Binance loses $6.3 billion in the largest crypto theft on record

Binance, the world's largest cryptocurrency exchange, says about $6.3 billion in crypto was taken from its wallets on 29 October. That makes it the largest crypto theft on record, roughly four times the $1.5 billion stolen from Bybit in February 2025. Binance has suspended deposits and withdrawals and says it will cover all losses. Two blockchain analytics firms, TRM Labs and Chainalysis, attribute the attack to TraderTraitor, a North Korean hacking unit.

How the money left

In its official update, Binance said the initial investigation points to a compromised laptop belonging to a DevOps engineer. The attacker used it to get into a service container and submit unauthorized withdrawal transactions. The exchange says it found no evidence that wallet private keys leaked and promised a detailed post-mortem once the investigation is complete.

TRM Labs reconstructed the theft from the blockchain. Starting at 20:05 UTC, Binance wallets on ten networks, including Ethereum, Bitcoin, XRP Ledger, Tron and Solana, sent their balances to addresses controlled by one attacker, most of it within about 20 minutes. On Ethereum, the attacker used 50 signatures prepared in advance to turn a Binance hot wallet into a contract that forwarded its funds on command. A single transaction then moved 167,464 ETH and 1.615 billion USDT. In TRM's view, this means the attacker could make Binance's signing system approve transactions of its choosing. Preparation began at least 36 hours before the theft.

TRM says it makes the North Korea attribution "with high confidence" and points to the same signs seen in the Bybit hack: small Tornado Cash withdrawals to fund the operator's wallet, long staging, and signatures collected in advance and used in one burst. Chainalysis estimates the haul at about $5.9 billion at the time of the theft. Western security agencies have said earlier that North Korea uses stolen crypto to fund its weapons programs. Binance has not commented on the attribution.

What was frozen and what was not

Stablecoin issuers moved quickly. Tether froze about 1.57 billion USDT and Circle more than $800 million in USDC. Ripple and World Liberty Financial froze smaller amounts, and the Arbitrum Security Council blocked about $30 million on its network. The attacker raced the freezes by selling USDT to market makers and borrowing ETH against it. According to TRM, they still control more than 420,000 ETH and 18,270 BTC, which no issuer can freeze.

A CoinDesk review of Binance's own proof-of-reserves report from 1 October found that the drained wallets were among those backing customer balances. Until Binance replaces the stolen ether, its ETH backing is likely around 94% instead of 100%. Binance says it will pay for the losses from its SAFU emergency fund and its own money, and will publish updated reserves once the cleanup is done. The next regular snapshot is due on 1 November.

What Binance users should do now

• Expect withdrawals to stay paused for a while: Binance said it hoped to restore them within about 48 hours, after rebuilding the withdrawal service.
• Follow updates only on binance.com and Binance's verified accounts.
• Ignore messages offering "compensation", "refunds" or "wallet verification". Big hacks are routinely followed by phishing that exploits them, and no real refund needs your password, 2FA code or seed phrase.
• Do not install apps or browser extensions sent to you as "Binance recovery tools".
• Check that two-factor authentication and the withdrawal address whitelist are on in your account.

Binance.US, a separate company for American users, says it was not affected, and Coinbase said the same about its platform. Markets still reacted: bitcoin fell 4 to 5% to below $77,000 after the news. A similar but far smaller case played out in India shortly before: the exchange CoinDCX first called hack reports false and then admitted losing $16 million. Even a large exchange remains a single point of failure for the money kept on it.