Binance Loses $6.3B In The Largest Crypto Hack Ever

About $6.3 billion left Binance's wallets late on Thursday, October 29, and most of it went in roughly 20 minutes. TRM Labs puts the start at 20:05 UTC and counts ten blockchains hit. That is about four times the $1.5 billion Bybit hack of February 2025, the previous record.

Binance said on X that its early investigation points to a compromised laptop belonging to a DevOps engineer. The attacker got into a service container from there and submitted unauthorized withdrawals. The exchange says it has found no evidence that a wallet private key leaked, and it has not explained how the laptop was compromised. Richard Teng later pushed back on the tidy version of the story, according to Forbes: the attacker did not just borrow one engineer's permissions, and it was not a single one-click action.

The Freeze Did The Heavy Lifting

Speed saved roughly half the money. Changpeng Zhao, who no longer runs Binance, wrote that it did look like a hack and thanked Tether and Circle for freezing quickly. Tether CEO Paolo Ardoino said his company froze more than $1.567 billion in USDT. Circle CEO Jeremy Allaire said more than $800 million in USDC was frozen with law enforcement. Ripple froze about $200 million in RLUSD, per Binance co-CEO Yi He, and World Liberty Financial froze some USD1. The Arbitrum Security Council pulled about $30 million in ETH and ARB out of the attacker's reach.

Binance counts about $3 billion frozen. TRM's tally is closer to $2.7 billion. Both are well short of the total, and the gap is the uncomfortable part.

What Nobody Can Freeze

Bitcoin and ETH have no issuer with a kill switch. TRM and others estimate that around $2.4 billion sits with the attacker in more than 420,000 ETH and 18,270 BTC. CryptoQuant's Julio Moreno tracked that BTC out of a Binance cold wallet into 19 fresh addresses, 17 of them holding exactly 1,000 BTC. When he posted, none of it had touched an exchange, a bridge or a mixer.

The attacker was not idle while the freezes landed. TRM saw about 325 million USDT sold through intent-based swaps for roughly 122,300 ETH, about 10% below market. Another $60 million in USDT went into Aave as collateral against 19,762 ETH borrowed, around $44.6 million. Aave froze its V3 and V4 markets, and says its contracts were not at fault. Chainalysis said it is seeing laundering patterns it has never seen before and suspects automation.

North Korea is The Working Theory

TRM and Chainalysis both attribute the theft to TraderTraitor, North Korea's elite hacking unit, which was also behind Bybit. Chainalysis says funds from September's Bitget exploit are commingling with the Binance loot. Binance itself has not named anyone.

Markets Flinched, Then Steadied A Bit

Bitcoin dropped to around $76,650, a six-week low, before bouncing to about $78,500. BNB sold off 7% to 8%, to roughly $690. Crypto Ticker counted $628 million in liquidations in the first hour. Laevitas' Rick Maeda called the BNB drop quite modest for what may be the biggest exchange theft ever.

The Bill

Binance says it has set aside more than $6.34 billion of company money to make users whole. About $5 billion is already sitting in the same tokens that were taken. The remaining $1.3 billion or so is being bought on the open market and over the counter. The frozen $3 billion is not counted in that figure. Repayments to affected users have started, but some tokens are thinly traded and large OTC deals do not settle instantly, so completing the buy takes time.

CertiK told Cointelegraph it needs more data from Binance before it can verify the $5 billion on-chain. Yi He said the exchange's revenue this year is enough to cover the loss and it does not need to sell its SpaceX stake.

Deposits and withdrawals have been paused since about 22:15 UTC on Thursday while Binance rebuilds its withdrawal service. It expects to reopen within 45 to 48 hours. Two things will tell us more by then: the post-mortem Binance has promised, and an updated proof of reserves that should show, token by token, whether $6.34 billion really replaces what left.

Numbers That Don't Agree

Loss estimates vary by source: Binance says about $6.3 billion, TRM $6.36 billion, Elliptic $6.43 billion and Chainalysis $5.9 billion. Frozen totals also moved through the night, from $1.8 billion to $3 billion, depending on who was counting and when.