The Binance hack on Thursday, October 29, took an estimated $6.3 billion from the world’s largest crypto exchange, by Binance’s own count. That is more than four times the $1.5 billion stolen from Bybit in 2025, the previous record.
Binance says it will cover every customer’s loss and expects to reopen withdrawals within about two days. Americans aren’t supposed to use Binance’s main exchange at all, under a 2023 federal settlement. The fallout still reached them on Friday. Bitcoin fell, crypto stocks slid, and the dollar-pegged stablecoins USDT and USDC were pulled into the chase.
How the Binance hack unfolded
Crypto watchers on X flagged large outflows from Binance-linked wallets early Thursday afternoon US time. By evening Binance had confirmed a security incident to TechCrunch. Spokesperson Ross O’Leary said the exchange had “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”
Founder Changpeng Zhao no longer runs Binance but is its largest shareholder. “It does look like a hack on Binance,” he posted on X, as quoted by Yahoo Finance.
Binance’s first explanation came late Thursday, according to Fortune. The attack “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container,” the exchange said. From there, the attacker submitted unauthorized withdrawals.
That account has already grown. On Friday, co-CEO Richard Teng called it a “more complex attack process,” not a single “one-click” action. Binance said it had found “additional points of breach,” Cointelegraph reported. It has found no evidence that wallet private keys leaked, CoinDesk reported.
How much was stolen, and how much is frozen
Binance estimates the total impact at about $6.3 billion. Blockchain analytics firm Chainalysis put the haul at roughly $5.9 billion at the time of the theft, according to CoinDesk. In the first hours, unverified estimates on X ranged from $2 billion to $8 billion. That is why early headlines carried much smaller numbers.
About $3 billion is now frozen, Binance said late Thursday, including about $2.3 billion in the stablecoins USDT and USDC. Tether CEO Paolo Ardoino said his company froze more than $1.57 billion in USDT. Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC, according to CoinDesk.
Freezing works because both coins are run by companies that can block transfers from specific addresses. Bitcoin and ether have no such switch, so the remaining $3.3 billion or so is harder to stop. Early tallies put about $1.5 billion of the haul in bitcoin and just under $1 billion in ether, Fortune reported.
The attacker moved fast. TRM Labs said the hackers hit Binance wallets on 10 blockchains and moved most of the money in about 20 minutes, RTE reported, citing Reuters. They also borrowed about $44 million in wrapped ether on the lending platform Aave, using stolen USDT as collateral, according to CoinDesk. Aave then froze markets across its platform as a precaution.
Investigators point to North Korea’s TraderTraitor
TRM Labs, a US blockchain analysis firm, attributed the attack “with high confidence” to TraderTraitor, a North Korean hacking group. Chainalysis CEO Jonathan Levin also named the group as the likely culprit, according to Cointelegraph. On-chain investigator ZachXBT said money from this hack and from September’s $350 million Bitget exploit was mixed at one address.
The name matters for Americans. The FBI publicly blamed TraderTraitor for the Bybit theft in February 2025. It then asked exchanges, analytics firms and other crypto services to block addresses the group used to launder the money. The FBI has not attributed the Binance attack.
Binance itself hasn’t named anyone. “Our investigation has not attributed responsibility to any individual,” Teng said. The exchange told Reuters it was “doing all we can in coordination with law enforcement to resolve it,” according to RTE. North Korea’s mission in Geneva and its embassy in China did not respond to Reuters.
Why US users are mostly on the sidelines
Binance.com has been off-limits to Americans since a 2023 settlement with federal regulators. The Treasury Department’s November 2023 announcement required a “complete exit from the United States,” including not serving US persons. Binance paid a $3.4 billion FinCEN penalty and a $968 million sanctions penalty. It also accepted a five-year monitor.
Zhao pleaded guilty in the same case and served four months in prison in 2024. President Trump pardoned him on October 23, 2025, TechCrunch reported.
Binance.US is a separate company, and it said it was not affected, as did Coinbase, according to RTE. Treasury found in 2023 that Binance had steered users toward VPNs to get around its own geographic blocks. Any American still on the global exchange that way now waits in the same withdrawal queue as everyone else.
The wider exposure runs through prices. Bitcoin fell more than 3% in Asian trading to a six-week low of $76,368, RTE reported. Before Friday’s US open, Coinbase and Strategy shares were down about 5% and Robinhood 5.8%, according to Yahoo Finance.
Who pays, and what to watch
Binance says customers won’t. It will cover all losses from company funds and its Secure Asset Fund for Users, a reserve set up in 2018, according to CoinDesk. On Friday it said it had set aside more than $6.34 billion, Cointelegraph reported. Of that, $5 billion is already held in the affected tokens. Co-CEO Yi He said the exchange would cover “all hacking losses.”
That pledge is checkable. The test is whether withdrawals reopen on time and balances come back whole. Deposits are working normally, Binance said. As of Friday morning UTC, it said it was on track to resume withdrawals in about 45 hours.
Binance’s first statement also warned users to avoid scams, unofficial links and requests for account information, according to TechCrunch. That advice holds for anyone who gets a message about this hack, whether or not they use Binance. Fake prompts that borrow a trusted name are a standard trick, as in the fake CAPTCHA scam we explained this week, and this month brought a run of unrelated security incidents too.
The next concrete step is the reopening of withdrawals, which Binance’s 45-hour estimate puts at early Sunday, November 1, UTC. A full post-mortem is promised once the investigation is complete.
