Key Takeaways
Binance estimates its losses from the hack at about $6.3 billion, making it the largest hack on record and more than four times the $1.46 billion stolen from Bybit.
The attacker entered Binance's internal systems through an employee's laptop and, instead of submitting a withdrawal request, obtained a signature on an EIP-7702 authorization that handed over control of the wallet. TraderTraitor, a North Korean hacking group that has relied mainly on social engineering, has been named as the likely perpetrator.
FTX collapsed after misusing customer funds. Binance's losses resulted from an external hack, and the exchange has pledged to cover them with its own funds.
The $3 billion that has been frozen has not yet been returned, however, and the SAFU fund can cover only 18% of the losses. Whether Binance has enough company funds to cover the remaining $5.1 billion or so has not been verified.
Customer outflows once deposits and withdrawals resume, along with the stolen assets that have moved into DeFi, are the next risks to watch, and the impact is expected to spread beyond Binance to the broader DeFi market.
1. Scale of the Loss and Timeline
Binance, the world's largest crypto exchange, has been hacked. Blockchain researcher Spreek disclosed on X that assets in a Binance-linked wallet had been moved to new addresses, and Binance founder Changpeng Zhao later acknowledged the hack. All times below are KST.
05:24: 167,464 ETH and about 1.6 billion USDT are drained from the Binance hot wallet "Binance 14" in a single transaction
05:32: On-chain researcher Spreek is the first to flag the unusual transaction on X
06:15: Changpeng Zhao states that "Binance appears to have been hacked"
06:16: Binance issues its first official statement, saying it is "investigating a potential security issue"
06:18 to 06:25: Circle (800 million USDC) and Tether (1.57 billion USDT) freeze assets linked to the attacker
09:13: Binance suspends all deposits and withdrawals and says it will "cover all losses"
09:52: Binance confirms that $3 billion in stolen funds has been frozen
11:23: Binance publishes its initial findings: total losses of about $6.3 billion, caused by a compromised DevOps engineer's laptop
Binance estimates total losses at about $6.3 billion, more than four times the $1.46 billion stolen from Bybit in the previous largest hack.
2. How the Attack Worked
Binance has released only its initial findings and has not yet published a detailed post-mortem.
2.1. Forged Requests: The Common Thread in Recent Exchange Hacks
In recent large exchange hacks, attackers did not steal private keys. They targeted the signing system that uses those keys to sign transactions.
To send crypto assets out of an exchange, a transaction must be signed with the wallet's private key. Exchanges store these keys in signing systems rather than entrusting them to individual employees, and when a withdrawal request comes in, the system checks the recipient address, the amount, and other details before signing and sending the transaction.
Cold wallets (wallets that keep keys offline) and multisig wallets (which require several parties to sign) also go through this verification step before a signature is produced.
This verification step is what attackers target. After breaking into an employee's computer or an internal server, an attacker can submit a fake request that looks like a normal withdrawal directly to the signing system, or alter what an employee sees on the approval screen. This is a forged request. If the signing system accepts it as genuine, the attacker can send assets anywhere without ever holding the private key.
In recent cases, attackers have most often reached employees' devices through social engineering.
Social engineering: an attack that exploits human error rather than technical flaws, for example by impersonating a recruiter or business counterparty to get a target to open a malicious file, or by tricking someone into approving a transaction on a fake screen
In earlier incidents, attackers also compromised employee devices at Bybit and DMM Bitcoin through social engineering.
Bybit (social engineering, February 2025, $1.46 billion): The attackers infected a developer's computer at wallet provider Safe with malware and then falsified the signing screen. The signers believed they were approving a routine transfer, but the transaction in fact handed over control of the cold wallet. (Sygnia, Safe post-mortem)
DMM Bitcoin (social engineering, May 2024, $305 million): A North Korean hacking group posed as a recruiter to take over the account of an employee at the exchange's wallet software provider, then swapped out a legitimate withdrawal request in transit. (Japan's National Police Agency and FBI)
In both cases, the attackers first deceived a person to get inside and then used a forged request to deceive the signing system. However carefully keys are protected with cold wallets and multisig, one compromised employee and a signing system that cannot filter out forged requests are enough to cause a breach.
2.2. What Was Different at Binance
Binance also appears to have been breached through social engineering.
Binance has said only that an engineer's laptop was compromised and that the attacker reached its internal systems through it, without disclosing how the laptop was breached. TraderTraitor, the North Korean group that TRM Labs has named as the likely perpetrator, gained access to employee devices in the Bybit and DMM Bitcoin attacks through social engineering such as posing as recruiters.
What made the losses so large was an Ethereum feature called EIP-7702.
EIP-7702 lets a regular wallet sign an authorization allowing a designated program (a smart contract) to act on the wallet's behalf. It was introduced in May 2025 to make wallets easier to use, for example by bundling several transactions into one. Once a wallet signs such an authorization, however, that program can move all of the assets in the wallet.
The attacker exploited this. Once inside Binance's internal systems, the attacker submitted this authorization to the signing system instead of a withdrawal request. Because the authorization contains neither a recipient address nor an amount, it did not trigger the withdrawal checks, and once it was signed, control of the Binance hot wallet passed to a program the attacker had built.
Three minutes later, the attacker ran the program and drained 63 different tokens, including ETH and USDT, in a single transaction.
3. Will Binance Go the Way of FTX?
The question the market is most concerned about is whether Binance will collapse like FTX. The losses arose differently from those at FTX, but it is too early to say whether Binance can absorb them in full.
3.1. A Different Kind of Loss from FTX
The cause of the problem differs between Binance and FTX. FTX's problem was not a hack but the reckless use of customer funds.
When crypto prices collapsed after the Terra-Luna crash in May 2022, lenders to FTX's affiliate Alameda Research all demanded repayment at once, and about $8 billion in FTX customer deposits was sent to Alameda to repay them. When a report raising doubts about FTX's finances appeared that November, customers rushed to withdraw, but their money had already gone to Alameda. Unable to return customer funds, FTX went bankrupt.
Binance's loss, by contrast, came from assets stolen through a hack. Binance has said it will cover the loss with its emergency fund (SAFU) and its own corporate funds rather than customer money. The question is whether Binance has enough of its own funds to cover the loss.
3.2. Can Binance Absorb the Loss?
Binance estimates total losses at $6.3 billion, about 4.4% of the roughly $144 billion in assets it holds. Stablecoin issuers including Tether and Circle have frozen $3 billion of that amount, but a freeze only stops the attacker from using the funds and does not return them to Binance. The actual loss falls to about $3.3 billion (2.3% of assets) only once the frozen funds are recovered through law enforcement and issuer procedures.
Until the frozen assets are returned, Binance therefore has to cover the full $6.3 billion up front. The SAFU fund (about $1.16 billion) can cover only 18% of that, leaving roughly $5.1 billion to come from company funds. The difficulty is that Binance does not publish financial statements, so the size of its corporate funds cannot be verified.
A second problem comes after deposits and withdrawals reopen.
Covering the hack losses and withstanding a rush of withdrawals by anxious customers are separate problems. Within 24 hours of its hack, Bybit saw $4 billion, about 24% of its assets, leave the exchange. If Binance experienced a similar outflow of roughly 24% of its assets, withdrawals could reach about $35 billion, more than five times the $6.3 billion lost in the hack.
Binance therefore needs to set out how it will handle large-scale withdrawals before it resumes deposits and withdrawals.
The most important questions are how Binance will fund withdrawals until the frozen assets are returned, and when it will publish an updated proof of reserves. Without concrete plans by the time deposits and withdrawals reopen, customer anxiety could escalate into a large-scale bank run.
4. Cascading Bank Runs
A bank run at Binance is only the first-order problem, because in crypto a single asset is connected to many DeFi protocols.
For now, issuers can freeze only stablecoins, so the attacker converted the remaining assets into ETH and moved them into DeFi. For example, the attacker deposited stolen USDT on Aave and borrowed ETH against it. In response, Aave, the largest DeFi lending protocol, froze all of its markets to prevent further damage.
In other words, the damage may not stop at Binance and could spread to the DeFi protocols connected to it. The Kelp DAO hack in April, for example, caused $290 million in losses, but as fear spread, total deposits across DeFi fell by $13.2 billion over two days, 45 times the amount stolen.
A second-order bank run is therefore also possible. If the ETH and DeFi tokens held by the attacker are sold into the market, or if the Aave freeze drags on unresolved and deposits start to leave once withdrawals reopen, a first-order run on Binance could lead to a second-order run across DeFi markets.
In the end, Binance needs to present a concrete plan for covering the hack losses. As noted above, the amount may not be a critical problem for an exchange of Binance’s size, but no one can be certain, so its response will need to be watched closely.
🐯 More from Tiger Research
Read more reports related to this research.Disclaimer
This report has been prepared based on materials believed to be reliable. However, we do not expressly or impliedly warrant the accuracy, completeness, and suitability of the information. We disclaim any liability for any losses arising from the use of this report or its contents. The conclusions and recommendations in this report are based on information available at the time of preparation and are subject to change without notice. All projects, estimates, forecasts, objectives, opinions, and views expressed in this report are subject to change without notice and may differ from or be contrary to the opinions of others or other organizations.
This document is for informational purposes only and should not be considered legal, business, investment, or tax advice. Any references to securities or digital assets are for illustrative purposes only and do not constitute an investment recommendation or an offer to provide investment advisory services. This material is not directed at investors or potential investors.
Terms of Usage
Tiger Research allows the fair use of its reports. ‘Fair use’ is a principle that broadly permits the use of specific content for public interest purposes, as long as it doesn’t harm the commercial value of the material. If the use aligns with the purpose of fair use, the reports can be utilized without prior permission. However, when citing Tiger Research’s reports, it is mandatory to 1) clearly state ‘Tiger Research’ as the source, 2) include the Tiger Research logo. If the material is to be restructured and published, separate negotiations are required. Unauthorized use of the reports may result in legal action.
