Binance Hack Took About 4% of Its Assets; HK Caps Hot Wallets at 2%

In roughly 20 minutes before dawn on Friday, Hong Kong time, an attacker pulled about US$6.36 billion out of Binance wallets on ten blockchains. That is the largest crypto theft on record, around four times the US$1.5 billion taken from Bybit in February 2025.

The figure that matters most for Hong Kong came from Binance itself. Co-chief executive Yi He said the roughly US$3 billion that has not been frozen amounted to about 2% of the exchange's total user assets and public reserves. On that ratio, the full haul equals a little over 4% of Binance's asset base. That is about double the share of client assets a platform licensed by the Securities and Futures Commission may keep outside cold storage.

Hong Kong's rules do not reach Binance. The exchange is not on the SFC's list of licensed virtual asset trading platforms, last updated on Oct 16, and it is not among the applicants awaiting a decision either. The 13 licensed platforms, from OSL and HashKey to Bixin, operate under SFC guidelines that require 98% of client virtual assets to be held in cold storage. Exceptions are allowed only case by case.

The attacker never needed Binance's cold wallets. According to TRM Labs' on-chain reconstruction, the operator submitted 50 authorizations on Ethereum, all signed in advance by a Binance hot wallet. They used a feature added in Ethereum's May 2025 upgrade to hand control of that wallet to a sweeper contract that only the attacker could command. One authorization matched the wallet's running transaction count. Three minutes and 24 seconds later, the wallet sent out its entire balance, including 1.615 billion USDT.

In the same window, Binance wallets on the other nine chains paid the attacker through ordinary signed transfers. Those wallets ran on different chains, key types and signing schemes, yet all of them produced valid signatures for one attacker within about half an hour. TRM's assessment is that the intruder had gained the ability to make Binance's hot-wallet signing system sign transactions of its choosing.

Binance's own account has shifted. It first said a compromised laptop belonging to a DevOps engineer may have let the attacker reach a service container and submit unauthorized withdrawals. It later said investigators had found additional points of breach. Binance said it had found no evidence that any wallet private key leaked. Chief executive Richard Teng said the hackers manipulated a transaction-approval system to move money out of a hot wallet without passing through normal controls.

That is where a cold-storage ratio matters. It would not stop an intruder who controls the system that signs online withdrawals. What it limits is how much that system can reach. On an asset base the size of Binance's, a 2% ceiling would in principle have kept roughly half the stolen sum offline.

TRM attributed the attack, with high confidence, to TraderTraitor, a North Korean state-linked unit that the FBI named as responsible for the Bybit theft. Chainalysis reached the same assessment. It said its strongest evidence came when it watched funds taken from Binance mixing in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors.

Stablecoin issuers moved within the hour. By 00:30 UTC on Friday, TRM counted about US$2.7 billion frozen. That included roughly 1.77 billion USDT held by Tether and about 825 million USDC held by Circle, plus smaller freezes by Ripple, World Liberty Financial and Arbitrum's Security Council. Binance put the frozen total at about US$3 billion. The attacker raced the freezes, dumping about 325 million USDT for ether at a discount of more than 10%. It still controls more than 420,000 ETH and 18,270 BTC, worth about US$2.4 billion and beyond any issuer's reach.

Binance said it would cover all losses from its Secure Asset Fund for Users and company funds. It said deposits were unaffected and that it expected withdrawals to resume within 48 hours. In Hong Kong, that kind of backstop is a licensing condition rather than a choice. Licensed platforms must hold an SFC-approved compensation arrangement covering 100% of client assets in hot storage and 50% of those in cold storage.

Bitcoin hit a six-week low of US$76,368 before steadying near US$77,355, while Binance's BNB token fell 6.74% to US$698. Tim Sun, a senior researcher at Hong Kong-based HashKey Group, said the incident could prompt investors to reassess the safety of assets held on centralised exchanges.

The SFC has been tightening this area for over a year. In August 2025, after a string of overseas exchange breaches, it set minimum custody standards for licensed platforms. These included address whitelists for cold-wallet transactions and a ban on smart contracts in client cold wallets. The SFC described those standards as the floor platforms must meet before it would consider letting them move to newer custody technology under its ASPIRe roadmap, which floated more technology-neutral, outcome-based rules.

Binance has promised a detailed technical report once its investigation ends. That report should settle whether the breach began and ended with one engineer's laptop, or whether the attacker could reach Binance's signing system on ten chains at once, as TRM's on-chain trail indicates.