Binance Says $6.3 Billion Breach Is the Largest Crypto Heist Ever as $3 Billion Is Frozen

Binance, the world’s largest cryptocurrency exchange by trading volume, has said a security breach had an estimated impact of about $6.3 billion, according to Reuters, a figure that would make it the largest cryptocurrency theft ever recorded. About $3 billion in affected assets had been frozen with the help of industry partners, Binance said, while the status of the remaining roughly $3.3 billion was not updated in the same statement.

The exchange suspended all deposits and withdrawals while it carried out security checks, froze funds and worked with law enforcement, according to Binance. It said it would cover all losses from its Secure Asset Fund for Users, known as SAFU, and from company funds, and that user funds were safe. It also said it would publish an updated proof of reserves once remediation was complete.

The incident began on the evening of 29 October, when large transfers left wallets identified as Binance hot wallets. CoinDesk, reviewing Binance’s own reserve data and on-chain records, reported that Etherscan showed 167,464 ether moving from a wallet labelled “Binance 14” at 20:24 UTC, followed by 28,005.6 ether from “Binance 16” into an attacker-controlled wallet. Nearly fifteen minutes later, CoinDesk reported, 195,460 ether, worth around $442 million at the time, was sent to a second address. Those movements were parts of a much larger, multi-asset outflow, not the whole incident on their own.

Binance’s first public response came at about 21:16 UTC, when it said it was aware of reports of a potential security incident and was investigating urgently, according to contemporaneous reporting. Changpeng Zhao, the exchange’s founder, who no longer runs the company but remains its largest shareholder, according to The Wall Street Journal, wrote on X: “It does look like a hack on Binance.” At that stage, AFP reported, neither the company nor industry observers had offered an explanation for how the transfers had happened.

The fuller account arrived in a Binance statement reported at about 00:30 GMT on Friday 30 October. In that statement, quoted by multiple outlets, Binance said its initial investigation suggested the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” Binance added: “We have found no evidence of any wallet private key leak.” It said a detailed technical post-mortem would follow once the investigation was complete and the facts were fully verified.

That wording matters. Binance described the laptop account as an initial suggestion, not a concluded finding. The exchange also said the $6.3 billion figure was its current estimate of total impact, and that the figure could change as tracing continued. Blockchain analytics firm Chainalysis gave a different, independently calculated estimate. Eric Jardine, Chainalysis’s head of research, told Reuters: “As of 8:30 p.m. ET (0030 GMT), we have confirmed that at least $5.912 billion was stolen, with funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron, Ripple and several Layer 2 networks.” Jardine also told Reuters that the investigation was ongoing and that the cause could not yet be confirmed.

Readers should therefore treat the two headline numbers as answers to slightly different questions. The $6.3 billion is Binance’s estimate of the incident’s total impact. The $5.912 billion is Chainalysis’s estimate of the amount stolen at the time of theft, based on confirmed on-chain movements available at that point. Early in the evening, before Binance published its estimate, other tallies circulated that were lower and far less certain. Neither number, on its own, establishes how much will ultimately be lost, recovered or returned.

What is clearer is the scale of the freeze effort that followed. Binance said about $3 billion had been frozen on-chain through blockchain partners. Stablecoin issuers moved first on the assets they control. Tether chief executive Paolo Ardoino said more than $1.567 billion in USDT had been frozen, according to CoinDesk, while Zhao said Circle’s freeze of USDC was around $823 million. CoinDesk also reported that Ripple froze around $200 million in assets and that World Liberty Financial froze $27 million worth of its USD1 stablecoin. Those figures come from different issuers at different moments, so they should not simply be added together into a single total, and a freeze is not the same as a recovery: freezing stops an asset moving, but it does not by itself establish when, or whether, it can be returned to the exchange or to customers.

The market reaction was immediate. Reuters reported that bitcoin hit a six-week low and was last down 3 per cent at $76,469.82, while ether was down more than 3 per cent at $2,185.83. Shares in the crypto exchange Coinbase Global slid 4.8 per cent, Reuters reported, while shares in Strategy, a major corporate buyer of bitcoin, fell nearly 6 per cent in extended United States trading. AFP, reporting at about 00:25 GMT, recorded a sharper snapshot from earlier in the night, with bitcoin down nearly 5 per cent, ether down nearly 6 per cent and BNB, Binance’s native token, down nearly 10 per cent. The two snapshots describe different moments in a fast-moving night, not a contradiction: prices fell steeply as the transfers were first spotted, then partly steadied as the freeze figures emerged.

Binance’s United States arm was not affected, according to The Wall Street Journal, which reported that Binance.US said it was unaffected by the security incident. That distinction matters for customers trying to work out which platform they use: Binance.US is a separate entity from the global Binance.com exchange at the centre of this incident, a point Binance and its United States arm have stressed in earlier, unrelated contexts and which reporting on this incident repeated.

Separately, on the same night, the prediction-market platform Polymarket paused trading on its international platform after some traders’ wallets were drained. Blockchain analytics firm Bubblemaps estimated that about 700 Polymarket users lost a combined $2.7 million, according to a summary of reporting by the BBC and WIRED. Polymarket did not confirm those totals to WIRED, according to the same summary, and no established link between the Polymarket incident and the Binance breach has been reported. The two incidents should not be treated as one attack, or added together, on the evidence available so far.

Who carried out the Binance transfers, and exactly how, remains unresolved. The Wall Street Journal reported that cybersecurity research firms TRM Labs and Pangolin Intelligence said the heist appeared to have been conducted by TraderTraitor, a hacking group linked to North Korea that has been blamed for many of the largest crypto thefts. BusinessDay, reporting the same attribution, said TRM Labs attributed the attack to TraderTraitor with high confidence, citing technical and on-chain indicators. Binance itself has not attributed the attack to any actor, and its investigation is ongoing. Attribution by outside researchers, however confident, is not the same as a concluded finding by the exchange or by law enforcement, and this article does not present it as one.

The technical mechanism is also disputed in its early stages. CoinDesk reported that the attacker used an Ethereum feature called EIP-7702, which lets a wallet hand control to a piece of software, and that after getting the Binance 14 wallet’s key to sign that permission, the attacker turned the wallet into a “sweeper” that forwarded incoming funds to an address under the attacker’s control. Other security researchers, quoted in contemporaneous reporting, described the incident instead as a misuse of the signing system, in which the attacker tricked Binance’s system into approving malicious transactions, rather than a straightforward theft of a private key. Mark Karpeles, the former head of the Mt. Gox exchange, told Reuters that the attacker appeared to have obtained a valid delegation for both Binance 14 and Binance 16, which in his view suggested the attacker had likely found the private key used by those addresses. That reading sits uneasily alongside Binance’s statement that it had found no evidence of a private-key leak. The post-mortem Binance has promised will need to resolve that tension with evidence, not assertion.

The wallets at the centre of the incident were not obscure side accounts. CoinDesk’s review of Binance’s proof-of-reserves data found that Binance 14 appeared in the exchange’s 1 October proof-of-reserves report, meaning the crypto taken was part of the assets Binance presented as backing customer balances. At the time of that report, CoinDesk reported, Binance 14 held 1.26 billion USDT and 89,475 ether, among 37 assets. On 1 October, Binance held exactly enough ether to cover customer balances, a 100 per cent reserve ratio, and 108.26 per cent of customers’ USDC, according to CoinDesk. The roughly 204,500 ether taken, CoinDesk calculated, represented about 5.6 per cent of Binance’s ether reserves, leaving ether backing near 94 per cent, with USDC and several smaller holdings also likely below 100 per cent until the missing assets are replaced. The attacker’s smaller positions, including ENA, UNI, PEPE and AAVE, represented between 7 and 15 per cent of Binance’s reported holdings of each, CoinDesk reported.

Binance and its co-chief executive Yi He have said user funds are safe, according to CoinDesk. In practice, as CoinDesk explained, that means customers’ balances will be honoured even though assets behind them were stolen. Zhao also said he expected users to be fully recovered, CoinDesk reported. Whether that promise holds in practice will be tested by the next reserve snapshot, due on 1 November, which CoinDesk said would show whether Binance had already replaced the stolen assets. Binance has said it will publish an updated proof of reserves once remediation is complete.

The SAFU fund, which Binance has pledged alongside company funds, is not by itself large enough to cover an incident of this size. CoinDesk reported that the fund holds around $1 billion in bitcoin. That is a substantial emergency reserve, but it is a fraction of a $6.3 billion estimated impact, which is why the pledge to draw on company funds as well, and the $3 billion already frozen, are central to any assessment of whether customers will be made whole, and how quickly. Binance covered a much smaller theft from its own funds in 2019, when attackers stole about $40 million in bitcoin, according to reporting on that incident, but the present incident is more than 150 times larger on Binance’s own estimate.

Law enforcement involvement is at an early stage. Binance said it was working with law enforcement as part of its security checks and freeze effort. AFP reported that the United States Department of Justice and the FBI did not immediately respond to requests for comment. No arrests, charges or official attribution had been announced at the time of reporting.

The incident is the latest in a long series of large cryptocurrency thefts, and by the reported figures it dwarfs them all. Reuters’s factbox on the Binance breach lists the previous record as the February 2025 theft of digital tokens worth $1.5 billion from the Bybit exchange, taken from a cold wallet used for ether tokens. Earlier cases listed by Reuters include the Ronin Network, where roughly $540 million was taken in March 2022; Poly Network, where $610 million was taken in August 2021, with hackers later returning nearly all of it; Wormhole, where $320 million was taken in February 2022; Coincheck, where $530 million was taken from a hot wallet in January 2018; and Mt. Gox, where bitcoin worth close to $500 million was stolen between 2011 and 2014, after which the exchange, which once handled 80 per cent of the world’s bitcoin trade, filed for bankruptcy in early 2014, with some 24,000 customers losing access to their funds. A hot wallet, Reuters explains, is a digital wallet stored online, while a cold wallet is usually stored offline and is supposed to be more secure. That distinction is part of why the Binance case will be studied closely: the wallets drained were hot wallets at the heart of a working exchange, not forgotten offline stores.

For now, the verified picture is this: a very large, multi-chain outflow from Binance hot wallets on 29 October; a company estimate of $6.3 billion in impact and about $3 billion frozen; an independent analytics estimate of at least $5.912 billion stolen; deposits and withdrawals suspended; a preliminary, unverified account involving a compromised laptop and a service container; competing technical readings of how signing authority was obtained; an outside attribution to a North Korea-linked group that Binance has not adopted; and a promise to cover all losses, whose fulfilment will be visible first in the freeze totals, then in the post-mortem, and then in the 1 November reserve snapshot. Everything beyond that picture — the final loss, the attacker’s identity, the precise entry point, and the date normal service resumes — remains unconfirmed.

Analysis: Why It Matters

1. Scale changes the question

Until this week, the standard reassurance about large exchanges was a relative one: the biggest platforms, with the largest security budgets, were presented as the safest place for ordinary users to keep crypto. A breach of this size at the world’s largest exchange by trading volume does not prove that reassurance false, but it changes what it has to mean. The question is no longer whether a well-resourced exchange can be breached — it plainly can — but whether its systems are designed so that a single compromised device, or a single misused signing permission, cannot move billions across several blockchains before anyone can stop it. Binance’s own preliminary account, involving one engineer’s laptop and one service container, will therefore face an obvious follow-up: what limits, approvals or delays should have stood between that starting point and $6.3 billion in impact? The post-mortem’s credibility will depend less on naming an entry point than on explaining why the blast radius was so large.

2. Frozen is not recovered, and the difference is the story

The $3 billion frozen figure has understandably dominated headlines, because it sounds like half the problem solved. In practice, freezing and recovering are different operations, governed by different actors. Stablecoins such as USDT and USDC can be frozen by their issuers because those issuers retain controls over the tokens they issue. Bitcoin and ether cannot be frozen in the same way: they can be traced on public blockchains, watched, and sometimes intercepted at exchanges, but the coins themselves keep moving unless someone with control over an address or an exchange intervenes. That is why analysts quoted by Reuters distinguished between the frozen stablecoin portion and the bitcoin and ether still under the attacker’s control, and why one researcher told Reuters he expected ether to face ongoing selling pressure through mixing services while bitcoin might remain harder to spend. For users, the practical lesson is to read every new freeze total as a measure of containment, not of restitution, until Binance shows the assets actually restored to its reserves.

3. The laptop-versus-key dispute is the whole security lesson

Two accounts of the mechanism are circulating, and they point to different failures. If an attacker compromised a laptop and then abused a service container’s legitimate access, the failure is operational: device security, access scope, and the permissions granted to internal services. If, as some researchers argue, the attacker obtained a valid delegation or misused the signing system itself, the failure is closer to the cryptographic heart of the exchange: who can authorise a transfer, and under what checks. Binance’s statement tries to hold both ideas at once — a compromised laptop, but no private-key leak — and that may yet prove coherent if the laptop gave access to a signing service rather than to a key itself. But the distinction cannot be waved through. A post-mortem that confirms the laptop route without explaining the signing route will leave the most important question unanswered, and a post-mortem that blames a key without evidence will contradict the company’s own first statement. The industry will learn more from how Binance resolves this tension than from the headline loss figure.

4. Proof of reserves now has a live, dated test

Proof-of-reserves reporting was invented to answer a simple scepticism: does the exchange actually hold the assets its customers think it holds? Binance’s 1 October snapshot gave a precise, dated answer, and the hack has now turned that snapshot into a before-and-after experiment. CoinDesk’s calculation — ether backing falling from 100 per cent to near 94 per cent on the assets taken — is an estimate based on that snapshot, not a live audit, and Binance’s balances will have moved since 1 October in any case. Even so, the 1 November snapshot, and the updated proof of reserves Binance has promised, will be the first hard evidence of whether the exchange has replaced what was taken, from frozen assets, company funds, or new purchases, and whether any other asset has slipped below full backing in the meantime. If that evidence arrives promptly and in full, it will do more for confidence than any statement that user funds are safe. If it is delayed, partial or qualified, the market will read the delay as information in itself.

5. The contagion risk is plumbing before it is price

Price falls are the visible symptom, but the analysts quoted by Reuters were more concerned about plumbing: deposits and withdrawals suspended at the largest venue, market makers unable to move capital between venues, spreads widening, leverage being cut back, and traders locked out of funds they need to meet margin calls elsewhere. One researcher told Reuters that spreads on spot bitcoin were five times wider than normal earlier in the morning, and 2.5 times wider for ether, before narrowing slightly. Another warned that funds locked during the interim could leave traders profitable on one venue and facing forced liquidation on another. That is how a theft at one exchange becomes a liquidity event for the whole market, even for users who hold no funds on Binance at all. The speed with which Binance restores deposits and withdrawals, and the transparency with which it explains any staged reopening, will therefore matter as much as the final loss figure. A long suspension, however prudent as a security measure, keeps that plumbing pressure in place.

There is a broader point, too, about what “largest” now means. The Bybit theft in 2025 was already a record, and it was attributed to North Korea-linked hackers. If the TraderTraitor attribution for Binance is confirmed, it would suggest that the same kind of actor has now struck the two largest targets in succession, at a scale four times larger than before, and that the defences of the best-resourced exchanges have not kept pace. If the attribution is not confirmed, the lesson is different but no less serious: an unknown actor, by an incompletely explained route, moved billions from the market’s central venue in minutes. Either way, regulators, who have spent years arguing about whether crypto exchanges should face bank-like controls, will have a fresh and unusually concrete example. The question they will ask is not whether crypto is risky — that is settled — but whether an exchange that sits at the centre of global trading can be allowed to operate with a single point of failure of this kind.

What to Watch Next

1. The post-mortem and the reopening date. Binance has promised a detailed technical post-mortem once the facts are fully verified. Watch for the precise entry point, the scope of the service container’s access, the signing mechanism, and the timeline from first unauthorised transfer to suspension. Watch equally for a reopening plan: whether deposits and withdrawals return together or in stages, and what checks are applied first.
2. The freeze total, and what frozen assets actually do next. The $3 billion frozen figure will move. Watch for updates from Tether, Circle and other issuers, for any law-enforcement seizures, and above all for evidence that frozen assets are being returned to Binance reserves rather than simply held in place. A rising freeze total without a rising reserve total would tell a different story from a rising freeze total that feeds directly into restored backing.
3. The 1 November reserve snapshot. CoinDesk reported that Binance’s next reserve snapshot is due on 1 November. Compare it, asset by asset, with the 1 October snapshot: ether and USDC backing, the smaller altcoin positions, and any statement about assets replaced from company funds. An updated proof of reserves, promised by Binance, should be read alongside it, not instead of it.
4. Attribution evidence. TRM Labs and Pangolin Intelligence have attributed the attack to TraderTraitor, according to The Wall Street Journal. Watch for Binance’s own attribution, or its explicit refusal to attribute, and for any law-enforcement statement. Treat further on-chain analysis as evidence to be weighed, not as confirmation, until the exchange or an investigating authority adopts it.
5. Regulatory and market follow-through. Watch for statements from regulators in major jurisdictions, for any change in how other exchanges describe their own hot-wallet limits and signing controls, and for whether liquidity and spreads return to normal once Binance reopens. Also watch the separate Polymarket investigation: any confirmed link, or any confirmed absence of a link, will matter for judging whether the night’s two incidents were coincidence or coordination.

Sources

• Reuters — Where Binance’s $6.3 billion breach ranks in crypto’s biggest hacks and heists
• Reuters, via Euronext — Analysts react as Binance freezes assets after $6.3 billion security breach
• AFP, via The Business Standard — Crypto platform Binance confirms major hack, more than $2.5bn frozen
• The Wall Street Journal — Binance suspends transactions after it is targeted in biggest-ever cyber heist
• CoinDesk — Binance says customer money is safe after huge hack drains key reserve wallets