Hackers drained about US$6.3 billion from the world’s largest crypto exchange on 29 October, in what analysts call the biggest crypto theft on record. Binance says users will not lose money and has restarted withdrawals. Several questions remain open: how the attackers got in, who they are, and how much of the money can be recovered. This article covers the position as of Tuesday 3 November 2026 and what ordinary users should take from it.
Over a few hours on Thursday 29 October, attackers moved funds out of Binance’s hot wallets across ten blockchains. Blockchain analytics firm TRM Labs says most of the money left in about 20 minutes. It puts the total at about US$6.36 billion, measured at the prices when the assets were taken. That is roughly four times the US$1.5 billion Bybit hack of February 2025, previously the largest.
Binance suspended withdrawals, promised to cover every user’s losses and reopened withdrawals in phases on Sunday 1 November. Early data suggests most customers stayed.
The numbers at a glance
| Item |
Figure |
Source |
| Amount stolen |
About US$6.36bn at time of theft (about US$6.23bn at later prices) |
TRM Labs |
| Earlier independent estimate |
About US$5.9bn |
Chainalysis, reported 30 October |
| Company reserve set aside |
More than US$6.34bn |
Reported by PBS |
| Frozen by token issuers and partners |
About US$2.5bn to US$3bn, depending on the count and date |
Binance, TRM |
| Losses replaced so far |
About 95% (up from 90% on Saturday) |
Binance, reported by Gizmodo and Bitcoin Magazine |
| Net outflow in first 9.5 hours of reopened withdrawals |
About US$3.64bn, or 2.1% of assets |
Binance, reported by Gizmodo |
The totals differ because firms count at different times, at different prices and with different assumptions about what is “stolen”. Treat them as a range, not a single number.
Background: a big target with a long history
Binance is the world’s largest exchange, with about 335 million registered users and about US$162.8 billion in customer assets, according to its 2025 annual report. It was also hacked in 2019, when about 7,000 BTC (roughly US$41 million) was taken. Binance covered users from its Secure Asset Fund for Users (SAFU), a reserve it set up in 2018 and has historically kept at about US$1 billion.
Crypto theft is rising in scale. TRM Labs says attackers stole about US$2.9 billion across nearly 150 attacks in 2025. One attack now exceeds that, more than twice over.
Key developments
How it happened. Accounts differ, and Binance has not yet published a full post-mortem.
- Binance’s early finding was a compromised laptop belonging to a DevOps engineer. Attackers reportedly used it to reach a service container and submit unauthorised withdrawals. Binance has since said it found additional points of breach. It says it found no evidence that wallet private keys leaked.
- TRM Labs describes preparation starting at least 36 hours earlier, including small Tornado Cash withdrawals to fund an operator wallet and test runs of the attack code. On Ethereum, it says the attacker turned a Binance hot wallet into a sweeper contract using a feature called EIP-7702. On nine other chains, funds left through ordinary signed transfers. TRM’s assessment is that the evidence points to a compromise of Binance’s wallet signing systems.
- Co-CEO Richard Teng said the attack was not the work of one person and used a “self-destruct mechanism” that complicates the investigation.
In plain terms: the attackers appear to have gained control over the systems that approve withdrawals from Binance’s operational wallets. They did not break the blockchains themselves.
Who is behind it. TRM Labs attributes the attack to TraderTraitor, which it calls North Korea’s premier hacking unit, with “high confidence”. Chainalysis also believes TraderTraitor likely carried it out. The FBI previously blamed the same group for the Bybit theft. Binance has not confirmed any attribution. President Donald Trump told reporters, “We’re looking at that,” when asked about North Korea. North Korea has not responded.
The freeze
Token issuers acted within hours. Tether froze about US$1.57 billion to US$1.77 billion of USDT, Circle more than US$800 million of USDC, and Ripple and World Liberty Financial smaller amounts. The Arbitrum Security Council also forced the transfer of about US$30 million in assets. Frozen is not the same as recovered, and returning funds can take weeks.
What is left unfrozen
Reports put the unfrozen portion at about US$3.3 billion. TRM expects it to move through cross-chain bridges, swap services and over-the-counter brokers. Elliptic said laundering was running “on autopilot”, with one Tron wallet releasing funds hourly for 31 straight hours. Chainalysis chief executive Jonathan Levin said the attackers have more money than their trusted laundering routes can absorb.
Covering the losses
Binance says it is funding replacements from part of SAFU, part of its futures insurance fund and its corporate treasury. It had covered about 95% by Sunday. The remaining 5% is in less liquid tokens that it is buying on the market and through over-the-counter desks. Major assets, including bitcoin, ether, USDT, USDC, BNB, Solana and XRP, are fully backed. Binance has committed to restoring SAFU to about US$1 billion. The use of the futures insurance fund drew attention because Binance has described part of its remaining balance as a regulatory requirement.
Proving it
Binance published a new proof-of-reserves snapshot dated 31 October, with the zero-knowledge proof completed on Monday. Holders of BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD or ZEC can use an open-source verifier to check that their balances are backed at least 1:1. The next snapshot is due on 4 November, covering more tokens.
The reopening
Withdrawals restarted on Sunday at 06:00 UTC, starting with bitcoin and reaching 15 networks. In the first 9.5 hours, Binance reported US$4.65 billion in withdrawals against US$1.01 billion in deposits. CZ, the company’s founder, said most of the net outflow came in the first couple of hours and that “98% choose to stay”. That is Binance’s own account of its own data. A further withdrawal phase is scheduled for today.
Markets
Bitcoin fell about 4.5% to roughly US$76,600, a six-week low. Ether fell about 5% and BNB about 7%, according to reports. More than US$1.5 billion in leveraged positions was liquidated over 24 hours. Shares of Coinbase and other crypto-linked companies also fell. Binance.US and Coinbase said they were not affected.
What it means for ordinary users
The hack was not a failure of Bitcoin or Ethereum. It was a failure of one company’s operational security. That distinction matters for anyone deciding what to do next.
If you hold crypto on Binance:
- Binance says users will not bear the loss, and its coverage figures are rising. But this is a company promise, not a government guarantee. Use the proof-of-reserves verifier to check your own balance.
- Don’t withdraw in a panic because of rumours. Binance’s own guidance says the same. Do withdraw whatever you cannot afford to have stuck on any platform.
- Switch on two-factor authentication and an anti-phishing code. Treat unexpected messages about your account as suspect, since scammers exploit big news.
For everyone holding crypto:
- Keep on any exchange only what you need for trading. Long-term holdings are safer in a wallet you control, though that brings its own risks of lost keys and mistakes.
- Spread holdings across more than one platform, and prefer ones that publish proof of reserves.
- Be wary of anyone promising to “recover” stolen or stuck funds for a fee.
Please note, this is general information, not financial advice.
Business Diary Analysis
Three lessons stand out.
First, the hack underlines how much trust sits with centralised exchanges. Binance was able to absorb a loss of this size, but few platforms could. A user’s protection depends on the company’s balance sheet, not on a legal guarantee.
Second, the response was faster than in earlier hacks. Token issuers froze about US$2.5 billion to US$3 billion within hours, and proof of reserves gave users something to verify. That speed is also a reminder that “decentralised” money is not always beyond intervention.
Third, the open questions are material: the full root cause, the unfrozen US$3.3 billion and the attribution. Until Binance publishes its post-mortem, confidence rests partly on the company’s own statements.
Key takeaways
- About US$6.3 billion was stolen from Binance on 29 October, the largest crypto theft on record.
- Binance says users won’t bear the loss. It reported about 95% of losses replaced by Sunday and restarted withdrawals in phases.
- TRM Labs and Chainalysis point to North Korea’s TraderTraitor group. Binance hasn’t confirmed this.
- About US$2.5 billion to US$3 billion was frozen, but roughly US$3.3 billion remains unfrozen.
- Users can check backing through Binance’s proof-of-reserves verifier. Keep only what you need on any exchange.
What’s next?
Watch for Binance’s technical post-mortem, the second withdrawal phase and the 4 November proof-of-reserves snapshot. Also watch for any official US attribution, the pace of recoveries and laundering, and whether regulators, including Zimbabwe’s FIU, respond to the incident.
Sources
