Binance’s $6.3B Hack Compromised Laptop Suspected as Attackers Rush to Convert Stolen Funds
Binance's preliminary investigation into a massive security breach has identified a potentially compromised DevOps engineer's laptop as the entry point for the attack. The exchange said the incident may have allowed attackers to access internal infrastructure and submit unauthorized withdrawal transactions.
The suspected breach appears to have involved compromised transaction-signing infrastructure rather than the direct theft of wallet private keys. Binance said it had found no evidence that private keys were exposed, although its investigation remains ongoing.
The exchange now estimates the total financial impact at approximately $6.3 billion. It has also worked with blockchain companies and other industry partners to freeze around $3 billion in affected assets onchain.
Binance said it would cover all losses through its Secure Asset Fund for Users (SAFU) and corporate funds, assuring customers that their assets remain safe. The exchange also temporarily suspended deposits and withdrawals during security checks, revoked the affected address authorization and began working with law enforcement to trace the stolen funds.
It plans to release a detailed technical report once the investigation is complete and all findings have been verified.
Attackers Exploit DeFi Platforms to Move Stolen Funds
Meanwhile, onchain activity suggests the attackers are using decentralized finance (DeFi) platforms to convert stolen stablecoins into Ethereum (ETH), which cannot be frozen by a central issuer.
Blockchain records show that wallets associated with the exploit have interacted with decentralized exchanges, including Uniswap, to exchange stablecoins for ETH. The strategy appears designed to move funds out of tokens that can be blacklisted by their issuers.
Tether and Circle have already blocked several addresses linked to the suspected attackers, freezing more than $2 billion in assets across different stablecoins. Unlike USDT and USDC, Ethereum has no central issuer with the authority to freeze individual balances.
Uniswap's automated trading infrastructure has provided another route for the attackers to exchange assets without relying on a centralized exchange.
The wallets have also used Aave, a decentralized lending protocol, to deposit stablecoins as collateral and borrow ETH. One transaction sequence involved deposits of $10 million and $50 million in USDT, followed by ETH borrowing worth tens of millions of dollars.
Aave subsequently froze its V3 markets on Ethereum mainnet, preventing new deposits and borrowing. Solana-based DeFi platform Kamino also temporarily paused borrowing in its SOL and BTC markets as a precaution, although it said its services were not affected by the Binance incident.
Hundreds of Thousands of ETH Remain in Attacker Wallets
Despite the asset conversions, a significant amount of ETH remains in wallets associated with the exploit.
Onchain data showed that two wallets labeled as exploiters collectively held approximately 253,000 ETH, worth around $570 million at the time of reporting. Some of the funds had passed through several intermediary wallets before reaching their destinations.
The attackers also converted approximately 36 million RLUSD, Ripple's dollar-backed stablecoin, into more than 15,000 ETH.
Ripple responded by freezing approximately $200 million in affected funds. The company confirmed that it was monitoring the incident and coordinating with relevant parties to support investigations and protect users.
Tornado Cash, a cryptocurrency mixing service, has also appeared in the transaction history, although available records indicate it was used to fund the address that initiated the attack rather than to move the main stolen balances.
Similarities to Previous Major Crypto Exchange Attacks
The suspected compromise of Binance's signing infrastructure has drawn comparisons to the February 2025 Bybit hack. In that incident, attackers compromised a developer's credentials, gained access to wallet infrastructure and manipulated the transaction approval process to trick signers into authorizing malicious transfers.
The similarities suggest that attackers may have targeted the systems responsible for approving transactions rather than attempting to extract private keys directly. However, the precise attack method and the identity of those responsible have not been confirmed.
Binance is continuing to work with law enforcement agencies and blockchain intelligence companies to identify the attackers and recover assets.
The incident highlights the risks associated with centralized exchange infrastructure, particularly systems that manage transaction authorization and wallet operations. It also demonstrates how attackers can use decentralized protocols to move assets even as stablecoin issuers and other industry participants attempt to freeze stolen funds.