avday An attacker took about $6.36bn from Binance on Thursday 29 October, most of it in about 20 minutes from 20:05 UTC, blockchain analysts TRM Labs found.
That makes the Binance hack the largest crypto theft on record, TRM said: about four times the $1.5bn taken from Bybit in February 2025. Binance puts the impact at around $6.3bn.
Binance says no customer will lose money. But SAFU, its emergency fund, held only about $1bn in bitcoin, according to CoinDesk. So most of any payout would come from Binance itself.
Are Binance funds safe? What users should do now
Binance will cover all losses from SAFU and company funds, co-CEO Richard Teng said on Friday, Cointelegraph reported. Binance hasn’t said how the bill splits. What backs that promise, and what doesn’t:
- The theft is about 4% of the roughly $144bn on the platform, CoinDesk calculated from DefiLlama figures.
- About $3bn is frozen, Binance said overnight.
- About $2.4bn is beyond any issuer’s reach. It’s in bitcoin and ether, which have no issuer to lock them, TRM said.
And where accounts stand as of Friday morning, 30 October:
- Withdrawals are paused. Binance is revamping the security of its withdrawal service and said overnight they should begin resuming within 48 hours, according to Cointelegraph.
- Deposits work. Binance said around midnight UTC it had suspended them, then said by Friday morning they were operating normally.
- Nobody genuine will ask you to move coins to a “safe” wallet. Binance told TechCrunch users “should not trust unofficial links, messages, or requests for account information”. We gave the same advice after the Coinbase vendor data leak came to light on 27 October.
How the Binance hack happened
Binance says it started with a “compromised DevOps engineer’s laptop”, which let the attacker into a service container and to “submit unauthorized withdrawal transactions”, as quoted by CoinDesk. It found “no evidence of any wallet private key leak”.
TRM’s on-chain reading points somewhere deeper:
- The attacker came prepared. On Ethereum it used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled. It had 50 pre-signed authorisations ready, covering 50 consecutive nonces, so one would still be valid. Preparation began at least 36 hours earlier.
- One transaction did most of the damage. It moved 167,464 ETH and 1.615bn USDT.
- TRM blames the signing system. It says the evidence “points to a compromise of Binance’s hot wallet signing infrastructure”. The Ethereum trick doesn’t explain the outflows on other chains.
Teng called it “a more complex attack process”, not a single “one-click” action. Binance has promised a full post-mortem but given no date.
An engineer’s machine with production access is part of your security perimeter. So are the coding agents on developer laptops that now hold the same credentials.
Who hacked Binance? North Korea’s TraderTraitor, analysts say
TRM attributes the attack to TraderTraitor, a North Korean hacking unit, “with high confidence”. The FBI named the same group for the Bybit hack. Chainalysis chief executive Jonathan Levin also said TraderTraitor was likely responsible, Cointelegraph reported.
The investigator ZachXBT found the stolen funds mixed with those from an earlier exploit of the exchange Bitget, which had been linked to the same group. Binance hasn’t named anyone. “Our investigation has not attributed responsibility to any individual,” Teng said.
How much was stolen from Binance, and how much is frozen
The totals differ because each counts something slightly different:
| Who | Figure | What it counts |
|---|---|---|
| TRM Labs | $6.36bn | Value when each asset left Binance, ten chains |
| TRM Labs | $6.23bn | The same assets at 30 October prices |
| Binance | About $6.3bn | “Estimated total impact” |
| Chainalysis | $5.9bn, later $6.4bn | Amount stolen; $5.9bn valued at the time of theft |
Stablecoin issuers can lock tokens in place, and they did. Tether froze more than 1.567bn USDT, chief executive Paolo Ardoino said. Circle froze more than 800m USDC, said its chief executive, Jeremy Allaire.
The attacker now holds more than 420,000 ETH and 18,270 BTC, TRM said. That’s about twice the 200,630 ETH it took, so by our reading it has been swapping other tokens into ether, which no issuer can freeze. Arkham data cited by CoinDesk showed the hacker’s wallet moving assets through Uniswap.
Binance withdrawals: what happens next
Bitcoin fell 4.8% to below $77,000 on the news and BNB, the token of the Binance-linked BNB Chain, dropped 8%, CoinDesk reported. The first test of confidence is Binance’s own deadline: withdrawals should start again by early Sunday 1 November, UTC. After that comes the post-mortem, which should say how one laptop reached the signing system.
