On October 29 at around 20:05 UTC, attackers began draining Binance's hot wallets. The exchange puts the loss at about $6.3 billion. Analytics firms give similar figures: TRM Labs $6.36 billion, Chainalysis about $6.4 billion, Elliptic $6.43 billion.
According to TRM Labs, it is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
How it happened
Binance's initial investigation suggested the attack may have started with a compromised DevOps engineer's laptop, which let the attacker reach a service container and submit unauthorized withdrawals. Binance later said it had found additional points of breach and called it a complex attack.
So far, Binance says, it has found no evidence that wallet private keys were leaked. The investigation is ongoing, and the exchange has promised a detailed post-mortem.
According to TRM Labs, most of the funds were drained within about 20 minutes. TRM counts 10 affected blockchains (Elliptic counts 11), including Ethereum, Bitcoin, Tron and Solana.
Who is suspected
TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group. TRM says it makes this call "with high confidence", and Elliptic calls it likely. These are assessments by private analytics firms.
Binance has not named anyone. The FBI has only said it is aware of the incident and working with partners. No arrests have been reported.
What happened to the money
- About $3 billion of the stolen funds has been frozen on-chain, Binance said on October 30. Independent estimates are a little lower, from $2.7 to $2.85 billion. Stablecoin issuers froze the most: Tether over $1.5 billion, Circle over $800 million.
- Binance is covering the loss with its own money: part of its SAFU fund, part of its futures insurance fund and its corporate treasury. As of October 31, 90% of the stolen assets had been replenished. Ten coins, including BTC, ETH, USDT and BNB, are fully replenished, and the exchange is still buying the less liquid tokens.
- Replenishing is not the same as recovering: Binance is replacing the stolen assets with its own, not getting them back from the hackers.
- The stolen funds came from the exchange's own hot wallets. Binance says it will absorb the loss, not its users.
When withdrawals reopen
As of October 31, withdrawals from Binance were paused. The exchange planned to start a phased reopening on November 1 and promised a separate update with details. Deposits are working, according to Binance.
Binance took a new Proof of Reserves snapshot on October 31 and expects the full balance verification by November 3.
Binance has not announced any compensation claims process. Messages and emails with "recover your funds after the hack" links are a red flag. Check withdrawal status only on Binance's official website and channels.
Sources: Binance, TRM Labs, Chainalysis, Elliptic.