Binance Breach: What We Know about the $6.3B Theft

Binance said on Oct. 29 that attackers moved an estimated $6.3 billion out of its systems. The exchange says it has frozen about $3 billion of that amount and will cover all losses. "User funds are safe," Binance wrote on X. The BBC described the incident as the largest known crypto theft on record.

How the incident unfolded

Binance's first public message was cautious. It said its teams were "aware of reports of a potential security issue and are actively investigating."

CZ, Binance's founder, wrote on X:

"It does look like a hack on Binance." He added that he no longer manages Binance.com, "but as a shareholder, I expect all user funds will be fully covered."

On-chain analysis shows funds leaving hot wallets across nine to eleven blockchains, among them Ethereum, Bitcoin, Tron and Solana. The main outflows started around 20:05 UTC. Binance said they "ceased when we paused withdrawal service." Bitcoin slid as the news spread.

What Binance says caused it

The exchange's first explanation pointed to "a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It also said it had "found no evidence of any wallet private key leak."

That account changed within hours. A later post said the investigation "has uncovered additional points of breach" and called it "a complex attack." Binance has promised a full technical post-mortem, plus an updated Proof of Reserves after remediation.

Its messages on deposits also shifted. Early posts said deposits and withdrawals were both suspended. Later updates said deposits "remain unaffected," and Binance expected to resume withdrawals within 45 hours after a security revamp of the withdrawal service and related addresses. It also suspended Binance Alpha trading and revoked the affected address authorisation. Users were warned to trust only official channels because of scams.

A hot wallet is an internet-connected wallet an exchange uses to process withdrawals. Exchanges keep most customer funds in offline cold storage, so a breach of this kind usually reaches only the funds sitting in hot wallets. A loss near $6.3 billion would be unusually large for that layer.

The freeze figures

The frozen total moved during the day. Binance first corrected circulating reports of $1.8 billion, saying "the current verified total frozen is $2.54 billion." It later put the figure at "around $3 billion". CZ credited Tether with about $971 million and Circle with about $823 million.

Who is blamed and how it compares

Blockchain intelligence firms including TRM Labs, have attributed the attack with high confidence to North Korea-linked actors, specifically the TraderTraitor unit tied to the Lazarus Group. It has similarities to the 2025 Bybit incident. Binance says it is working with law enforcement to confirm the identity of the attackers. It has not independently confirmed the attribution.

The Bybit hack in February 2025 cost about $1.5 billion, and the FBI publicly tied it to TraderTraitor. Binance's own past incidents were far smaller. In May 2019, hackers took about 7,000 BTC from a hot wallet, and the SAFU fund covered the loss. In October 2022, an exploit on the BNB Chain bridge minted about 2 million BNB, though the chain was halted and most of the value was contained.

Binance created SAFU in 2018, funding it with a share of trading fees. It started publishing Proof of Reserves after the FTX collapse in late 2022.

Binance says it will "only share confirmed figures," and the frozen total may rise as issuers and law enforcement trace more of the stolen assets.

ICE and Trade[XYZ] Bring Hyperliquid Perps to US Traders | HODL FM NEWS

ICE, owner of the NYSE, signed a deal with Trade[XYZ] to bring Hyperliquid-based perpetual futures to US retail traders, pending regulatory approval.

HODL FM News: The Wildest Ride in the Crypto MarketKristian Koch

Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.