How Did Hackers Steal $6.3 Billion From Binance?

Hackers stole $6.3 billion from Binance, Reuters reports. How they crossed its internal defences remains partly unresolved. Binance’s initial investigation points to a potentially compromised DevOps engineer’s laptop, access to a service container and unauthorised withdrawals. Our analysis is that the critical business question concerns control over payment instructions, not simply whether wallet keys were stolen. The available evidence supports a preliminary explanation, not a completed forensic account.

A Laptop Is a Starting Point, Not the Whole Explanation

In its official update, Binance says it found no evidence of a wallet private-key leak and promises a technical post-mortem once facts are verified. Reuters’ subsequent reconstruction reports that Binance also uncovered additional breach points, without describing them. Readers should therefore resist a neat single-device explanation. Our assessment is that the missing evidence is the complete path from initial access to accepted withdrawal instructions, including which safeguards failed or were bypassed.

The Signing System Matters as Much as the Key

TRM Labs’ analysis assesses that Binance’s hot-wallet signing infrastructure was compromised and describes signed authorisations used to delegate an Ethereum wallet’s behaviour. The EIP-7702 specification describes how signed authorisations can set delegated code for an account. That is technical context, not evidence that Ethereum itself was broken. Our implication for custodians is to test whether signing permissions, software access and transaction approval remain independently constrained. NIST’s zero-trust guidance rejects implicit trust based solely on network location or asset ownership.

Frozen Assets Are Not Automatically Recovered Funds

Binance estimates that about $3 billion of affected assets have been frozen on-chain. Reuters’ updated report describes freezes involving Tether, Circle and other partners. Circle’s contract code includes address-blacklisting functionality. Our interpretation is that issuer controls can interrupt movement of some assets, but a freeze should not be presented as completed reimbursement. For customers and counterparties, the useful distinctions are assets located, assets restricted, assets returned and losses ultimately covered. Those categories should not be merged into a single recovery headline.

A Coverage Promise Needs a Funding Explanation

Binance says it will cover losses using its SAFU fund and company funds. Its SAFU documentation describes a fund established to protect users’ assets. The analytical issue is not whether a promise has been issued, but how it will be executed and independently evidenced. We would look for reconciled losses, disclosed funding arrangements and a transparent restoration process. A recovery announcement and proof that every affected customer has been made whole are different milestones. Our recommendation is to assess operational restoration separately from financial coverage. Customers should ask what services have resumed, what restrictions remain and what evidence supports any claim that the incident has been contained.

What Customers and Security Leaders Should Watch

CISA recommends phishing-resistant authentication as part of zero-trust principles. That recommendation is relevant defensive context, not proof that phishing caused this breach. The FBI attributed the earlier Bybit theft to North Korea. That separate finding does not establish responsibility here. Our priority would be a verified post-mortem explaining access, signing controls, containment and remediation. Until then, distinguish analyst attribution from confirmed investigative findings, and company assurances from independently demonstrated restoration.

For institutional customers, our suggested due-diligence checklist is straightforward: ask who can approve withdrawals, how those permissions are revoked, and what independent evidence demonstrates that emergency controls were tested.

Related analysis: passkey and session controls; permissioned crypto trading; AI agent safeguards; cyberthreat research; enterprise security controls.