Hackers took approximately $6.3 billion in digital assets from Binance-controlled wallets on October 29, marking the largest hack in crypto history and putting the security system of the world’s largest exchange under unprecedented pressure. Binance suspended withdrawals but kept deposits open, while industry partners froze roughly $3 billion in related assets and the exchange committed to covering all user losses.
The ultimate cause remains undetermined, but transactions bearing valid signatures suggest hackers may have breached Binance’s approval system, raising questions about how the exchange protects user assets after the record hack.
A Multichain Attack Unfolded in Minutes
According to official updates from Binance, initial investigations indicate that a DevOps engineer’s computer may have been compromised, allowing attackers to access a service container and submit unauthorized withdrawal orders. The exchange has found no evidence of private key leaks, but later stated that the investigation identified additional access points beyond the initial hypothesis.
Assets left Binance wallets across 11 blockchains, with most transactions concentrated within a 30-minute window starting at 20:05 UTC on October 29, according to analysis by Elliptic. Ethereum suffered the largest loss at approximately $3.8 billion, while a Bitcoin hot wallet transferred 18,270 BTC, worth around $1.47 billion at the time of the transaction. Another transfer appeared several hours later.
On Ethereum specifically, the hacker used pre-signed authorization orders to transfer control of a hot wallet to a smart contract under their control. Assets on other blockchains left wallets via standard signed transactions. This pattern raises the possibility that the hacker accessed Binance’s approval layer or transaction-signing infrastructure, rather than merely compromising a single computer or stealing a private key.
Nearly Half the Stolen Assets Have Been Frozen
Binance stated that approximately $3 billion in related assets has been frozen with the support of industry partners. Elliptic verified about $2.84 billion as of 12:55 UTC on October 30, representing 44% of the $6.43 billion total tracked by the firm. Stablecoins accounted for roughly 94% of the locked assets. Tether froze nearly $1.57 billion in USDT, while Circle blocked over $800 million in USDC. Ripple and several other issuers also froze related tokens.
USDT and USDC can be blocked because their issuers have the authority to blacklist addresses, preventing tokens in those wallets from being transferred further. This mechanism does not exist for Bitcoin, Ether, XRP, and native blockchain assets not issued by a central entity.
Before the freeze orders took effect, the hacker swapped roughly $786 million in stablecoins for ETH or TRX. Some transactions were executed at prices 12% to 26% below market rates, indicating that the attacker prioritized speed when moving funds into assets that issuers cannot lock.
According to Binance, they are coordinating with partners and law enforcement agencies to recover the roughly $3 billion that has been locked, while committing to using company resources to cover any remaining shortfall for users.
Binance Faces a Test of Its Financial Resilience
More than $6.34 billion in corporate funds has been allocated to replace the stolen assets, according to Binance updates. The exchange said approximately $5 billion was already held in the affected tokens, including USDT, USDC, Bitcoin, Ether, and BNB. The remaining deficit is being purchased through the open market and over-the-counter transactions. The SAFU user protection fund, valued at around $1 billion, may also be used to cover losses.
Binance recorded 335 million registered accounts and roughly $162.8 billion in assets under custody at the end of 2025. The $6.3 billion loss represents nearly 3.9% of those assets. However, the full composition of the $6.34 billion allocated for reimbursement has not been independently verified. The most recent Proof of Reserves snapshot before the hack was dated October 1, with updated data following asset replacement expected to be published on November 2.
Withdrawal services remained suspended on October 31, while deposit operations continued normally. Binance aims to reopen withdrawals on November 1 after rebuilding systems and completing security audits. These two milestones will provide the first data points regarding the exchange’s ability to meet withdrawal requests and fully restore collateral assets following the attack.
The attack dragged Bitcoin down to $76,368, its lowest level in six weeks, while Ether hit $2,178, a two-month low. BNB fell approximately 5.3% in 24 hours. Coinbase stock lost 4.8% and Strategy fell nearly 6% in after-hours trading, although Coinbase stated it was not directly affected.
Investigators Point to a North Korea-Linked Group
TRM Labs attributed the attack to TraderTraitor, a hacking group believed to be linked to North Korea, with high confidence. Chainalysis issued a similar assessment, while Elliptic noted that Pyongyang-linked actors were likely behind the theft.
TRM cited small withdrawals from Tornado Cash to fund operational wallets, code testing activity, and a series of pre-generated signatures created before the assets were transferred. Elliptic also discovered that a portion of the funds from the Binance incident went to an address that had previously received assets from the Bitget hack in September, an earlier incident also suspected to involve North Korea.
TraderTraitor was previously identified by the FBI as the perpetrator of the Bybit hack worth approximately $1.5 billion in February 2025. The Binance incident is more than four times larger and carries several similar hallmarks, including preparation, the use of pre-generated signatures, and the speed of asset dispersion.
Values at the time of theft. Source: Elliptic
No government or law enforcement agency has officially attributed responsibility to North Korea in the Binance case as of October 31. The exchange has also not publicly identified the perpetrator and stated it is coordinating with law enforcement authorities. A Reuters source indicated that the FBI and the U.S. Secret Service are participating in the investigation.
