New details of the largest hack in crypto industry history clarify the picture: Binance's $6.36 billion in losses was distributed across nine blockchains, and the hacker managed to exchange some of the stablecoins before the issuers froze them. Meanwhile, on the Ethereum network, the attack was prepared in advance.

The targets were Binance's hot wallets — those that are constantly connected to the network and process user withdrawals. According to the exchange, there was neither a blockchain vulnerability nor a private key leak.

According to the preliminary version, the hacker infiltrated the internal infrastructure that generates and signs transactions: the entry point was a DevOps engineer's computer and a service container. It is too early to draw final conclusions about the method of penetration — the investigation continues.

Attack mechanics and distribution of funds

The most telling events took place on Ethereum. There, the attacker used EIP-7702 — a mechanism that allows an ordinary wallet to delegate the execution of operations to a smart contract. The scheme looked like this:

  • the attacker pre-prepared 50 signed authorizations with sequential nonces;
  • one of them transferred control of the hot wallet to a collector contract;
  • after the takeover, the contract could continue withdrawing new incoming funds to the wallet as well.

Such preparation is proof that the operation was planned well in advance, rather than exploiting a random hole. In the other networks, funds were withdrawn using ordinary signed transactions.

Total damage is estimated at $6.36 billion based on the value of assets at the time of the transactions — this matches Binance's own estimate of $6.3 billion. More than half came from Ethereum:

  • Ethereum — about $3.79 billion;
  • Bitcoin — about $1.47 billion;
  • TRON — $628 million;
  • XRP Ledger — $296 million;
  • Solana — $96 million;
  • the rest — Arbitrum, Optimism, Base, Avalanche, and Polygon.

In one of the main transactions, 167,464 ETH and about 1.615 billion USDT were moved. The hacker then split the funds and exchanged them for assets that cannot be blocked. On Ethereum, the stolen funds were swapped into ETH, with the bulk settling in three wallets; on TRON, 234 million USDT were converted into TRX before the freeze; on Bitcoin, 18,270 BTC were spread across several addresses, mostly 1,000 BTC each.

What was successfully frozen

The consequences were only partially contained. Freezing only works for stablecoins that have an issuer capable of blocking coins at specific addresses. The issuers froze:

  • Tether — about 1.76–1.77 billion USDT;
  • Circle — 825 million USDC;
  • Ripple — 40.5 million RLUSD;
  • World Liberty Financial — 27.8 million USD1.

Arbitrum acted separately: the network's security council transferred about $30 million to a service address, and those funds can now only be disposed of based on an ArbitrumDAO vote. Independent estimates put frozen assets at about $2.7 billion, while Binance says roughly $3 billion.

With ETH, BTC, and TRX, such a scenario will not work — they have no centralized issuer. That is precisely why the hacker hurried to exchange the stablecoins: 40.5 million RLUSD were frozen in time, but about $48 million the attacker withdrew and exchanged earlier. Binance temporarily halted deposits and withdrawals during the checks and promised to compensate for the losses.

The identity of the attackers is not disclosed: attributing the hack to specific individuals or groups without an evidentiary basis is premature, and while blockchain addresses are public, it is not always possible to establish their real owner.

Cryptalist analysis: For the industry, the sum itself is not critical against the backdrop of the market's overall capitalization — the far more serious blow is to trust in centralized exchanges, and users will have to reassess their security. Binance's ability to fully cover clients' losses is beyond doubt: for a platform of this scale, it is a matter of reputation. The main lesson is that reliable protection of private keys guarantees nothing if the infrastructure managing transactions is vulnerable.