Here We Go Again: Binance Loses $6.3b in Largest Robbery in History
This article originally appeared in Galaxy Research's weekly newsletter. Subscribe to get timely insights delivered to your inbox every Friday morning. Find our past reports and newsletters at galaxy.com/research. Send feedback to [email protected].
Binance, the world’s largest crypto exchange, was drained of roughly $6.3b across 10 blockchains on Thursday night. TRM Labs and Chainalysis attribute the attack to TraderTraitor, North Korea’s Lazarus-linked unit. As of writing, the exchange has not yet re-enabled withdrawals.
Start with scale. The benchmark for the largest robbery ever has long been the roughly $1b Saddam Hussein’s regime took from the Central Bank of Iraq on the eve of the 2003 invasion, about $1.8b in today’s dollars. Bybit beat that in nominal terms but not after inflation. Binance beats it on any measure. Even after roughly $2.5–3bn in freezes, this is the biggest heist of all time. Binance’s BTC outflows yesterday were 11 standard deviations higher than their 30-day average.
Then the method. On Ethereum, the attacker used EIP-7702 to turn a Binance hot wallet into a sweeper contract that took orders only from the attacker. It was backed by 50 pre-signed authorizations, one for each upcoming transaction number (nonce), so whichever one came up next would work. The code was rehearsed on three test wallets hours beforehand. Within minutes of each other, nine more chains were emptied, each with different key types and signing schemes. That is someone with intimate knowledge of how Binance’s withdrawal systems work. This is Binance’s preliminary finding: a compromised DevOps engineer’s laptop gave access to a service container, with “no evidence of any wallet private key leak.”
Our take
We believe our previous thesis from Bitget is consistent here. Nobody attacks the private-key math. They attack whoever, or whatever, tells the math what to do.
The biggest mitigating factor of this exploit was stablecoin issuers. Tether froze about $1.77b in USDT, Circle about $825m in USDC, Ripple about $40m in RLUSD, and World Liberty about $28m in USD1. That’s a big part of why this appears to be a painful week rather than an existential one, and we believe Tether deserves credit for moving fast and at scale.
We also believe Circle deserves credit for the freeze. Circle has long said it freezes only when directed by law enforcement or a court, not in real time during an active hack. After April's $285m Drift exploit, CEO Jeremy Allaire went further, saying a private company deciding "what is the right path or not" would be a "moral quandary." During the Drift exploit, about $232m in stolen USDC moved through Circle's own cross-chain transfer protocol over roughly six hours without being frozen. But, on Thursday, Circle froze $823m about 40 minutes after the Ethereum sweep, "in coordination with law enforcement."
Does Binance have enough to cover the hole? The SAFU fund, about $1b in BTC, does not come close to covering it, so Binance says it will cover all losses from its own corporate funds. Last year’s 10/10 liquidation event cost Binance about $283m in depeg compensation plus its $400m “Together Initiative” ($300m in user vouchers and $100m in low-interest loans to institutions). That’s under $700m; this hack is roughly nine times that.
A better yardstick is the BNB burn. 2026’s three quarterly burns so far have retired about $3.2bn of BNB. Net of freezes, the hole is roughly one year of burns, or about 4% of the ~$144bn in assets Binance held before the attack. It is a staggering amount of money, but Binance does appear to have it, or at least the ability to earn its way out of a hole based on our own calculations of their revenue-funded BNB burns. While we can’t independently verify Binance’s whole financial condition, and we don’t know exactly what Binance plans to do, Binance Co-CEO Richard Teng said plainly: “Binance will cover all losses from the SAFU fund and company funds.”
What’s left: when will withdrawals reopen, where will the roughly $2.4b in ETH and BTC still in the attacker’s hands go next (THORChain, Tornado Cash, etc.), and how did an outsider come to know Binance’s systems this well? These are among the key specific questions we will be following in the coming days and weeks. But how the market reacts to the event broadly is also top of mind.
Bitcoin and other crypto assets are trading lower on the news. Alex Thorn’s piece from Monday (Why Now Is the Time to Add and Hold BTC) relies heavily on the 50-week moving average as a key level to maintain a bullish trend, with a break below that is not retaken within 1 month cited as invalidating the paper’s thesis. That 50w MA currently sits at $76,103, and at the time of writing BTCUSD is trading at $77,000. So far, the 50w MA has held, with BTC trading as low as $76,301 overnight on Coinbase. Whether the 50w can hold this weekend is a key test that could be consequential for the next several months of Bitcoin’s technical market structure.
Legal Disclosure:
This document, and the information contained herein, has been provided to you by Galaxy Digital Inc. and its affiliates (“Galaxy Digital”) solely for informational purposes. This document may not be reproduced or redistributed in whole or in part, in any format, without the express written approval of Galaxy Digital. Neither the information, nor any opinion contained in this document, constitutes an offer to buy or sell, or a solicitation of an offer to buy or sell, any advisory services, securities, futures, options or other financial instruments or to participate in any advisory services or trading strategy. Nothing contained in this document constitutes investment, legal or tax advice or is an endorsement of any of the stablecoins mentioned herein. You should make your own investigations and evaluations of the information herein. Any decisions based on information contained in this document are the sole responsibility of the reader. Readers should consult with their own advisors and rely on their independent judgement when making financial or investment decisions.
Participants, along with Galaxy Digital, may hold financial interests in certain assets referenced in this content. Galaxy Digital regularly engages in buying and selling financial instruments, including through hedging transactions, for its own proprietary accounts and on behalf of its counterparties. Galaxy Digital also provides services to vehicles that invest in various asset classes. If the value of such assets increases, those vehicles may benefit, and Galaxy Digital’s service fees may increase accordingly. The information and analysis in this communication are based on technical, fundamental, and market considerations and do not represent a formal valuation. For more information, please refer to Galaxy’s public filings and statements. Certain asset classes discussed, including digital assets, may be volatile and involve risk, and actual market outcomes may differ materially from perspectives expressed here.
For additional risks related to digital assets, please refer to the risk factors contained in filings Galaxy Digital Inc. makes with the Securities and Exchange Commission (the “SEC”) from time to time, including in its Quarterly Report on Form 10-Q for the quarter ended September 30, 2025, filed with the SEC on November 10, 2025, available at www.sec.gov.
Certain statements in this document reflect Galaxy Digital’s views, estimates, opinions or predictions (which may be based on proprietary models and assumptions, including, in particular, Galaxy Digital’s views on the current and future market for certain digital assets), and there is no guarantee that these views, estimates, opinions or predictions are currently accurate or that they will be ultimately realized. To the extent these assumptions or models are not correct or circumstances change, the actual performance may vary substantially from, and be less than, the estimates included herein. None of Galaxy Digital nor any of its affiliates, shareholders, partners, members, directors, officers, management, employees or representatives makes any representation or warranty, express or implied, as to the accuracy or completeness of any of the information or any other information (whether communicated in written or oral form) transmitted or made available to you. Each of the aforementioned parties expressly disclaims any and all liability relating to or resulting from the use of this information. Certain information contained herein (including financial information) has been obtained from published and non-published sources. Such information has not been independently verified by Galaxy Digital and, Galaxy Digital, does not assume responsibility for the accuracy of such information. Affiliates of Galaxy Digital may have owned, hedged and sold or may own, hedge and sell investments in some of the digital assets, protocols, equities, or other financial instruments discussed in this document. Affiliates of Galaxy Digital may also lend to some of the protocols discussed in this document, the underlying collateral of which could be the native token subject to liquidation in the event of a margin call or closeout. The economic result of closing out the protocol loan could directly conflict with other Galaxy affiliates that hold investments in, and support, such token. Except where otherwise indicated, the information in this document is based on matters as they exist as of the date of preparation and not as of any future date, and will not be updated or otherwise revised to reflect information that subsequently becomes available, or circumstances existing or changes occurring after the date hereof. This document provides links to other Websites that we think might be of interest to you. Please note that when you click on one of these links, you may be moving to a provider’s website that is not associated with Galaxy Digital. These linked sites and their providers are not controlled by us, and we are not responsible for the contents or the proper operation of any linked site. The inclusion of any link does not imply our endorsement or our adoption of the statements therein. We encourage you to read the terms of use and privacy statements of these linked sites as their policies may differ from ours. The foregoing does not constitute a “research report” as defined by FINRA Rule 2241 or a “debt research report” as defined by FINRA Rule 2242 and was not prepared by Galaxy Digital Partners LLC. Similarly, the foregoing does not constitute a “research report” as defined by CFTC Regulation 23.605(a)(9) and was not prepared by Galaxy Derivatives LLC. For all inquiries, please email [email protected].
©Copyright Galaxy Digital Inc. 2026. All rights reserved.