About $6.3 billion was withdrawn from Binance hot wallets on Thursday. This is the largest theft in crypto market history. Withdrawals for the exchange's users still don't work.
Hot wallets are storages connected to the network. The exchange processes client withdrawals through them. The money in them is always at hand, which is why they become the target of attacks.
For a trader, this is not an abstraction. Against this backdrop, BTC dropped to around $77.2K, losing 5.25% in a day.
How did it happen?
The first unauthorized transfers were recorded by TRM Labs analysts on Thursday at around 23:05 Moscow time. Hot wallets were drained across several blockchains at once.
The market's previous record was the Bybit hack in February 2025 for $1.5 billion. That is four times less.
- EIP-7702 delegation. According to Richard Teng, co-head of Binance, the attacker used it to control the hot wallet bypassing standard approvals.
- Self-destruct mechanism. After withdrawing the funds, he erased the tools and traces.
- Entry point. An infected laptop of one of the engineers was suspected at first, but other breach points were found later.
- Keys intact. According to the exchange, there was no leak of private keys from the wallets.
How much has been recovered?
Partners froze about $3 billion. Part of the stolen funds got stuck in stablecoins, and their issuers blocked the addresses.
- Circle - approximately $823 million in USDC.
- Tether - more than $1.56 billion in USDT, according to Paolo Ardoino.
TRM Labs and Chainalysis attribute the attack to the North Korean group TraderTraitor. The FBI blamed the same group for the Bybit hack. The FBI and the US Secret Service are already working with the exchange and tracking the transfers.
How is the exchange closing the hole?
Binance has reserved $6.34 billion to compensate clients. Of this amount, $5 billion is already held in the affected tokens.
The exchange is buying the rest on the market and through over-the-counter deals. CertiK says there is not enough data for an independent verification of these reserves.
Key point: withdrawals are promised to be restored by Sunday, and a full reserves report on Monday. Until then, money cannot be withdrawn from the exchange.
What's next?
The market is already adjusting. Aave on Friday restored its markets after a pause on deposits and loans.
If you trade crypto on a prop firm account, check the terms for overnight positions and the coin list in advance. You can compare programs in the prop firm catalog or pick a challenge for your market.
Were you holding a position when withdrawals were cut off?
A night like this is remembered by the notifications: minus 5% on BTC and an exchange you can no longer withdraw money from. On a prop firm account, the question shifts to the rules, and they differ: some calculate the daily limit from floating loss and will cut the position while you sleep, while others don't allow crypto to be held overnight at all. The coin list and weekend access also differ from program to program. These points are checked before paying for the evaluation. And not on another Thursday like this.