The largest cryptocurrency theft ever recorded may not have involved hackers stealing Binance’s private wallet keys at all.
Instead, the emerging evidence suggests attackers found something potentially more valuable: access to infrastructure trusted to tell those wallets when to move money.
Around $6.3bn was transferred from Binance-controlled wallets across 10 blockchains on October 29, with most of the theft unfolding during a period of roughly 20 minutes.
Bitcoin, Ether, XRP, Solana, USDT, USDC and numerous other digital assets were moved towards attacker-controlled addresses before Binance and companies across the cryptocurrency industry began trying to freeze the funds.
Binance initially traced the incident to a compromised laptop belonging to a DevOps engineer, which allowed access to a service container capable of submitting unauthorised withdrawal transactions.
The company subsequently said it had uncovered additional points of breach.
Most importantly, Binance says it has found no evidence that the private keys controlling its wallets were leaked.
BPI News spoke to Pakistani cyber-security expert Siraj ul-Haq and an experienced hacker who requested anonymity because of the nature of his work to understand what that could mean.
Both point towards the same important distinction.
The attackers may not have broken into individual cryptocurrency wallets one by one. They may instead have compromised part of the machinery sitting above them.
The Laptop May Have Been Only The Beginning
Siraj ul-Haq told BPI News that the compromised engineer’s laptop should not automatically be treated as the whole explanation.
“The laptop was probably only the entry point, not the whole attack. In an organisation the size of Binance, compromising one engineer’s machine would not normally be enough on its own to move billions of dollars across multiple blockchains.”
He said Binance’s discovery of additional breach points indicates investigators must examine what happened after that first compromise.
“What this looks like is a multi-stage intrusion. The attackers may have spent time understanding the internal systems, escalating their access and identifying which services ultimately interacted with the hot wallets. The theft itself may have happened very quickly, but the preparation could have taken much longer.”
The anonymous hacker who spoke to BPI News went further.
In his assessment, an operation capable of draining wallets across multiple networks would likely require significant reconnaissance before the visible theft.
“Speed on the day comes from how much preparation happened beforehand. Moving that amount across several networks is not something you improvise.”
He believes attackers could potentially have spent months mapping internal systems before executing the theft, although there is currently no public evidence establishing exactly how long the attackers had access.
“The money can disappear in minutes, but the real intrusion may have begun months earlier. An attacker needs to understand where the trusted systems are, how transactions are approved and which internal services eventually reach the signing infrastructure.”
That distinction is critical because the moment billions left Binance was when the attack became visible. It may not have been when the attack began.
How Do You Steal $6.3bn Without Stealing The Private Keys?
Cryptocurrency is controlled through cryptographic signatures. If somebody controls a private key, they can normally authorise transactions from the corresponding wallet.
That creates an obvious assumption that if billions were stolen, the hackers must have stolen Binance’s keys.
Binance says that does not appear to have happened.
Siraj explained that sophisticated attackers do not necessarily need the key itself if they can reach systems authorised to use it.
“A lot of people assume a crypto hack means somebody stole a seed phrase or private key, but that is not always how sophisticated attacks work. If you can compromise the systems that are authorised to request signatures, you may not need to steal the key itself.”
He compared it with compromising the controls around a bank vault rather than attacking the vault directly.
“You do not necessarily need to break the vault if you can compromise the system that is authorised to tell it when to open.”
The anonymous hacker described the same problem from an attacker’s perspective.
“Amateurs chase the key. A more sophisticated attacker looks at what is allowed to command the key.”
If a trusted transaction system, approval service or high-privilege session is compromised, he said, the resulting blockchain transaction can still look completely legitimate.
“The signing machine can do exactly what it was designed to do. The dangerous part is that the instruction reaching it is no longer coming from somebody you should trust.”
This could explain how Binance can say its keys remained secure while valid transactions still removed billions of dollars.
One Compromise Could Explain Ten Blockchains
The scale of the attack creates another important clue.
The funds did not leave one Ethereum wallet.
Binance wallets operating across Ethereum, Bitcoin, XRP Ledger, Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon all transferred assets during the attack.
Those networks use different technologies and signing systems.
That makes the possibility of 10 completely separate wallet compromises less persuasive than the possibility of an attack against infrastructure shared by multiple wallets.
The hacker BPI News spoke to said the multi-chain nature of the theft is one of the clearest reasons to look for a common point of control.
“If ten different chains are moving at roughly the same time, you start looking for the thing they share. Large exchanges need central systems to manage liquidity and automate movements between wallets.”
He said an attacker would not necessarily need to separately defeat Bitcoin, Ethereum and Solana security if there were a trusted layer capable of instructing all of them.
“You do not need to break into ten separate vaults if there is a trusted control layer above them.”
Siraj agreed that this is where the wider security questions begin.
“The issue is not simply whether the private keys are protected. You also have to protect every service, API and privileged system that is trusted to make use of those keys.”
It is important to stress that this is a model of how such a compromise could work based on the available evidence and expert analysis. Binance has not yet published its complete internal architecture or confirmed that a single treasury platform was the exact point compromised.
Ethereum Shows How Carefully The Attack Was Prepared
The Ethereum component gives investigators one of their clearest public views into the operation.
Blockchain analysis indicates the attackers used EIP-7702, an Ethereum feature introduced through the Pectra upgrade that allows a standard account to delegate certain behaviour to smart-contract code.
The attacker submitted a batch containing 50 authorisations that had already been signed by a Binance hot wallet.
Those authorisations covered consecutive transaction counts, known as nonces.
Because a busy Binance wallet continually processes transactions, the correct nonce changes.
By preparing authorisations across multiple possible values, the attacker increased the likelihood that one would remain valid at the moment of execution.
One did.
A little over three minutes after the successful delegation, more than 167,000 ETH and dozens of tokens were swept from the wallet.
The same delegation was subsequently capable of sweeping additional funds arriving at the address.
Siraj said this demonstrates why investigators cannot concentrate only on whether the private key itself was exposed.
“The transactions can still be cryptographically valid while the instructions behind them are malicious.”
The anonymous hacker said extensive preparation makes sense when an attacker knows defenders will start reacting immediately after the first enormous transaction appears.
“Once the first major transaction appears, the clock starts. Security teams begin investigating, access gets revoked and withdrawals can be suspended. If an attacker has reached that stage, they want as much of the operation prepared beforehand as possible.”
Rather than processing everything one by one, a prepared attacker can release large numbers of transactions almost simultaneously.
Should Binance Have Stopped It?
This may become one of the most difficult questions for Binance.
If billions of dollars began leaving several wallets across numerous networks, why did automated systems not stop the transfers?
Siraj described the incident as raising serious questions about transaction controls.
“At this scale, you would expect strong controls around transaction velocity, unusual destination addresses and sudden changes in withdrawal behaviour.”
He said an event involving billions moving simultaneously should be treated very differently from normal customer withdrawals.
“If billions begin leaving multiple hot wallets at the same time, that should trigger additional checks or an automatic pause. The investigation will need to establish what controls Binance already had, whether they were bypassed and why they did not stop the transfers sooner.”
Binance has not yet published enough information to answer that conclusively.
The exchange has promised a detailed technical post-mortem once the investigation is complete.
Stealing The Money Was Only The First Problem
The attackers then faced an entirely different challenge.
Not all cryptocurrency can be treated the same way after it has been stolen.
Stablecoins such as USDT and USDC are issued by companies capable of blacklisting assets associated with particular addresses.
That allowed token issuers and blockchain companies to react quickly.
Binance says around $3bn of affected assets have now been frozen.
The attackers appear to have understood that stablecoins were particularly vulnerable and quickly began converting some of them into assets such as Ether that cannot be frozen by a central company.
The anonymous hacker explained why an attacker might willingly accept a significant loss during those conversions.
“If an asset can be frozen, speed is more important than getting the perfect price. Losing part of the value in a conversion is still better for the attacker than having the entire balance frozen.”
Siraj described the recovery problem as being divided between two very different types of asset.
“With centralised stablecoins such as USDT or USDC, the issuer has the ability to freeze identified assets, which is why such a large amount was stopped so quickly.”
Bitcoin and Ether create a much harder problem.
“There is no company that can simply freeze somebody’s Bitcoin. Investigators can follow the funds on the blockchain, but being able to see where the money is does not mean they can immediately take control of it.”
Blockchain investigators estimate the attackers continue to control enormous amounts of Bitcoin and Ether outside the immediate reach of token issuers.
The Hardest Part May Be Spending It
Stealing billions of dollars in cryptocurrency and successfully using that money are very different challenges.
The anonymous hacker told BPI News that cashing out such an enormous amount could ultimately be more difficult than stealing it.
“The hardest stage is turning an enormous amount of stolen crypto into something usable without connecting it back to the people behind the attack.”
Bitcoin and Ethereum transactions are publicly recorded.
Investigators can label addresses connected with the Binance theft and continue monitoring them whenever funds move.
Attackers can complicate that trail by moving funds between addresses, exchanging assets and using multiple blockchain networks, but the original transaction history does not simply disappear.
Eventually, at least some of the value is likely to encounter an exchange, broker or other financial intermediary.
That could give investigators an opportunity.
Siraj said this may be where the recovery operation eventually succeeds.
“The real opportunity often comes later, when the attackers try to move the money through an exchange, broker, bridge or another service that law enforcement can reach.”
The anonymous hacker said patience becomes part of the attacker’s strategy.
“An attacker may be prepared to leave funds untouched for years rather than immediately trying to cash everything out. Investigators can also leave alerts on those wallets for years. One mistake later can reopen the entire trail.”
That is why the recovery process could continue long after the Binance systems themselves have been repaired.
Is North Korea Behind It?
The leading public attribution points towards North Korea.
TRM Labs says it has high confidence that TraderTraitor, a North Korean hacking operation associated with the wider Lazarus ecosystem, was responsible.
Other blockchain investigators have also pointed towards North Korean involvement.
Binance has not publicly confirmed the identity of the attackers, and law enforcement has not yet announced a formal attribution for this specific incident.
Siraj said the similarities with previous North Korean operations deserve serious attention.
“There are certainly similarities with previous attacks attributed to North Korean groups, particularly TraderTraitor and the wider Lazarus ecosystem.”
He said the preparation before the theft, the rapid movement across multiple chains and the effort to convert assets vulnerable to freezes fit patterns previously observed in sophisticated state-linked operations.
However, he cautioned against treating attribution as settled.
“The technical similarities are significant, and the assessments from blockchain intelligence firms deserve to be taken seriously, but I would still wait for formal findings from law enforcement before treating North Korean responsibility as conclusively established.”
The anonymous hacker was more convinced that the operation had the characteristics of state-backed activity.
“The scale, preparation and willingness to manage this amount of attention look much more like a state-backed operation than an ordinary criminal crew.”
He said patience is another reason the state-backed theory is plausible.
“A normal criminal gang usually wants to get paid. A state operation can afford to be patient.”
The Bybit Attack Shows How Difficult Recovery Can Become
There is a recent precedent.
North Korea’s TraderTraitor operation was formally blamed by the FBI for stealing approximately $1.5bn from Bybit in February 2025.
The assets were rapidly converted and spread across numerous addresses.
Around 18 months later, Bybit said it had recovered approximately $48.4m and frozen another $30.5m.
That represents only a small portion of what was stolen.
Binance begins its recovery operation from a stronger position because approximately $3bn was frozen quickly.
However, recovering every Bitcoin and Ether controlled by the attackers could still take years.
Some of it may never return.
Will Binance Customers Get Their Money Back?
Binance says they will.
The exchange has promised to cover all losses through its SAFU protection fund and wider company resources.
This creates two separate financial questions.
The first is whether Binance can restore its customers’ assets.
The company says it can and has reserved more than enough resources to cover the estimated impact.
The second question is whether Binance itself can eventually recover everything that was stolen.
That is much less certain.
If frozen assets are returned, Binance’s permanent corporate loss falls.
If stolen Bitcoin and Ether remain outside its control, Binance may ultimately have to absorb that loss itself.
The company’s promised updated Proof of Reserves will therefore be an important part of rebuilding confidence.
Customers will want to see that assets have genuinely been restored and that normal withdrawals can resume without difficulty.
What Other Exchanges Should Learn
Siraj said the wider lesson for the cryptocurrency industry is that security cannot end with protecting private keys.
“Protecting the key is not enough. You have to protect the entire chain of systems that can instruct that key to sign.”
He believes exchanges should examine how their development environments interact with production wallet systems and ensure that ordinary engineering access cannot provide a pathway towards transaction approval.
Greater isolation of privileged systems, multi-party signing and stronger automated monitoring should all form part of that review.
The attack also revives the long-running debate around customers keeping cryptocurrency on centralised exchanges.
“Keeping cryptocurrency on an exchange always means trusting that exchange’s security, internal controls and financial strength.”
Binance says it can absorb this loss.
A smaller exchange facing the same attack might not have that option.
BPI News Analysis
The most significant aspect of the Binance theft may eventually be what the attackers did not need to break.
There is no evidence Bitcoin’s cryptography failed, Ethereum was cracked or Binance’s private wallet keys were directly stolen.
Instead, the available evidence points towards attackers exploiting the infrastructure surrounding those highly secure systems.
That distinction matters because a cryptographic key can remain protected while the service trusted to request its signature is compromised.
From the blockchain’s perspective, a valid signature is a valid signature. The network cannot know that the system requesting it may have been taken over by an attacker.
That is why this incident has implications far beyond Binance.
The exchange now has to explain how systems associated with assets across 10 networks were apparently manipulated during the same operation and why the resulting transfers were not stopped sooner.
The recovery process presents a completely different challenge.
Around $3bn being frozen demonstrates how quickly centralised token issuers can intervene when stolen assets remain within their control.
Bitcoin and Ether demonstrate the opposite side of cryptocurrency.
Their decentralisation makes arbitrary freezes difficult, but that same design makes recovering stolen funds much harder.
The attackers may therefore control billions while knowing that every significant movement can continue to be monitored.
They can make the trail more complicated, but they cannot erase blockchain history.
Their greatest vulnerability may ultimately come when somebody tries to turn those digital assets into something usable.
That could happen within weeks or years from now.
For Binance, the immediate challenge is much closer.
It must reimburse customers, restore normal services, demonstrate sufficient reserves and explain how the largest cryptocurrency theft in history was able to unfold through infrastructure it controlled.
The money disappeared quickly.
Understanding exactly how the attackers reached it and recovering everything they took could take considerably longer.
