Binance Hack Explained in Simple Points (2019 & 2022)
Binance Hack Explained in Simple Points
Two very different attacks, one famous exchange. Here is what happened, how much was stolen, who paid for it, and where it sits among the biggest crypto thefts ever.
Reading time: about 7 minutes.
The short version
Binance was hit twice. In May 2019, hackers drained about 7,000 Bitcoin (roughly $40 million) from an exchange hot wallet. In October 2022, an attacker exploited a bug in a cross-chain bridge on Binance’s blockchain and created 2 million BNB tokens, worth about $570 million on paper.
Binance said it would cover user losses in 2019. In 2022, the chain was paused and most of the funds were frozen. Neither hack is the largest crypto theft in history, but the 2022 one is among the largest ever.
Is this really the biggest cyber incident ever?
You will often see Binance’s name next to the words “biggest hack ever.” That is not accurate, and it helps to know why before you read on.
A fair reality check
The 2019 theft was about $40 million, which was serious but small by crypto standards. The 2022 exploit looked huge on paper ($570 million), yet Binance’s CEO said the attacker only got away with around $100 million, because the chain was halted quickly.
For comparison, the Bybit exchange hack in February 2025 was widely reported at about $1.5 billion, and was linked by investigators to North Korea–connected hackers. That makes it the largest crypto theft on record as far as public reporting shows.
So why does Binance get the label? Because it is the world’s largest crypto exchange by trading volume, so any breach there feels enormous. The two incidents are still worth understanding, because they show two completely different ways crypto can be attacked.
The 2019 hack, step by step
This was a classic “steal the keys, then empty the safe” attack. Here is the story in order.
- Hackers gather the tools Binance later said the attackers used a mix of methods, including phishing and viruses. They collected a large number of user API keys, two-factor authentication (2FA) codes and possibly other information.
- One big withdrawal (7 May 2019) The team spotted the breach at 17:15 UTC. The hackers had moved over 7,000 BTC out of Binance’s Bitcoin hot wallet in a single transaction.
- Binance hits the brakes Deposits and withdrawals were suspended while the team investigated. CEO Changpeng Zhao (known as CZ) told users their funds were “SAFU,” short for Secure Asset Fund for Users.
- The reorg idea is dropped Binance considered rewriting part of the Bitcoin blockchain to undo the theft. It rejected the idea after talking to others, because splitting the Bitcoin network could damage trust in Bitcoin itself.
- Other exchanges help Exchanges including Coinbase and KuCoin worked with Binance to block deposits from the hacker’s addresses, making it harder to cash out.
- Users are made whole Binance said it would use its SAFU emergency fund to cover the incident in full, so no user funds would be lost.
Why only 2% was at risk
Exchanges keep most crypto offline in “cold storage,” which is not connected to the internet. A small amount stays in a “hot wallet” so customers can withdraw quickly. The hot wallet is convenient, but it is the part hackers can actually reach.
That design is why Binance could say the damage was limited. The attackers got into the part of the system built to be reachable, and nothing else.
The 2022 BNB Chain bridge exploit
The second hack had nothing to do with stolen passwords. It targeted a piece of software called a cross-chain bridge.
What is a bridge?
A bridge lets you move a token from one blockchain to another. You lock your coins on one side, and the bridge hands you matching coins on the other. If someone tricks the bridge into believing coins were locked when they were not, it will happily hand out free money.
What went wrong
Binance’s bridge, called BSC Token Hub, connects BNB Beacon Chain and BNB Smart Chain. Security researchers reported that the attacker forged a proof that the bridge uses to check transfers. The bridge believed the proof was real, so it released 2 million BNB that had never been deposited.
How much was really lost?
- Paper value: 2 million BNB was worth about $570 million at the time.
- Real loss: CZ said around $100 million got away. Other analysts put it at roughly $110 million, since a large portion was frozen when the chain was paused.
- Response: On 6 October 2022, validators paused BNB Smart Chain. It resumed operating about a day later after the bug was fixed.
What about ordinary users?
Binance said user funds were safe in the 2022 incident, because the stolen tokens came from the bridge’s minting flaw rather than from customer accounts. Even so, the chain was frozen for hours, and the BNB price dipped on the news.
How the hacks compare
| Incident | When | Amount | How it happened |
|---|---|---|---|
| Binance exchange hack | May 2019 | 7,000 BTC (~$40M) | Phishing, viruses and stolen API keys and 2FA codes; hot wallet drained |
| BNB Chain bridge exploit | October 2022 | 2M BNB (~$570M on paper, ~$100M+ taken) | Forged proof tricked the cross-chain bridge into minting tokens |
| Bybit exchange hack | February 2025 | About $1.5 billion (widely reported) | Attributed by investigators to North Korea–linked hackers |
How to keep your crypto safer
The lessons from both incidents are practical. You cannot fix an exchange’s code, but you can reduce your own risk.
- Use an authenticator app or a hardware key for 2FA. Avoid SMS codes where you can. Stolen 2FA codes were part of the 2019 attack.
- Lock down your API keys. Give each key the minimum permissions, turn off withdrawals unless you need them, and restrict keys to trusted IP addresses.
- Turn on withdrawal address whitelisting. Then funds can only go to addresses you approved in advance.
- Set an anti-phishing code. Most exchanges let you add a code that appears in every genuine email they send you.
- Do not keep everything on one exchange. Move long-term holdings to a hardware wallet you control.
- Be careful with bridges. Use well-audited ones, avoid moving more than you need, and expect that new tech can fail.
Frequently asked questions
How much was stolen in the Binance hack?
In May 2019, hackers took 7,000 Bitcoin worth around $40 million. In October 2022, an attacker created 2 million BNB worth about $570 million at the time, though only around $100 million left the chain.
Did Binance users lose money?
In 2019, Binance said it would cover the losses in full using its SAFU fund. In 2022, Binance said user funds were safe.
Was the Binance hack the biggest crypto hack ever?
No. The 2022 BNB Chain exploit was one of the largest, but the 2025 Bybit hack, reported at about $1.5 billion, is considered the largest so far.
What does SAFU mean?
SAFU stands for Secure Asset Fund for Users. It is an emergency reserve that Binance keeps to compensate users if a breach happens.
Is Binance safe to use today?
No exchange is risk free. Binance has strengthened its security since these incidents, but you should still use strong 2FA, withdrawal whitelisting, and avoid keeping large long-term holdings on any exchange.
Disclaimer: This article is for general information only and is not financial or investment advice. Crypto assets are volatile and carry risk. Figures are based on contemporary news reports and may differ across sources.
Sources and further reading
- CNBC, “Hackers stole over $40 million of bitcoin from Binance” (8 May 2019)
- Yahoo Finance / Cointelegraph, “What We Know About the Binance Hack So Far” (May 2019)
- Reuters / Investing.com, “Hackers steal $570 million from bridge to Binance blockchain” (7 Oct 2022)
- Merkle Science, “Hack Track: Analysis of the BNB Smart Chain Exploit” (7 Oct 2022)