The Record $6.3B Binance Heist and What Comes Next

André Dragosch, PhD Director, Head of Research — Europe

Luke Deans Senior Research Associate

André Dragosch, PhD Director, Head of Research — Europe

Luke Deans Senior Research Associate

Contenuto

Binance Hack – A Postmortem Key implications for investors Bottom Line

Iscriviti alla nostra newsletter periodica e alle pubblicazioni di ricerca

Largest crypto hack on record, with a mixed recovery picture. Binance estimates ~$6.3 billion in impact, traced to a compromised DevOps engineer’s laptop rather than a private-key leak, and attributed to North Korea’s TraderTraitor unit. Issuers froze roughly $2.7-2.8 billion in stablecoins within hours, but ~$2.9 billion remains movable in non-freezable BTC and ETH, so recovery now depends on tracing, law enforcement, and voluntary returns. Binance will cover all losses from SAFU and company funds, and Bitwise client assets are unaffected.
Market reaction was sharp but orderly. Bitcoin fell as much as 5.0% and Ethereum 6.1%, with first-hour moves in the 99.6th percentile of the past four years, yet both have since recovered a quarter to a third of the decline and realised investor losses remain modest, pointing to resilience rather than capitulation. Historically, exchange hacks have been transient and followed by strong Bitcoin performance, but Bitwise’s Sentiment Index shows no oversold conditions or seller exhaustion yet, so downside risks stay elevated near term.
Bitcoin is defending a key structural support zone. The Short-Term Holder Cost Basis (~$76k), True Market Mean (~$78k) and 200-day moving average (~$73k) together form a $73k–$78k range that Bitwise views as the transition zone into a broader bull-market regime; Bitcoin trading into this region and holding firm despite the hack, geopolitical pressure and compressed volatility is a constructive signpost.

Binance Hack – A Postmortem

Yesterday’s incident is now the largest known crypto theft on record, with Binance estimating ~$6.3 billion in total impact across multiple hot wallets and chains. Across Bitcoin, Ethereum, USDC and USDT, Binance recorded its largest 24-hour outflow on record.

Notably, the hack ranks as the largest on record by a wide margin, with the $1.5bn Bybit hack in 2025 representing the closest historical comparison.

Initial findings point to a compromised DevOps engineer’s laptop that allowed an attacker to access a service container and submit unauthorised withdrawal transactions. No evidence of a private-key leak has been found.

Binance founder CZ was among the first to acknowledge the severity. In a post quoting early freeze reports he wrote: “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether ($971m) and Circle ($823m). I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

Tether and Circle (together with other issuers) moved quickly, freezing roughly $2.7 billion in stablecoins in total (Tether >$1.57 billion USDT; Circle ~$823 million USDC). Parallel freezes occurred on other networks. The attackers, however, raced the freezes.

One wallet in the cluster deposited ~60 million USDT into Aave V3 Ethereum Core and borrowed 19,762 WETH ($45 million) in a matter of minutes before the first freezes landed, converting freezable stablecoins into non-freezable ETH.

They also sold or swapped other tokens on DEXes. Aave later froze affected markets as a precaution.

On-chain analytics firms, including TRM Labs and Chainalysis, have attributed the attack to North Korea’s TraderTraitor unit (linked to the broader Lazarus Group and prior incidents such as Bybit).

The attackers split ~18,270 BTC into 19 wallets (mostly 1,000 BTC each) that have so far remained idle, while large ETH balances sit in wallets that have not yet moved further.

Arkham has designated the actor an official entity, verified ~70 associated addresses, and published tracking showing ~$5.7 billion taken, ~$2.80 billion frozen, and ~$2.9 billion still movable (primarily ETH, BTC and other non-freezable assets).

Binance’s most recent update states that deposits continue normally, withdrawals remain paused while a security revamp of the withdrawal service is completed (expected resumption within 48 hours), and that the full attack path through the compromised computer is still being traced.

A comprehensive root-cause report will follow. Binance has reiterated that it will cover all losses from the SAFU fund and company funds and that user funds are safe.

The episode underscores both the industry’s improved rapid-response coordination (issuer freezes, on-chain tracking) and the residual risk of hot-wallet operational compromise - even at the largest platforms. The bulk of the remaining value sits in assets that cannot be blacklisted, so recovery efforts will now hinge on continued tracing, potential law-enforcement action, and any voluntary returns or liquidations. Full technical details remain pending although some technical details are already known.

Key implications for investors

Our CEO Hunter Horsley commented on the ongoing Binance situation, confirming that client assets held across Bitwise solutions - including curated vaults, private funds and ETPs & ETFs - remain safe.

He noted that spot and lending markets are likely to stay choppy in the near term, while emphasising that the broader crypto industry will survive the incident and emerge stronger, with Binance receiving support from peers. Horsley also highlighted cyber defence as an essential priority for all firms this year and beyond.

From an investor perspective, crypto exchange hacks have historically been associated with significantly negative performance in the short-term but have generally proven to be transient.

Historical occurrences of exchange hacks were generally followed by a significant post-event performance of Bitcoin in the past as they have usually induced a high degree of negative sentiment and seller exhaustion.

That said, we think that downside risks remain elevated as the situation continues to evolve. Moreover, our inhouse Cryptoasset Sentiment Index[1] implies that we haven’t seen oversold conditions and seller exhaustion just yet – neither on a daily basis nor on an intraday basis.

That said, the recent hack triggered a broad drawdown across the digital asset complex, with Bitcoin falling as much as 5.0% from its pre-hack level and Ethereum 6.1%. The sharpest move came immediately after the drain began, with Bitcoin declining 2.4% and Ethereum 3.3% in the first hour. For both assets, these moves ranked in the 99.6th percentile of hourly price moves over the past four years.

Selling pressure eased considerably after the initial shock. The 24-hour trading range peaked at around 6.5% for Bitcoin and 8.0% for Ethereum, placing both towards the upper end of their four-year distributions, but still below levels seen during recent periods of elevated volatility. Both assets have experienced larger 24-hour ranges within the past three months.

Since bottoming overnight, the market has stabilised reasonably well. Bitcoin has recovered roughly a third of its initial decline and Ethereum more than a quarter, leaving them around 3.4% and 4.4% below their respective pre-hack levels.

Despite the sharp price decline and severity of the hack, when assessing the losses realised by investors over the past 24 hours, the response has remained relatively contained. The magnitude of losses locked in has been modest by comparison, suggesting that investors have remained comparatively steadfast rather than capitulating aggressively.

As repeatedly highlighted across our weekly Crypto Market Compass and Bitcoin Macro Investor, we believe Bitcoin entered this drawdown with a cluster of important structural levels beneath spot:

The Short-Term Holder Cost Basis near $76k represents the average acquisition price of newer market participants and has historically acted as an important delineator between local risk-on and risk-off conditions.
The True Market Mean near $78k estimates the average acquisition price of active investors by excluding supply considered lost or deeply dormant.
The 200-day moving average near $73k is a widely followed technical reference point and has historically served as an important bull/bear threshold for traditional market participants.

Together, these levels form a broader support zone between roughly $73k and $78k, which we view as the primary transition range into a broader bull-market regime. The fact that Bitcoin has now traded into this region and remained comparatively resilient is therefore a constructive signpost.

Despite historically compressed volatility, persistent geopolitical pressure and the largest digital asset hack on record, Bitcoin continues to retest and defend this key support zone.

Bottom Line

Largest crypto hack on record, with a mixed recovery picture. Binance estimates ~$6.3 billion in impact, traced to a compromised DevOps engineer’s laptop rather than a private-key leak, and attributed to North Korea’s TraderTraitor unit. Issuers froze roughly $2.7-2.8 billion in stablecoins within hours, but ~$2.9 billion remains movable in non-freezable BTC and ETH, so recovery now depends on tracing, law enforcement, and voluntary returns. Binance will cover all losses from SAFU and company funds, and Bitwise client assets are unaffected.
Market reaction was sharp but orderly. Bitcoin fell as much as 5.0% and Ethereum 6.1%, with first-hour moves in the 99.6th percentile of the past four years, yet both have since recovered a quarter to a third of the decline and realised investor losses remain modest, pointing to resilience rather than capitulation. Historically, exchange hacks have been transient and followed by strong Bitcoin performance, but Bitwise’s Sentiment Index shows no oversold conditions or seller exhaustion yet, so downside risks stay elevated near term.
Bitcoin is defending a key structural support zone. The Short-Term Holder Cost Basis (~$76k), True Market Mean (~$78k) and 200-day moving average (~$73k) together form a $73k–$78k range that Bitwise views as the transition zone into a broader bull-market regime; Bitcoin trading into this region and holding firm despite the hack, geopolitical pressure and compressed volatility is a constructive signpost

[1] The Cryptoasset Sentiment Index is a composite indicator consisting of 15 different sub-indicators covering sentiment, on-chain, derivatives, flows developments as well as sentiment in traditional financial markets. A 90-day rolling z-score is used to standardise and aggregate these sub-indicators.

Important Information

This publication constitutes a marketing communication and is provided for informational purposes only. It is intended solely for professional investors and is not suitable for retail distribution and reliance. It does not constitute investment advice, a personal recommendation, or an offer or solicitation to buy or sell any financial instrument.

This document (which may take the form of a presentation, press release, social media post, blog article, broadcast communication or similar instrument – collectively referred to as a “Document”) is issued by Bitwise Europe GmbH (“BEU” or the “Issuer”) and has been prepared in accordance with applicable laws and regulations, including those relating to financial promotions.

Bitwise Europe GmbH, incorporated under the laws of Germany, is the issuer of the Exchange Traded Products (“ETPs”) referenced in this Document under a base prospectus and the applicable final terms, as supplemented from time to time, approved by the German Federal Financial Supervisory Authority (BaFin). The approval of the prospectus by BaFin relates solely to the completeness, coherence and comprehensibility of the prospectus in accordance with the Prospectus Regulation and does not constitute an endorsement, recommendation or assessment of the merits of the products.

Past performance is not a reliable indicator of future results.

Capital at risk. Cryptoassets are highly volatile and involve a high degree of risk. The value of investments in cryptoassets and crypto-linked ETPs may fluctuate significantly, and investors may lose part or all of their invested capital. No capital protection or guaranteed compensation mechanism applies in respect of market losses.

Any investment decision should be made on the basis of the relevant base prospectus, the applicable final terms and the key information document, in particular the section entitled “Risk Warning” The base prospectus, final terms and additional risk information are available at: www.bitwiseinvestments.eu

Access to certain documents may require self-certification regarding your jurisdiction and investor status and may be subject to additional disclaimers and important information.

This document may contain forward-looking statements including statements regarding Bitwise Europe’s belief or current expectations with regards to the performance of certain asset classes. Forward-looking statements are subject to certain risks, uncertainties and assumptions, and there can be no assurance that such statements will be accurate and actual results could differ materially. Therefore, you must not place undue reliance on forward-looking statements.

For more details and the full disclaimer visit:
https://bitwiseinvestments.eu/disclaimer/

Informazioni su Bitwise

Bitwise è uno dei principali gestori patrimoniali specializzati in criptoasset a livello globale. Dal 2017, Bitwise collabora con migliaia di consulenti finanziari, family office e investitori istituzionali in tutto il mondo per favorire la comprensione e l’accesso alle opportunità offerte dai criptoasset. La società vanta una consolidata esperienza nella gestione di un’ampia gamma di soluzioni delta-one, indicizzate e attive, tra cui ETP, ETF, mandati di gestione individuale, fondi privati e strategie hedge fund, negli Stati Uniti e in Europa.

Articoli consigliati per te

Se ci si trova nel Regno Unito, negli Stati Uniti o in Canada

Le informazioni contenute nel presente Sito non costituiscono, e non devono in alcun caso essere interpretate come, un’offerta di vendita o una sollecitazione all’acquisto di titoli, né alcun altro atto diretto a promuovere un’offerta pubblica, negli Stati Uniti o in Canada, o in qualsiasi stato, provincia o territorio degli stessi, nei quali né l’Emittente né i suoi prodotti sono autorizzati o registrati per la distribuzione o la vendita e nei quali non è stato depositato alcun prospetto dell’Emittente presso alcuna autorità di vigilanza sui valori mobiliari. Né il presente Sito né le informazioni ivi contenute devono essere recepiti, trasmessi o distribuiti (direttamente o indirettamente) negli Stati Uniti.

Nel Regno Unito, il presente Sito è fornito esclusivamente a scopo informativo ed è in ogni caso fornito in conformità all’esenzione dal requisito, previsto dalla Section 21 del Financial Services and Markets Act 2000, secondo cui le comunicazioni relative a inviti o incentivi a intraprendere un’attività di investimento devono essere approvate da un soggetto autorizzato dalla Financial Conduct Authority. Il presente Sito è pertanto rivolto esclusivamente a soggetti che rientrano in una delle esenzioni pertinenti alla restrizione sulle promozioni finanziarie previste dal Financial Services and Markets Act 2000 (Financial Promotion) Order 2005, quali: gli investitori professionali (Article 19); le persone fisiche ad elevato patrimonio netto (“high net worth individuals”, ossia persone fisiche con un reddito annuo di almeno 100.000 £ e/o un patrimonio netto di almeno 250.000 £) (Article 48); le società ad elevato patrimonio netto, le associazioni non riconosciute e simili (Article 49); gli investitori esperti (“sophisticated investors”, ossia persone fisiche in possesso di un idoneo certificato in corso di validità attestante che dispongono di conoscenze sufficienti per comprendere i rischi associati al presente investimento) (Article 50); gli investitori esperti autocertificati (ossia persone fisiche che: negli ultimi due anni hanno lavorato a titolo professionale nel settore del private equity o del finanziamento di piccole e medie imprese; negli ultimi due anni hanno ricoperto la carica di amministratore di una società con un fatturato annuo di almeno 1 mln £; negli ultimi due anni hanno effettuato due o più investimenti in una società non quotata; oppure hanno fatto parte, per più di sei mesi, di una rete o di un gruppo (syndicate) di business angel) (Article 50A); e le associazioni di investitori ad elevato patrimonio netto o esperti (Article 51).

I soggetti che non rientrano in alcuna esenzione pertinente non devono accedere al presente Sito, né fare altrimenti affidamento su di esso o agire sulla base dello stesso; tali soggetti dovrebbero invece consultare la versione del Sito destinata agli investitori privati (“Private Investor”). Accedendo al presente Sito, si conferma di rientrare in una delle esenzioni pertinenti. Né l’Emittente né i suoi prodotti sono autorizzati o regolamentati dalla Financial Conduct Authority del Regno Unito, e il contenuto della presente promozione finanziaria non è stato approvato da un soggetto autorizzato ai sensi del Financial Services and Markets Act 2000. Fare affidamento sulla presente promozione finanziaria al fine di intraprendere un’attività di investimento può esporre una persona a un rischio significativo di perdere la totalità dei beni o delle altre attività investite. Per ulteriori informazioni o per qualsiasi altra richiesta relativa alle questioni cui si riferisce il presente Sito, è possibile contattarci all’indirizzo eu-legal@bitwiseinvestments.com.

Informativa su Pubblicazioni e Social Media

Le comunicazioni sui social media, inclusi i post su LinkedIn e X (congiuntamente, i “Social Media”), possono costituire comunicazioni pubblicitarie, promozioni finanziarie o raccomandazioni di investimento ai sensi del Regolamento (UE) n. 596/2014, del Financial Services and Markets Act 2000, ovvero altre comunicazioni regolamentate, a seconda del loro contenuto e della giurisdizione in cui vengono diffuse. Salvo espressa indicazione contraria, tali comunicazioni non sono destinate a costituire consulenza in materia di investimenti né una raccomandazione personalizzata.

BEU compie ogni ragionevole sforzo per garantire che le informazioni contenute nei documenti e sui Social Media siano accurate e affidabili; tuttavia, potrebbero verificarsi errori. Nella misura consentita dalla normativa applicabile, i documenti e i materiali disponibili sui Social Media sono forniti senza alcuna garanzia espressa o implicita in merito ad accuratezza, validità, tempestività o completezza. Nessuna disposizione del presente paragrafo esclude o limita una responsabilità legale o regolamentare che non possa essere legittimamente esclusa o limitata, inclusi gli obblighi applicabili alle comunicazioni pubblicitarie o alle promozioni finanziarie e la responsabilità relativa a un prospetto o ad altra informativa regolamentare.

Salvo espressa approvazione o adozione da parte di Bitwise Europe, i commenti espressi dai membri della comunità online rappresentano esclusivamente le opinioni personali di tali soggetti e non sono approvati da Bitwise Europe.

Rischi degli ETP e delle Criptovalute

Un investimento in un ETP garantito da una o più criptovalute, come quelli emessi da BEU, dipende dalla performance della criptovaluta sottostante, al netto dei costi; tuttavia, non ci si può attendere che la performance dell’ETP replichi esattamente la performance dell’attività sottostante. Investire in ETP comporta inoltre numerosi rischi, tra cui rischi di mercato generali relativi al sottostante, movimenti avversi dei prezzi, rischi valutari, di liquidità, operativi, legali e regolamentari; gli investitori dovrebbero essere preparati a perdere in parte o interamente l’importo investito.

Gli ETP garantiti da criptovalute sono strumenti altamente volatili e la loro performance è imprevedibile. La performance passata non è un indicatore affidabile della performance futura. Il prezzo di mercato degli ETP è soggetto a variazioni e tali strumenti non offrono un reddito fisso. Il valore di un ETP può essere influenzato dai tassi di cambio e dall’andamento del prezzo della/e criptovaluta/e sottostante/i. Il presente Sito può contenere dichiarazioni previsionali, incluse dichiarazioni relative alle convinzioni o alle attuali aspettative di Bitwise Europe in merito alla performance di determinate classi di attivo. Le dichiarazioni previsionali sono soggette a determinati rischi, incertezze e assunzioni, e non vi è alcuna garanzia che tali dichiarazioni si rivelino accurate; i risultati effettivi potrebbero discostarsi in modo sostanziale da quelli indicati. Non si dovrebbe fare affidamento su dichiarazioni previsionali o su altre informazioni analoghe contenute nel presente Sito.

Le criptovalute sono altamente volatili e note per le loro fluttuazioni di prezzo estreme e rapide. Sebbene vi possa essere un potenziale per guadagni significativi, si è esposti al rischio di perdere in parte o interamente il capitale investito. Il prezzo delle criptovalute può fluttuare notevolmente e può essere influenzato, ad esempio, da eventi politici, economici o finanziari globali e regionali, da eventi regolamentari o da dichiarazioni delle autorità di vigilanza, da attività di negoziazione, copertura o altre attività poste in essere da un’ampia gamma di partecipanti al mercato, da fork dei protocolli sottostanti, nonché da interruzioni dell’infrastruttura o dei mezzi attraverso cui i crypto-asset vengono prodotti, distribuiti, conservati e negoziati. Le caratteristiche delle criptovalute e la divergenza degli standard regolamentari applicabili creano un potenziale di abuso di mercato. Il prezzo delle criptovalute può inoltre variare a seguito del mutevole livello di fiducia degli investitori nelle prospettive future di tale classe di attivo.

Per una panoramica dettagliata dei rischi connessi alle criptovalute e, in particolare, ai prodotti di BEU, si prega di fare riferimento al prospetto e alle condizioni definitive, disponibili nella sezione “Risorse” del sito internet di Bitwise Europe all’indirizzo bitwiseinvestments.eu/it/resources/. Si dovrebbe investire soltanto se si è in grado di comprendere e valutare i rischi connessi. In caso di dubbi in merito all’adeguatezza di un investimento, si raccomanda di consultare un soggetto autorizzato specializzato nella consulenza in materia di investimenti, inclusi gli ETP garantiti da criptovalute.