Key Takeaways
- • Binance's post-mortem traces its US$6.3 billion cryptocurrency theft to a campaign that began five months before any coin moved, starting with a tampered software package in June and ending at the exchange's wallet-signing service.
- • The FBI has attributed the attack to TraderTraitor, a unit within North Korea's Lazarus Group, and the sweeper contract used to drain hot wallets ran to roughly 130 lines of code.
- • Binance says it has replenished approximately 90 per cent of affected assets, funded by its Secure Asset Fund for Users, part of its Futures Insurance Fund and corporate treasury reserves, with the remaining 10 per cent in less liquid tokens.
- • Elliptic estimates about 44 per cent of stolen assets were frozen quickly, while roughly US$786 million in stablecoins was converted to TRX and Ethereum.
- • Australian banks are tightening crypto transfers, with three of four majors imposing a A$10,000 limit, and Zilliqa is pivoting from its standalone Layer 1 to an Ethereum Layer 2 aimed at regulated institutions.
Summary
Binance's post-mortem of its US$6.3 billion cryptocurrency theft describes a campaign that began five months before a single coin was moved. The intrusion started with a tampered software package in June, escalated through a fake recruiter and a compromised internal AI tool, and ended at the exchange's wallet-signing service. The on-chain component was compact, with the sweeper contract running to roughly 130 lines of code. The difficulty lay in the months of operational manoeuvring needed to reach the systems authorised to approve withdrawals. The FBI has attributed the attack to TraderTraitor, a unit within North Korea's Lazarus Group.
Industry commentators at Immunefi described a shift in attacker focus. Head of Security Gonçalo Magalhães said direct key theft has become rare as key management has hardened, so attackers now target signing systems. VP of Engineering Simone Imbrescia argued that the people, infrastructure and workflows that instruct keys form part of the security perimeter and need equal defence.
Binance reported it has replenished approximately 90 per cent of affected assets, up from 80 per cent in its earlier update, drawing on a partial deployment of its Secure Asset Fund for Users, a portion of its Futures Insurance Fund and corporate treasury reserves. The remaining 10 per cent consists of less liquid tokens outside the top ten assets, which may take longer to source. A new Proof of Reserves report is being generated, with a zero-knowledge proof taking 40 to 50 hours to process. Withdrawals reopened on schedule without an apparent surge in requests.
On-chain risk firm Elliptic estimates around 44 per cent of stolen assets were frozen quickly by stablecoin issuers or Layer 2 networks, with the US Secret Service helping identify linked addresses. Attackers still converted roughly US$786 million in stablecoins to TRX and Ethereum, though THORChain was unavailable due to an unrelated protocol halt. Elliptic believes remaining funds will be laundered slowly through over-the-counter brokers over months.
The article also highlights withdrawal pressure as a distinct risk. After the 2025 Bybit hack, customer withdrawals reached roughly US$4 billion against about US$1.5 billion stolen. Varun Datta, founder and CEO of Truth Ventures, argued that emergency funds cannot resolve every reason withdrawals stop, and warned of currency mismatch when an exchange owes stablecoins but holds Bitcoin for reserves.
Research by BlockchainHub found the 20 largest crypto hacks between 2024 and 2026 caused more than US$3 billion in combined losses, with infrastructure attacks accounting for 81 per cent. Immunefi confirmed 782 valid bug bounty reports in Q3 2026, nearly triple the 273 a year earlier. Regulatory pressure is building: Wyoming Senator Cynthia Lummis cited the breach in support of the Clarity Act, and Australian banks now impose a A$10,000 limit on transfers to crypto exchanges, with Westpac joining Commonwealth Bank and NAB.
Zilliqa, a nine-year-old blockchain project, has abandoned its standalone Layer 1 and is rebuilding as an Ethereum Layer 2 targeting regulated institutions. Its team acknowledged the original chain failed to gain sufficient traction. The rebranded network will use verifiable Legal Entity Identifiers, with the Liechtenstein Trust Integrity Network running the sequencer.
Industry commentators at Immunefi described a shift in attacker focus. Head of Security Gonçalo Magalhães said direct key theft has become rare as key management has hardened, so attackers now target signing systems. VP of Engineering Simone Imbrescia argued that the people, infrastructure and workflows that instruct keys form part of the security perimeter and need equal defence.
Binance reported it has replenished approximately 90 per cent of affected assets, up from 80 per cent in its earlier update, drawing on a partial deployment of its Secure Asset Fund for Users, a portion of its Futures Insurance Fund and corporate treasury reserves. The remaining 10 per cent consists of less liquid tokens outside the top ten assets, which may take longer to source. A new Proof of Reserves report is being generated, with a zero-knowledge proof taking 40 to 50 hours to process. Withdrawals reopened on schedule without an apparent surge in requests.
On-chain risk firm Elliptic estimates around 44 per cent of stolen assets were frozen quickly by stablecoin issuers or Layer 2 networks, with the US Secret Service helping identify linked addresses. Attackers still converted roughly US$786 million in stablecoins to TRX and Ethereum, though THORChain was unavailable due to an unrelated protocol halt. Elliptic believes remaining funds will be laundered slowly through over-the-counter brokers over months.
The article also highlights withdrawal pressure as a distinct risk. After the 2025 Bybit hack, customer withdrawals reached roughly US$4 billion against about US$1.5 billion stolen. Varun Datta, founder and CEO of Truth Ventures, argued that emergency funds cannot resolve every reason withdrawals stop, and warned of currency mismatch when an exchange owes stablecoins but holds Bitcoin for reserves.
Research by BlockchainHub found the 20 largest crypto hacks between 2024 and 2026 caused more than US$3 billion in combined losses, with infrastructure attacks accounting for 81 per cent. Immunefi confirmed 782 valid bug bounty reports in Q3 2026, nearly triple the 273 a year earlier. Regulatory pressure is building: Wyoming Senator Cynthia Lummis cited the breach in support of the Clarity Act, and Australian banks now impose a A$10,000 limit on transfers to crypto exchanges, with Westpac joining Commonwealth Bank and NAB.
Zilliqa, a nine-year-old blockchain project, has abandoned its standalone Layer 1 and is rebuilding as an Ethereum Layer 2 targeting regulated institutions. Its team acknowledged the original chain failed to gain sufficient traction. The rebranded network will use verifiable Legal Entity Identifiers, with the Liechtenstein Trust Integrity Network running the sequencer.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.