Binance Hit by $6.3 Billion Hack, the Largest Crypto Theft on Record, With About $3 Billion Frozen

Binance, the world's largest crypto exchange, lost an estimated $6.3 billion in a security breach on Thursday, 29 October, the biggest theft the industry has ever recorded. About $3 billion of the stolen assets has already been frozen on-chain, and the exchange says it will cover every dollar of customer losses.

Withdrawals were still paused on Friday morning. Binance says it expects to switch them back on within 48 hours, while blockchain investigators have pinned the attack on TraderTraitor, the North Korean state-backed group the FBI blamed for the Bybit hack in February 2025.

What happened

The first warning came from on-chain data, not from Binance. Blockchain researcher Spreek flagged assets moving from a Binance-linked Ethereum wallet to a newly created address through a contract call allegedly funded by Tornado Cash, Cointelegraph reported. The Block said Spreek's data showed about $3.55 billion flowing into the unlabeled wallet.

Estimates climbed quickly. Coinbase's Conor Grogan put the figure at up to $5.8 billion, according to The Block, and Arkham Intelligence grouped wallets it labeled "binance-hacker-1029" holding about $5.84 billion. CNBC reported that Arkham tied nearly $6 billion to 55 addresses.

Binance co-founder Yi He first said only that the firm was "actively investigating". Later that night the exchange confirmed the breach, suspended deposits and withdrawals, halted Binance Alpha trading and put the estimated total impact at around $6.3 billion.

A laptop, not a leaked key

The exchange's early explanation points at a person's computer rather than its wallets. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said, as quoted by CNBC.

"We have found no evidence of any wallet private key leak," the statement added, promising a full technical post-mortem. Blockaid CEO Ido Ben-Natan told Cointelegraph his preliminary read was "key misuse": a compromised signing system tricked into approving malicious transactions without the key itself being extracted.

That distinction matters for anyone who assumes a big exchange's hot wallets fail only when a key escapes. Here the signing machinery appears to have done exactly what it was told, by the wrong person.

Who froze what

Stablecoin issuers moved within hours. Tether CEO Paolo Ardoino said the company froze more than 1.567 billion USDT, and Circle's Jeremy Allaire said more than 800 million USDC was frozen, The Block reported. "Protecting the industry and our partners is our main priority," Ardoino wrote.

Others followed. Ripple said it was freezing affected RLUSD, and Yi He later said Ripple helped halt $200 million in funds, according to CNBC. World Liberty Financial froze $27 million in USD1 and $2 million in WLFI, and First Digital confirmed it had frozen the FDUSD involved, Cointelegraph reported.

The most unusual freeze came from a blockchain itself. At 8:08am Hong Kong time on 30 October, the Arbitrum Security Council froze 8,425 ETH and 74,559,805.2 ARB held on Arbitrum One by an address tied to the exploit, the council said on its governance forum. It temporarily upgraded the network's inbox contract to move the funds, then reverted it. The assets, worth about $30.5 million according to Cointelegraph, can now only be moved by an ArbitrumDAO governance vote.

DeFi protocols braced too. Aave froze its V3 and V4 markets after the exploiter deposited 60 million USDT and borrowed 19,762 WETH, worth about $44.6 million, between 8:58pm and 9:01pm UTC on Thursday, Cointelegraph reported citing risk adviser LlamaRisk.

The North Korea link

TRM Labs attributed the attack to TraderTraitor with "high confidence," CNBC reported. The firm said about $6.36 billion was moved from Binance wallets across 10 blockchains, most of it within about 20 minutes, and that preparation began at least 36 hours earlier, with Tornado Cash used to fund the attacker's wallets.

Chainalysis CEO Jonathan Levin put the theft at $6.4 billion and also pointed to TraderTraitor. Chainalysis separately estimated $5.912 billion at the time of theft, four times what was taken from Bybit in 2025, according to Cointelegraph. On-chain investigator ZachXBT said Binance funds were commingled in the same address as proceeds from the earlier Bitget exploit after arriving via THORChain, which he said "indicates the same actor is likely behind both incidents."

It fits a pattern coinasity has tracked before, as North Korean hackers keep escalating attacks on the crypto industry.

Why it matters

The size alone resets the record. CNBC pointed to Bybit's roughly $1.5 billion loss in 2025 and Bitget's more recent loss of over $350 million. Binance's estimated impact is several times either.

Markets took it badly. Bitcoin fell more than 4% to $77,994.96, CNBC reported, while Cointelegraph cited CoinGecko data showing bitcoin near $76,937, BNB down 8% to about $693 and ether down 5.7% to about $2,211. AAVE dropped 11.3%, UNI 10.7%, and the Bitcoin Fear and Greed Index fell to 30, a level not seen since August. Circle shares slid about 5% after hours.

The ripple effect reached trading firms too. Wintermute CEO Evgeny Gaevoy said its Binance exposure was under 20% of net equity, and GSR's Xin Song put his firm's at under 5%, Cointelegraph reported. Neither expects operational disruption. Binance.US said it was a separate platform and was not affected, according to The Block.

Can Binance cover it?

Binance says it will pay losses from its Secure Asset Fund for Users (SAFU) and company funds, and publish an updated Proof of Reserves after remediation. Former CEO Changpeng Zhao said that as a shareholder he expects "all user funds will be fully covered."

Sean Farrell of Fundstrat told CNBC the breach "does not currently appear to create meaningful solvency risk for Binance." He estimated about $3.3 billion remains unfrozen and said the roughly $1.2 billion SAFU fund could cover about a third of that, with the exchange's own money making up the rest, assuming frozen stablecoins are returned.

What's next

The first test is withdrawals. Binance says they stay paused while it rebuilds its withdrawal service and related addresses, with a restart expected within 48 hours. "The key tell will be how quickly withdrawals resume and whether outflows stay orderly," Farrell said.

Getting frozen money back is slower than freezing it. "A freeze stops the money from moving, and recovery follows through legal process," TRM Labs' Ari Redbord told CNBC, adding that stablecoins are the most recoverable asset because issuers can freeze, burn and reissue tokens. Bitcoin and ether have no issuer, so investigators must catch them at cooperating platforms. Chainalysis' Eric Jardine warned returns "can take months or years."

There is also a debate about where trading goes from here. Standard Chartered's Geoffrey Kendrick told Cointelegraph the hack could push more volume to decentralized exchanges, kept his $100 target for UNI by 2030, and said the breach was "another reason why that forecast may end up being too low."

Expect Binance's post-mortem, a refreshed Proof of Reserves and, eventually, an ArbitrumDAO vote on what happens to the frozen ARB and ETH. Until withdrawals are flowing again, the market will treat every update from the exchange as the real verdict on how contained this is.