The biggest theft in crypto history. What happened to Binance?

On the evening of October 29, hackers withdrew approximately $6.3 billion from Binance's hot wallets across 10 blockchains in just a couple of hours. This is the largest theft in the history of the crypto industry (approximately four times larger than the Bybit hack in February 2025).

In this article, we'll outline the full chronology and mechanics of the attack, discuss the true final damage (given that some USDT and USDC were frozen), whether the exchange will go bankrupt, and how the average crypto trader or arbitrageur can protect themselves from such a scam.

How did the Binance cyberattack occur?

There were some warning signs that a cyberattack was brewing on Binance. Two days before the attack, the crypto exchange reported that it had repelled several cyberattacks by North Korean hackers over the previous week. These attacks followed the following pattern: a hacker interviews for a coding position at Binance, receives a test assignment, and embeds a virus into the test assignment file. These threats were successfully eliminated without any loss of funds.

But the hackers' attempts didn't stop there. Preparations for a new attack began on October 28, when the attacker's wallet ( 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , which was used to transfer the stolen funds) received three transfers via the Tornado Cash mixer.

At 15:59 UTC, a vacuum cleaner contract (also known as Sweeper) was deployed, controlled only by the hacker. Before stealing from Binance, the hacker rehearsed the scheme on three of his wallets, each containing small amounts (between $2 and $6).

The attack began at 8:05 PM UTC. Within 20 minutes, wallets containing XRP, Solana, ETH, and BTC were emptied. The total amount stolen was approximately $6.36 billion. For clarity, we've compiled a table showing exactly what the hackers stole from different networks:

Net	What did hackers steal?	Rating, $
Ethereum	200,630 ETH and 185 other tokens, including 1.875 billion USDT, 823 million USDC, 88.5 million RLUSD	~3.79 billion
Bitcoin	18,270 BTC	~1.47 billion
Tron	612.7 million USDT and 46.4 million TRX	~628 million
XRP Ledger	233.46 million XRP	~296 million
Solana	970,500 SOL	~96 million
Other Networks	Miscellaneous assets (including ARB 74.6 million)	~77 million
Total		~6.36 billion

By 9:15 PM, the exchange's founder, CZ, wrote that it looked like a hack, but user funds were safe (he would later reiterate his claim about the security of user funds). An hour later, Binance officially halted withdrawals, but this didn't stop the hacker, and by 11:05 PM UTC, a second wave of hacking began – this time, the exchange's wallets on the Avalanche and Polygon networks were emptied.

Around the same time, there was some hype about hacks at a number of crypto exchanges – Bybit, Coinbase, and so on. But no other exchanges were affected that evening.

Attack mechanism

The attacker himself did not hack blockchains or find bugs in smart contracts: he gained the ability to create valid signatures on behalf of Binance hot wallets across 10 networks at once.

The entry point was a DevOps engineer's laptop. It was through this laptop that the attacker gained access to the service container and sent unauthorized transactions for withdrawal.

Binance declined to comment on how the laptop was infected, but such attacks typically involve human intervention. For example, someone poses as a recruiter or business partner and somehow induces an employee to run malicious code (as in the fake test assignment attack).

Next, hackers in 9 out of 10 networks made standard signed withdrawals (which look exactly like a standard transfer from the Binance exchange - which is why the suspicious activity was not immediately mistaken for a hack).

In the case of Ethereum, hackers were able to turn the exchange's hot wallet into a "vacuum cleaner" thanks to the EIP-7702 standard, which allows wallet management to be entrusted to a smart contract. In a single transaction, the hackers sent 50 authorizations on behalf of the Binance wallet 14. Ultimately, one matched, so within three minutes the wallet was completely emptied of $2.5 billion, leaving behind a purely symbolic 1 ETH.

The total amount stolen was $6.3 billion, but Tether, Circle, and other crypto issuers responded quickly, allowing some assets to be frozen. So, let's look at the ultimate damage to the exchange and whether it will be able to cover it, or should users fear bankruptcy?

How much is actually lost?

First, let's talk about the funds that Binance won't be able to access. Primarily, we're talking about 18,270 BTC (worth $1.4 billion at the current price) and 420,000 ETH (another $1 billion), which no one will be able to freeze .

In addition, hackers were able to launder and convert funds using the following schemes:

• 325 million USDT were exchanged for Ethereum (receiving 122k ETH);
• We pledged 60 million USDT in AAVE and borrowed 19,762 WETH (~$44.6 million);
• In Tron, 300 million USDT went into the JustLend lending protocol, another 200 million passed through a wallet chain and were exchanged on Uniswap (of which only 30 million was frozen).
• Before being frozen by Ripple, the attacker managed to sell 48 million RLUSD.
• Seven stolen altcoins worth $158 million were also swapped into ETH.
• In addition, a fairly large amount of the stolen money passed through ThorChain.

Around $3 billion was frozen—a significant portion of Binance's funds was saved by Circle and Tether, so the total amount of damage actually amounts to approximately $3.3 billion, which is still the largest amount in history.

Let's also talk about the likelihood of Binance going bankrupt. It appears to still be close to zero, as the exchange's total assets before the hack exceeded $144 billion, meaning the net theft was only 2.5%, which can be covered from its own profits.

Binance has a reserve fund of approximately $1 billion in BTC. It's used for situations like these. Therefore, there's no need to panic; withdrawals from the crypto exchange will likely be open by November 1st.

What should crypto-users do?

First, withdraw funds from centralized crypto exchanges. If Binance, which has an excellent cybersecurity team, was hacked, then any other CEX could be hacked as well. Whales and institutions have already taken this step, according to Coindesk sources.

A good alternative would be a hardware wallet (just make sure the seller is authorized, otherwise you could end up with another scam) or a hot, non-custodial wallet on a separate device (for example, Trust Wallet), which is used only for transfers to the wallet address.

For larger amounts (or if you use crypto for business), multisig addresses are better suited.

You can also try to profit from the gradual decline in CEX by trading coins from decentralized exchanges like Hyperliquid (their HYPE token rose 18% despite the overall market decline) and Uniswap. However, it's important to be mindful of cryptocurrency volatility and the risks involved.

Conclusion

The Binance attack was the largest theft in the history of the crypto industry. The hackers didn't hack blockchains or search for bugs in smart contracts. They infected a DevOps engineer's laptop and used it to sign transactions on behalf of the exchange's hot wallets across 10 networks. On Ethereum, they also exploited the EIP-7702 standard and emptied one wallet of $2.5 billion in just three minutes.

In total, approximately $6.3 billion was stolen. Approximately $3 billion was frozen, largely thanks to Tether and Circle. The net loss is approximately $3.6 billion, which is still an all-time record. It won't bankrupt Binance: the loss amounts to approximately 2.5% of the exchange's assets, and it has a reserve fund for such events.

The main conclusion is that a centralized exchange is always someone else's wallet. If even Binance, with its strong security team, was hacked, then any CEX is vulnerable. Keep only what you're currently trading on the exchange, and store the rest in a hardware wallet, a non-custodial wallet on a separate device, or, for larger amounts, in a multisig address.

The biggest theft in crypto history. What happened to Binance?

On the evening of October 29, hackers withdrew approximately $6.3 billion from Binance's hot wallets across 10 blockchains in just a couple of hours. This is the largest theft in the history of the crypto industry (approximately four times larger than the Bybit hack in February 2025).

In this article, we'll outline the full chronology and mechanics of the attack, discuss the true final damage (given that some USDT and USDC were frozen), whether the exchange will go bankrupt, and how the average crypto trader or arbitrageur can protect themselves from such a scam.

How did the Binance cyberattack occur?

There were some warning signs that a cyberattack was brewing on Binance. Two days before the attack, the crypto exchange reported that it had repelled several cyberattacks by North Korean hackers over the previous week. These attacks followed the following pattern: a hacker interviews for a coding position at Binance, receives a test assignment, and embeds a virus into the test assignment file. These threats were successfully eliminated without any loss of funds.

But the hackers' attempts didn't stop there. Preparations for a new attack began on October 28, when the attacker's wallet ( 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , which was used to transfer the stolen funds) received three transfers via the Tornado Cash mixer.

At 15:59 UTC, a vacuum cleaner contract (also known as Sweeper) was deployed, controlled only by the hacker. Before stealing from Binance, the hacker rehearsed the scheme on three of his wallets, each containing small amounts (between $2 and $6).

The attack began at 8:05 PM UTC. Within 20 minutes, wallets containing XRP, Solana, ETH, and BTC were emptied. The total amount stolen was approximately $6.36 billion. For clarity, we've compiled a table showing exactly what the hackers stole from different networks:

Net	What did hackers steal?	Rating, $
Ethereum	200,630 ETH and 185 other tokens, including 1.875 billion USDT, 823 million USDC, 88.5 million RLUSD	~3.79 billion
Bitcoin	18,270 BTC	~1.47 billion
Tron	612.7 million USDT and 46.4 million TRX	~628 million
XRP Ledger	233.46 million XRP	~296 million
Solana	970,500 SOL	~96 million
Other Networks	Miscellaneous assets (including ARB 74.6 million)	~77 million
Total		~6.36 billion

By 9:15 PM, the exchange's founder, CZ, wrote that it looked like a hack, but user funds were safe (he would later reiterate his claim about the security of user funds). An hour later, Binance officially halted withdrawals, but this didn't stop the hacker, and by 11:05 PM UTC, a second wave of hacking began – this time, the exchange's wallets on the Avalanche and Polygon networks were emptied.

Around the same time, there was some hype about hacks at a number of crypto exchanges – Bybit, Coinbase, and so on. But no other exchanges were affected that evening.

Attack mechanism

The attacker himself did not hack blockchains or find bugs in smart contracts: he gained the ability to create valid signatures on behalf of Binance hot wallets across 10 networks at once.

The entry point was a DevOps engineer's laptop. It was through this laptop that the attacker gained access to the service container and sent unauthorized transactions for withdrawal.

Binance declined to comment on how the laptop was infected, but such attacks typically involve human intervention. For example, someone poses as a recruiter or business partner and somehow induces an employee to run malicious code (as in the fake test assignment attack).

Next, hackers in 9 out of 10 networks made standard signed withdrawals (which look exactly like a standard transfer from the Binance exchange - which is why the suspicious activity was not immediately mistaken for a hack).

In the case of Ethereum, hackers were able to turn the exchange's hot wallet into a "vacuum cleaner" thanks to the EIP-7702 standard, which allows wallet management to be entrusted to a smart contract. In a single transaction, the hackers sent 50 authorizations on behalf of the Binance wallet 14. Ultimately, one matched, so within three minutes the wallet was completely emptied of $2.5 billion, leaving behind a purely symbolic 1 ETH.

The total amount stolen was $6.3 billion, but Tether, Circle, and other crypto issuers responded quickly, allowing some assets to be frozen. So, let's look at the ultimate damage to the exchange and whether it will be able to cover it, or should users fear bankruptcy?

How much is actually lost?

First, let's talk about the funds that Binance won't be able to access. Primarily, we're talking about 18,270 BTC (worth $1.4 billion at the current price) and 420,000 ETH (another $1 billion), which no one will be able to freeze .

In addition, hackers were able to launder and convert funds using the following schemes:

• 325 million USDT were exchanged for Ethereum (receiving 122k ETH);
• We pledged 60 million USDT in AAVE and borrowed 19,762 WETH (~$44.6 million);
• In Tron, 300 million USDT went into the JustLend lending protocol, another 200 million passed through a wallet chain and were exchanged on Uniswap (of which only 30 million was frozen).
• Before being frozen by Ripple, the attacker managed to sell 48 million RLUSD.
• Seven stolen altcoins worth $158 million were also swapped into ETH.
• In addition, a fairly large amount of the stolen money passed through ThorChain.

Around $3 billion was frozen—a significant portion of Binance's funds was saved by Circle and Tether, so the total amount of damage actually amounts to approximately $3.3 billion, which is still the largest amount in history.

Let's also talk about the likelihood of Binance going bankrupt. It appears to still be close to zero, as the exchange's total assets before the hack exceeded $144 billion, meaning the net theft was only 2.5%, which can be covered from its own profits.

Binance has a reserve fund of approximately $1 billion in BTC. It's used for situations like these. Therefore, there's no need to panic; withdrawals from the crypto exchange will likely be open by November 1st.

What should crypto-users do?

First, withdraw funds from centralized crypto exchanges. If Binance, which has an excellent cybersecurity team, was hacked, then any other CEX could be hacked as well. Whales and institutions have already taken this step, according to Coindesk sources.

A good alternative would be a hardware wallet (just make sure the seller is authorized, otherwise you could end up with another scam) or a hot, non-custodial wallet on a separate device (for example, Trust Wallet), which is used only for transfers to the wallet address.

For larger amounts (or if you use crypto for business), multisig addresses are better suited.

You can also try to profit from the gradual decline in CEX by trading coins from decentralized exchanges like Hyperliquid (their HYPE token rose 18% despite the overall market decline) and Uniswap. However, it's important to be mindful of cryptocurrency volatility and the risks involved.

Conclusion

The Binance attack was the largest theft in the history of the crypto industry. The hackers didn't hack blockchains or search for bugs in smart contracts. They infected a DevOps engineer's laptop and used it to sign transactions on behalf of the exchange's hot wallets across 10 networks. On Ethereum, they also exploited the EIP-7702 standard and emptied one wallet of $2.5 billion in just three minutes.

In total, approximately $6.3 billion was stolen. Approximately $3 billion was frozen, largely thanks to Tether and Circle. The net loss is approximately $3.6 billion, which is still an all-time record. It won't bankrupt Binance: the loss amounts to approximately 2.5% of the exchange's assets, and it has a reserve fund for such events.

The main conclusion is that a centralized exchange is always someone else's wallet. If even Binance, with its strong security team, was hacked, then any CEX is vulnerable. Keep only what you're currently trading on the exchange, and store the rest in a hardware wallet, a non-custodial wallet on a separate device, or, for larger amounts, in a multisig address.

The biggest theft in crypto history. What happened to Binance?

On the evening of October 29, hackers withdrew approximately $6.3 billion from Binance's hot wallets across 10 blockchains in just a couple of hours. This is the largest theft in the history of the crypto industry (approximately four times larger than the Bybit hack in February 2025).

In this article, we'll outline the full chronology and mechanics of the attack, discuss the true final damage (given that some USDT and USDC were frozen), whether the exchange will go bankrupt, and how the average crypto trader or arbitrageur can protect themselves from such a scam.

How did the Binance cyberattack occur?

There were some warning signs that a cyberattack was brewing on Binance. Two days before the attack, the crypto exchange reported that it had repelled several cyberattacks by North Korean hackers over the previous week. These attacks followed the following pattern: a hacker interviews for a coding position at Binance, receives a test assignment, and embeds a virus into the test assignment file. These threats were successfully eliminated without any loss of funds.

But the hackers' attempts didn't stop there. Preparations for a new attack began on October 28, when the attacker's wallet ( 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , which was used to transfer the stolen funds) received three transfers via the Tornado Cash mixer.

At 15:59 UTC, a vacuum cleaner contract (also known as Sweeper) was deployed, controlled only by the hacker. Before stealing from Binance, the hacker rehearsed the scheme on three of his wallets, each containing small amounts (between $2 and $6).

The attack began at 8:05 PM UTC. Within 20 minutes, wallets containing XRP, Solana, ETH, and BTC were emptied. The total amount stolen was approximately $6.36 billion. For clarity, we've compiled a table showing exactly what the hackers stole from different networks:

Net	What did hackers steal?	Rating, $
Ethereum	200,630 ETH and 185 other tokens, including 1.875 billion USDT, 823 million USDC, 88.5 million RLUSD	~3.79 billion
Bitcoin	18,270 BTC	~1.47 billion
Tron	612.7 million USDT and 46.4 million TRX	~628 million
XRP Ledger	233.46 million XRP	~296 million
Solana	970,500 SOL	~96 million
Other Networks	Miscellaneous assets (including ARB 74.6 million)	~77 million
Total		~6.36 billion

By 9:15 PM, the exchange's founder, CZ, wrote that it looked like a hack, but user funds were safe (he would later reiterate his claim about the security of user funds). An hour later, Binance officially halted withdrawals, but this didn't stop the hacker, and by 11:05 PM UTC, a second wave of hacking began – this time, the exchange's wallets on the Avalanche and Polygon networks were emptied.

Around the same time, there was some hype about hacks at a number of crypto exchanges – Bybit, Coinbase, and so on. But no other exchanges were affected that evening.

Attack mechanism

The attacker himself did not hack blockchains or find bugs in smart contracts: he gained the ability to create valid signatures on behalf of Binance hot wallets across 10 networks at once.

The entry point was a DevOps engineer's laptop. It was through this laptop that the attacker gained access to the service container and sent unauthorized transactions for withdrawal.

Binance declined to comment on how the laptop was infected, but such attacks typically involve human intervention. For example, someone poses as a recruiter or business partner and somehow induces an employee to run malicious code (as in the fake test assignment attack).

Next, hackers in 9 out of 10 networks made standard signed withdrawals (which look exactly like a standard transfer from the Binance exchange - which is why the suspicious activity was not immediately mistaken for a hack).

In the case of Ethereum, hackers were able to turn the exchange's hot wallet into a "vacuum cleaner" thanks to the EIP-7702 standard, which allows wallet management to be entrusted to a smart contract. In a single transaction, the hackers sent 50 authorizations on behalf of the Binance wallet 14. Ultimately, one matched, so within three minutes the wallet was completely emptied of $2.5 billion, leaving behind a purely symbolic 1 ETH.

The total amount stolen was $6.3 billion, but Tether, Circle, and other crypto issuers responded quickly, allowing some assets to be frozen. So, let's look at the ultimate damage to the exchange and whether it will be able to cover it, or should users fear bankruptcy?

How much is actually lost?

First, let's talk about the funds that Binance won't be able to access. Primarily, we're talking about 18,270 BTC (worth $1.4 billion at the current price) and 420,000 ETH (another $1 billion), which no one will be able to freeze .

In addition, hackers were able to launder and convert funds using the following schemes:

• 325 million USDT were exchanged for Ethereum (receiving 122k ETH);
• We pledged 60 million USDT in AAVE and borrowed 19,762 WETH (~$44.6 million);
• In Tron, 300 million USDT went into the JustLend lending protocol, another 200 million passed through a wallet chain and were exchanged on Uniswap (of which only 30 million was frozen).
• Before being frozen by Ripple, the attacker managed to sell 48 million RLUSD.
• Seven stolen altcoins worth $158 million were also swapped into ETH.
• In addition, a fairly large amount of the stolen money passed through ThorChain.

Around $3 billion was frozen—a significant portion of Binance's funds was saved by Circle and Tether, so the total amount of damage actually amounts to approximately $3.3 billion, which is still the largest amount in history.

Let's also talk about the likelihood of Binance going bankrupt. It appears to still be close to zero, as the exchange's total assets before the hack exceeded $144 billion, meaning the net theft was only 2.5%, which can be covered from its own profits.

Binance has a reserve fund of approximately $1 billion in BTC. It's used for situations like these. Therefore, there's no need to panic; withdrawals from the crypto exchange will likely be open by November 1st.

What should crypto-users do?

First, withdraw funds from centralized crypto exchanges. If Binance, which has an excellent cybersecurity team, was hacked, then any other CEX could be hacked as well. Whales and institutions have already taken this step, according to Coindesk sources.

A good alternative would be a hardware wallet (just make sure the seller is authorized, otherwise you could end up with another scam) or a hot, non-custodial wallet on a separate device (for example, Trust Wallet), which is used only for transfers to the wallet address.

For larger amounts (or if you use crypto for business), multisig addresses are better suited.

You can also try to profit from the gradual decline in CEX by trading coins from decentralized exchanges like Hyperliquid (their HYPE token rose 18% despite the overall market decline) and Uniswap. However, it's important to be mindful of cryptocurrency volatility and the risks involved.

Conclusion

The Binance attack was the largest theft in the history of the crypto industry. The hackers didn't hack blockchains or search for bugs in smart contracts. They infected a DevOps engineer's laptop and used it to sign transactions on behalf of the exchange's hot wallets across 10 networks. On Ethereum, they also exploited the EIP-7702 standard and emptied one wallet of $2.5 billion in just three minutes.

In total, approximately $6.3 billion was stolen. Approximately $3 billion was frozen, largely thanks to Tether and Circle. The net loss is approximately $3.6 billion, which is still an all-time record. It won't bankrupt Binance: the loss amounts to approximately 2.5% of the exchange's assets, and it has a reserve fund for such events.

The main conclusion is that a centralized exchange is always someone else's wallet. If even Binance, with its strong security team, was hacked, then any CEX is vulnerable. Keep only what you're currently trading on the exchange, and store the rest in a hardware wallet, a non-custodial wallet on a separate device, or, for larger amounts, in a multisig address.

The biggest theft in crypto history. What happened to Binance?

On the evening of October 29, hackers withdrew approximately $6.3 billion from Binance's hot wallets across 10 blockchains in just a couple of hours. This is the largest theft in the history of the crypto industry (approximately four times larger than the Bybit hack in February 2025).

In this article, we'll outline the full chronology and mechanics of the attack, discuss the true final damage (given that some USDT and USDC were frozen), whether the exchange will go bankrupt, and how the average crypto trader or arbitrageur can protect themselves from such a scam.

How did the Binance cyberattack occur?

There were some warning signs that a cyberattack was brewing on Binance. Two days before the attack, the crypto exchange reported that it had repelled several cyberattacks by North Korean hackers over the previous week. These attacks followed the following pattern: a hacker interviews for a coding position at Binance, receives a test assignment, and embeds a virus into the test assignment file. These threats were successfully eliminated without any loss of funds.

But the hackers' attempts didn't stop there. Preparations for a new attack began on October 28, when the attacker's wallet ( 0x7C8601d4645b93cea45F71e118A729332e6B5CA0 , which was used to transfer the stolen funds) received three transfers via the Tornado Cash mixer.

At 15:59 UTC, a vacuum cleaner contract (also known as Sweeper) was deployed, controlled only by the hacker. Before stealing from Binance, the hacker rehearsed the scheme on three of his wallets, each containing small amounts (between $2 and $6).

The attack began at 8:05 PM UTC. Within 20 minutes, wallets containing XRP, Solana, ETH, and BTC were emptied. The total amount stolen was approximately $6.36 billion. For clarity, we've compiled a table showing exactly what the hackers stole from different networks:

Net	What did hackers steal?	Rating, $
Ethereum	200,630 ETH and 185 other tokens, including 1.875 billion USDT, 823 million USDC, 88.5 million RLUSD	~3.79 billion
Bitcoin	18,270 BTC	~1.47 billion
Tron	612.7 million USDT and 46.4 million TRX	~628 million
XRP Ledger	233.46 million XRP	~296 million
Solana	970,500 SOL	~96 million
Other Networks	Miscellaneous assets (including ARB 74.6 million)	~77 million
Total		~6.36 billion

By 9:15 PM, the exchange's founder, CZ, wrote that it looked like a hack, but user funds were safe (he would later reiterate his claim about the security of user funds). An hour later, Binance officially halted withdrawals, but this didn't stop the hacker, and by 11:05 PM UTC, a second wave of hacking began – this time, the exchange's wallets on the Avalanche and Polygon networks were emptied.

Around the same time, there was some hype about hacks at a number of crypto exchanges – Bybit, Coinbase, and so on. But no other exchanges were affected that evening.

Attack mechanism

The attacker himself did not hack blockchains or find bugs in smart contracts: he gained the ability to create valid signatures on behalf of Binance hot wallets across 10 networks at once.

The entry point was a DevOps engineer's laptop. It was through this laptop that the attacker gained access to the service container and sent unauthorized transactions for withdrawal.

Binance declined to comment on how the laptop was infected, but such attacks typically involve human intervention. For example, someone poses as a recruiter or business partner and somehow induces an employee to run malicious code (as in the fake test assignment attack).

Next, hackers in 9 out of 10 networks made standard signed withdrawals (which look exactly like a standard transfer from the Binance exchange - which is why the suspicious activity was not immediately mistaken for a hack).

In the case of Ethereum, hackers were able to turn the exchange's hot wallet into a "vacuum cleaner" thanks to the EIP-7702 standard, which allows wallet management to be entrusted to a smart contract. In a single transaction, the hackers sent 50 authorizations on behalf of the Binance wallet 14. Ultimately, one matched, so within three minutes the wallet was completely emptied of $2.5 billion, leaving behind a purely symbolic 1 ETH.

The total amount stolen was $6.3 billion, but Tether, Circle, and other crypto issuers responded quickly, allowing some assets to be frozen. So, let's look at the ultimate damage to the exchange and whether it will be able to cover it, or should users fear bankruptcy?

How much is actually lost?

First, let's talk about the funds that Binance won't be able to access. Primarily, we're talking about 18,270 BTC (worth $1.4 billion at the current price) and 420,000 ETH (another $1 billion), which no one will be able to freeze .

In addition, hackers were able to launder and convert funds using the following schemes:

• 325 million USDT were exchanged for Ethereum (receiving 122k ETH);
• We pledged 60 million USDT in AAVE and borrowed 19,762 WETH (~$44.6 million);
• In Tron, 300 million USDT went into the JustLend lending protocol, another 200 million passed through a wallet chain and were exchanged on Uniswap (of which only 30 million was frozen).
• Before being frozen by Ripple, the attacker managed to sell 48 million RLUSD.
• Seven stolen altcoins worth $158 million were also swapped into ETH.
• In addition, a fairly large amount of the stolen money passed through ThorChain.

Around $3 billion was frozen—a significant portion of Binance's funds was saved by Circle and Tether, so the total amount of damage actually amounts to approximately $3.3 billion, which is still the largest amount in history.

Let's also talk about the likelihood of Binance going bankrupt. It appears to still be close to zero, as the exchange's total assets before the hack exceeded $144 billion, meaning the net theft was only 2.5%, which can be covered from its own profits.

Binance has a reserve fund of approximately $1 billion in BTC. It's used for situations like these. Therefore, there's no need to panic; withdrawals from the crypto exchange will likely be open by November 1st.

What should crypto-users do?

First, withdraw funds from centralized crypto exchanges. If Binance, which has an excellent cybersecurity team, was hacked, then any other CEX could be hacked as well. Whales and institutions have already taken this step, according to Coindesk sources.

A good alternative would be a hardware wallet (just make sure the seller is authorized, otherwise you could end up with another scam) or a hot, non-custodial wallet on a separate device (for example, Trust Wallet), which is used only for transfers to the wallet address.

For larger amounts (or if you use crypto for business), multisig addresses are better suited.

You can also try to profit from the gradual decline in CEX by trading coins from decentralized exchanges like Hyperliquid (their HYPE token rose 18% despite the overall market decline) and Uniswap. However, it's important to be mindful of cryptocurrency volatility and the risks involved.

Conclusion

The Binance attack was the largest theft in the history of the crypto industry. The hackers didn't hack blockchains or search for bugs in smart contracts. They infected a DevOps engineer's laptop and used it to sign transactions on behalf of the exchange's hot wallets across 10 networks. On Ethereum, they also exploited the EIP-7702 standard and emptied one wallet of $2.5 billion in just three minutes.

In total, approximately $6.3 billion was stolen. Approximately $3 billion was frozen, largely thanks to Tether and Circle. The net loss is approximately $3.6 billion, which is still an all-time record. It won't bankrupt Binance: the loss amounts to approximately 2.5% of the exchange's assets, and it has a reserve fund for such events.

The main conclusion is that a centralized exchange is always someone else's wallet. If even Binance, with its strong security team, was hacked, then any CEX is vulnerable. Keep only what you're currently trading on the exchange, and store the rest in a hardware wallet, a non-custodial wallet on a separate device, or, for larger amounts, in a multisig address.