Binance said $6.3bn of digital assets were taken in the biggest crypto hack on record, and that it will cover all losses itself.
On Thursday, the exchange said the theft involved digital assets worth $6.3bn (£4.7bn), making it what’s thought to be the biggest crypto theft in the industry's history. Binance will reimburse all customer losses using its emergency Secure Asset Fund for Users and company funds.
TRM Labs, a blockchain analytics firm, put the theft at $6.36bn in a report on the incident and called it the largest crypto theft on record. Either figure dwarfs the $1.5bn taken from the Bybit exchange in 2025, the previous record.
Roughly half the affected assets had been frozen by Friday, while attackers still held many of them. Check Point chief information security officer Jayant Dave said the incident ranked as the biggest crypto theft on record based on Binance's own estimate.
How the money left
The outflows from Binance wallets began at 20:05 UTC on 29 October, TRM Labs said. In roughly 20 minutes, most funds moved across ten separate networks, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger.
The attacker exploited EIP-7702, a feature on Ethereum, to transfer control of a Binance hot wallet to code they controlled. TRM said one transaction moved 167,464 ETH alongside 63 other tokens, among them 1.615 billion USDT.
Another wave targeted wallets on Avalanche and Polygon at about 23:05 UTC. TRM said the attacker began preparing at least 36 hours in advance, funding a wallet with small withdrawals from Tornado Cash and testing the attack on test wallets.
A laptop, then more breach points
Binance co-CEO Richard Teng said the first findings pointed to an engineer's compromised laptop as the entry point. It let an attacker reach a service container and submit unauthorised withdrawal transactions.
To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.
In an update on X, Binance said further inquiries uncovered breach points beyond the laptop. Investigators had found no evidence that a wallet private key had leaked, and no individual had been blamed, Teng said.
This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them.
Dave said the Binance incident had similarities to a September attack on Bitget, the crypto exchange platform, which caused losses of $388m (£289m).
The North Korean link
Both TRM Labs and Chainalysis attributed the incident to a North Korean hacking unit called TraderTraitor. Chainalysis said it has high confidence that the North Korean group is linked to the hack.
Known in the industry as Lazarus Group, TraderTraitor is also blamed for the 2025 Bybit hack, Check Point said. Similarities to previous incidents tied to North Korea, including the Bybit case, link the Binance attack to those incidents. Onchain analyst ZachXBT also connected the exploit to Tradertraitor, a threat actor tied to North Korea.
In the past, Western security agencies have said North Korea uses stolen money to support its nuclear weapons and missile development programmes. Binance hasn't identified a culprit, and North Korea has denied involvement in hacks in the past.
The freeze, minute by minute
Tether froze 971.1 million USDT at 21:01 UTC on 29 October; Circle followed three minutes later, freezing 823 million USDC, TRM said. The two issuers put the total amount frozen in response to the potential Binance hack at about $2.4bn.
On X, Tether chief executive Paolo Ardoino said the company had blocked more than $1.5bn in assets connected to a potential hack of the Binance exchange. Circle co-founder and chief executive Jeremy Allaire said the firm had frozen more than $800m of its coins linked to the incident.
| Measure | Amount |
|---|---|
| Theft, Binance figure | $6.3bn |
| Theft, TRM Labs figure | $6.36bn |
| USDT frozen by Tether | 971.1m |
| USDC frozen by Circle | 823m |
| Frozen on-chain by 00:30 UTC, TRM | about $2.7bn |
| Frozen, Binance figure | about $3bn |
| Held by attacker, no issuer can freeze | about $2.4bn |
On-chain freezes totalled about $2.7bn by 00:30 UTC on Friday, TRM reported. Binance put its own total at about $3bn.
The attacker retained 420,000 ETH and 18,270 BTC, valued at about $2.4bn and beyond the reach of any issuer's freeze, TRM said. Before the freezes spread, the attacker exchanged about 325 million USDT for ETH at a discount exceeding 10%, then borrowed ETH against USDT on the lending protocol Aave. Aave subsequently froze the affected markets.
- Two days beforePreparation
At least 36 hours of groundwork, with a wallet funded by small withdrawals from Tornado Cash and rehearsals on test wallets.
- 20:05 UTC, 29 OctFirst wave
Funds begin leaving Binance wallets across ten blockchains.
- 21:01 UTCTether freezes
971.1 million USDT frozen.
- 21:04 UTCCircle freezes
823 million USDC frozen three minutes later.
- 23:05 UTCSecond wave
Wallets on Avalanche and Polygon hit.
- 00:30 UTC, 30 OctCount
TRM counts about $2.7bn frozen on-chain; Binance later puts the figure at about $3bn.
Markets and withdrawals
After Binance confirmed the hack, crypto liquidations surpassed $1.54bn on Friday morning. Wiped-out long positions accounted for $1.29bn, just over 80% of the total. Bitcoin fell to a multiweek low of $76,320, while liquidations involving the top cryptocurrency approached $500m, five times the less than $99m reported 12 hours earlier.
Bitcoin had dropped by more than 4% following the alerts, and other major cryptocurrencies including Ethereum and Solana fell sharply too.
It may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralised exchanges, as well as counterparty, solvency and liquidity risks
Binance halted deposits and withdrawals on Thursday night. By Friday, deposits were operating normally, and the exchange said it expected withdrawals to resume within 45 hours of its latest update.
Safety first: withdrawals are currently disabled until the environment is confirmed to be secure.
Yi He thanked various cryptocurrency issuers for freezing the assets. During security checks, Binance said it paused deposits and withdrawals, revoked the affected address authorisation and brought in law enforcement and blockchain intelligence partners to help trace and recover funds.
We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Founded in China in 2017, Binance runs a digital-asset trading platform with an estimated user base of more than 300 million registered users around the world. In 2024, the company said it held more than $160bn in assets under its custody.
What is still open
TRM Labs noted that Binance hasn't published a root cause, though the company said its investigation uncovered additional points of breach beyond the laptop.
The final bill isn't settled either. Tracing and recovery of the roughly $2.4bn held in ETH and BTC are far from over. Binance is expected to resume withdrawals within 45 hours of its latest update, though another account put the resumption at within 48 hours.
After completing its investigation, Binance said it plans to release a technical post-mortem and an updated proof of reserves.
