Binance Puts Its Hot Wallet Theft at $6.3B, Chainalysis at $5.9B

Binance suspended deposits and withdrawals late on Thursday after an attacker drained a set of its hot wallets across several blockchains. The exchange put the total impact at about $6.3 billion and said it would cover every loss. Chainalysis, pricing the assets as they moved, counted $5.912 billion. The two figures do not reconcile, and no account read here says which supersedes the other. Bitcoin fell below $77,000 in the hours that followed.

No two totals agree

The $6.3 billion estimate is Binance's own, given at 02:25 UTC on Friday. Chainalysis published its reading at 00:26 UTC, calling it the value at the time of the theft and about four times the Bybit loss of 2025. An on-chain review compiled by Deep Tide TechFlow arrived at $6.28 billion, of which $6.07 billion moved inside the first 55 minutes; its author said Binance had confirmed none of them. Arkham's labelled addresses held roughly $5.84 billion, a balance and not a confirmed theft, as Cointelegraph said plainly when it carried the figure. Blockaid's count of about $3.3 billion is narrower than the rest, covering Ethereum, Arbitrum and Avalanche alone. Even the number of chains is unsettled. The on-chain review tabulates eight; TRM Labs said the attacker reached wallets on ten.

A laptop, or a signed authorisation

Binance's initial finding points at a compromised laptop belonging to a DevOps engineer, which it said may have let an attacker reach a service container and submit unauthorised withdrawals. The same statement said the company found no evidence of a wallet private-key leak. The on-chain review reads the record differently. It describes a single transaction at 20:20:59 UTC on Thursday carrying 50 EIP-7702 authorisations, a mechanism that lets an ordinary address delegate its behaviour to a contract, and says every one of them was signed by the key of the wallet labelled Binance 14. It does not explain how that key was obtained. One account says no key leaked. The other says the key signed.

"We don't think a key was leaked," said Ido Ben-Natan, Blockaid's chief executive, whose preliminary reading points to key misuse or compromised signing infrastructure.

By the review's timeline the groundwork ran two days: a sweeper contract on Wednesday, test transfers on the attacker's own wallet through Thursday afternoon, a second contract at 15:59 UTC. On-chain reconstruction landing before the operator's own account is familiar; it ran on Thursday with the forged batch root that drained zkLink Nova's Ethereum bridge.

Who froze what

Binance said $2.54 billion had been frozen at 22:36 UTC and about $3 billion by 00:52 UTC, with the figure likely to climb. Tether's Paolo Ardoino put his company's share above $1.567 billion and Circle's Jeremy Allaire above $800 million of USDC. Changpeng Zhao had earlier given about $971 million and about $823 million for those same two issuers, so the exchange's first numbers sat under Tether's own. Ripple's freeze is reported three ways: near $200 million by Reuters citing co-CEO Yi He, 40.5 million RLUSD by the on-chain review, no figure at all by Cointelegraph. Aave shut its markets at 21:19 UTC, 18 minutes after the attacker borrowed 19,762 WETH against 60 million USDT deposited there.

What Friday leaves open

Withdrawals were still off at the time of writing. Yi He said on Friday that Binance expected to restore them inside 48 hours and that work continued on withdrawal services and address controls. One account published at 05:08 UTC had deposits running as usual, against the suspension Binance announced at 00:07 UTC. Nothing read here dates a reopening. The promised post-mortem has no date either. TRM Labs attributed the theft with high confidence to TraderTraitor, a crew it ties to earlier North Korean activity, and Reuters reported Chainalysis reaching the same conclusion. Binance has endorsed neither. Leveraged positions worth $1.55 billion were closed out over 24 hours on CoinGlass data, longs taking $1.34 billion of that, the same lopsided shape seen when longs absorbed over 90% of the day's losses on Sunday. Bitcoin had come back to $77,984 by 03:51 UTC, down 2.2% on the day, against $76,664 two hours before.