Binance Crypto Hack: The biggest ever theft of ₹60,000 crore ($6.3B) from the world’s largest exchange, 90% loss compensated


A sensational case of the biggest cyber robbery in history has come to light in the world of cryptocurrency and digital assets. Hackers stole digital tokens worth a record $6.36 billion (about ₹60,000 crore in Indian currency) in a well-planned attack on Binance, the world’s largest crypto exchange by trading volume globally. The US intelligence agency FBI and major blockchain security firms have issued official statements confirming that North Korea’s notorious and sponsored cyber hacking group ‘Trader-Traitor’ is behind this horrific attack. However, within hours of the attack, Binance has given a big relief to its global investors and users by claiming that it has replaced 90% of the loss with the help of its internal emergency funds and corporate treasury and the users’ funds are completely safe.

According to an on-chain tracking report from blockchain intelligence firms TRM Labs and Chainalysis, the attackers used an extremely lethal and technically sophisticated approach:

  • Breach in hot wallet infrastructure: The hackers exploited the signing process of Binance’s hot wallet and EIP-7702 delegation on Ethereum. They had already prepared 50 pre-signed authorizations, turning the hot wallet into a ‘sweeper contract’.

  • Eliminates in just 20 minutes: The attackers simultaneously transferred funds from 10 different blockchain networks (Ethereum, XRP Ledger, Solana, Optimism, Arbitrum, etc.) to addresses they controlled within approximately 20 minutes.

  • Major currencies stolen: The stolen funds included approximately 2 lakh Ether (ETH), 18,270 Bitcoin (BTC), 1.87 billion USDT, 823 million USDC and millions worth of XRP.

  • Ban on immediate withdrawal: As soon as the unusual attack activity was detected, Binance temporarily suspended withdrawals on all networks to prevent further theft.

The US investigative agency FBI issued a strong public alert, saying that on-chain and off-chain evidence clearly shows that the attack was carried out by a hacking unit supported by the North Korean regime. ‘Trader-Traitor’ (Technical part of TraderTraitor/Lazarus Group).

  • The FBI has warned that hackers are trying to launder stolen cryptocurrencies through mixers, decentralized protocols (DeFi), and cross-chain bridges.

  • According to international intelligence reports, North Korea, which is facing tough economic sanctions, is running an organized network of raising foreign currency by targeting crypto exchanges to fund its nuclear and missile programs.

  • Earlier, the FBI had also held the same trader-traitor group responsible for the $1.5 billion hack of Bybit exchange in the year 2025.

Despite such huge losses, Binance adopted a rapid recovery strategy and calmed investors’ panic:

  1. $2.7 Billion Stablecoins Freeze: Immediately following the attack, the Security Council of Tether, Circle, Ripple and Arbitrum acted promptly to on-chain freeze (block) approximately $2.67 billion to $2.7 billion worth of stablecoins (USDT, USDC, RLUSD), preventing the hackers from cashing out those funds.

  2. Use of SAFU and Treasury Reserves: Binance pledges $1 billion of its funds to compensate for the remaining stolen tokens Secure Asset Fund for Users (SAFU)released capital from the futures insurance fund and the company’s corporate treasury (internal financial reserves).

  3. 90% Assets Replace: According to the company management, 90% of the amount of stolen tokens has been restored back into the system by purchasing new tokens, due to which common retail investors have not suffered any personal financial loss.

Binance founder Changpeng Zhao (CZ) while giving information on social media platform

At the same time, cyber security experts believe that with the rise of Artificial Intelligence (AI) and advanced coding, the risk of such attacks on financial institutions and Web3 platforms has increased manifold. Blockchain security analysts have advised all exchanges and wallet providers around the world to upgrade multi-sig infrastructure and block any type of transactions with addresses associated with the trader-traitor with immediate effect.