Binance Drained of $6.4 Billion in Largest Crypto Hack; North Korea's TraderTraitor Blamed

Attackers drained roughly $6.4 billion from Binance on Thursday, beginning about 4:05 p.m. ET after U.S. markets closed, moving funds from hot wallets across about 10 blockchains mostly within 20 minutes. Chainalysis and TRM Labs called it more than four times the previous record, February 2025's $1.5 billion Bybit heist. TRM Labs and Chainalysis attributed the breach to TraderTraitor, a North Korean state-linked group also blamed for Bybit. Binance traced the attack to a compromised DevOps engineer's laptop but said its investigation found additional breach points; CEO Richard Teng said wallet private keys were not leaked. On Ethereum, the attacker used EIP-7702 pre-signed authorizations to convert a hot wallet into a "sweeper" contract. Tether froze over $1.5 billion and Circle about $823 million, leaving roughly $3 billion frozen or located. Elliptic estimated the attacker still controls about $3.3 billion. Teng said Binance will cover all losses with company funds and its Secure Asset Fund for Users, setting aside more than $6.34 billion, and aims to restore withdrawals by Sunday. Bitcoin fell about 4% to roughly $76,400 on Friday.