EN
Hackers drained an estimated $6.3 billion from Binance, the world's largest cryptocurrency exchange, on the evening of October 29, in what is widely being described as the largest crypto theft ever recorded.
Blockchain intelligence firm TRM Labs says roughly $6.36 billion left Binance wallets across ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. That is around four times the $1.5 billion stolen from rival exchange Bybit in February 2025, previously the biggest crypto heist on record. The BBC also reported that the attack is suspected to be the largest in history.
Binance has confirmed a security incident, temporarily suspended withdrawals on several networks as a precaution, and said user funds are safe. The company has not yet published a root cause, and figures may change as the investigation continues.
TRM Labs attributes the attack, with high confidence, to TraderTraitor, a North Korean state-backed hacking unit that the FBI previously linked to the Bybit theft. The firm points to tell-tale signs seen in earlier North Korea-linked heists, including small Tornado Cash withdrawals used to fund an operator wallet, preparation that began well before the theft, and signatures obtained in advance then used in a single burst.
According to TRM, preparation started at least 36 hours earlier. On the night, Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and other networks sent their balances to attacker-controlled addresses within minutes, with a second wave hitting Avalanche and Polygon about three hours later. On Ethereum, the attacker used a feature called EIP-7702 to take control of one of Binance's best-known hot wallets, the internet-connected wallets exchanges use to process customer withdrawals, and kept sweeping new deposits into it through the night.
Because wallets on so many different chains all produced valid signatures for the attacker, TRM's assessment is that Binance's hot wallet signing system itself was likely compromised. In its words, the hacker appears to have gained the ability to make that system sign "transactions of its choosing across chains."
The damage could have been worse. Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial, along with Arbitrum's Security Council, froze around $2.7 billion of the stolen funds. But TRM estimates the attacker still controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, and expects the funds to move next through bridges, swap services and over-the-counter brokers.
Binance's own early findings point to a single point of failure. In a statement reported by the Free Press Journal, the exchange said its initial investigation traced the breach to a compromised laptop belonging to one of its DevOps engineers, which let the attacker reach a service container and submit unauthorised withdrawals.
The exchange has paused deposits and withdrawals and brought in law enforcement and blockchain investigators. It has pledged that users will not bear the losses, which it plans to cover from its Secure Asset Fund for Users (SAFU) and company funds, and says withdrawals will resume once its security review is complete, though no timeline has been given. Founder Changpeng Zhao, who no longer runs the company but remains its largest shareholder, said in a post on X that the incident "looked like a hack," as reported by Australian Associated Press. Binance has promised a detailed technical post-mortem and an updated proof-of-reserves report.
For ordinary users, the immediate impact is that their money is stuck. With withdrawals frozen, customers in the US, Europe and around the world cannot move funds off the platform until Binance completes its review. For anyone relying on the exchange for savings or regular payments, that uncertainty is likely to be the biggest worry in the days ahead.
On CNBC, Franklin Templeton's head of crypto argued that the response should focus on targeting the bad actors behind the attack, not punishing the victims.
Major hacks are quickly followed by a second wave of fraud aimed at worried users. Binance itself has urged customers to rely only on official channels for updates and to beware of scams. Common tricks after incidents like this include:
Binance will not ask for your password, two-factor codes or seed phrase, and genuine compensation will never require you to pay a fee. Type binance.com directly into your browser or use the official app, rather than following links. If you are unsure whether a site is genuine, a free website checker such as ScamAdviser's can show how new a domain is and whether others have flagged it, and the ScamAdviser app can warn you about risky links on your phone. If you are targeted, report it to Binance through the official app and share it via ScamAdviser's Report a Scam page to warn others.
Adam Collins is a cybersecurity researcher at ScamAdviser who operates under a pseudonym for privacy and security. With over four years on the digital frontlines, he specialises in translating complex threats into actionable advice. His mission: exposing red flags so you can navigate the web with confidence.
