Binance hit by largest crypto heist on record

Overview

Updated 1 hour ago

Binance, the world's largest cryptocurrency exchange, lost about $6.3 billion in digital assets on October 29, by its own estimate, when an attacker drained its hot wallets across at least ten blockchains, most of it in roughly 20 minutes. It is the largest crypto theft on record — about four times the size of the $1.5 billion Bybit hack in February 2025.

Stablecoin issuers froze about $2.8 billion of the stolen funds within hours, but billions more remain in the attacker's control. Binance suspended deposits and withdrawals and says it will cover all losses. Analytics firms Elliptic, Chainalysis, and TRM Labs attribute the theft to North Korea, and Chainalysis and TRM name its TraderTraitor hacking unit, though Binance has not confirmed attribution.

Why it matters

The hack shows a breach that began on one engineer's laptop can drain billions from the world's largest exchange — and tests whether stablecoin freezes can stop North Korean laundering.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

$6.3B

Total value stolen from Binance

Attacker drained hot wallets across at least ten blockchains on October 29; Binance's estimate, analytics firms say up to $6.4B.

$2.8B

Stolen assets frozen on-chain

Elliptic verified $2.84B frozen; Chainalysis says about $2.8B, TRM Labs about $2.7B.

Blockchains affected

Elliptic's count; TRM Labs counts ten. Wallets drained on Ethereum, Bitcoin, Tron, Solana, XRP Ledger, and others.

44%

Share of stolen funds frozen

Elliptic's verified $2.84 billion frozen, as a share of its $6.43 billion total.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Richard Teng

Co-Chief Executive, Binance

Leading the hack response

Ari Redbord

Global Head of Policy, TRM Labs

Assessing the hack on-chain

Organizations Involved

Binance

Cryptocurrency exchange

Suspended deposits and withdrawals; covering losses

World's largest cryptocurrency exchange by trading volume.

TraderTraitor (Lazarus Group)

State-sponsored hacking group

Suspected of carrying out the theft

North Korean hacking group attributed to major crypto thefts.

Tether

Stablecoin issuer

Froze $1.18 billion of stolen USDT

Issuer of USDT, the largest stablecoin by market capitalization.

Circle

Stablecoin issuer

Froze $823 million of stolen USDC

US-based issuer of USDC, the second-largest stablecoin.

Timeline

6 events Latest: Today

Tap a bar to jump to that date

October 2026
Analytics firms point to North Korea
Today Attribution

Elliptic, Chainalysis, and TRM Labs attribute the theft to North Korea; Chainalysis and TRM name TraderTraitor. No government has confirmed.
Today
Theft begins on XRP Ledger
Attack

Five Binance wallets on the XRP Ledger sent 233 million XRP to a single attacker-controlled address. The drain then spread to other blockchains.
Yesterday • 20:05 UTC
Bulk of Ethereum losses leave in one transaction
Attack

$2.53 billion in Ethereum assets exit a single Binance wallet in one transaction. Total Ethereum losses reached $3.80 billion across 186 tokens.
Yesterday • 20:24 UTC
Stablecoin issuers freeze stolen funds
Response

Tether froze 1.18 billion USDT in the attacker's main wallet 37 minutes after funds arrived. Circle froze 823 million USDC three minutes later. Ripple, Paxos, and others followed.
Yesterday
Binance halts withdrawals, pledges to cover losses
Response

Binance suspended deposits and withdrawals. Co-CEO Richard Teng said the company would cover all losses using its SAFU fund and company funds.
Yesterday
Attacker prepares the exploit
Preparation

The attacker received three small Tornado Cash withdrawals on October 28. On October 29 the exploit code was tested on two wallets and rehearsed on a third, about four hours before it was used.
2 days ago

Scenarios

Binance recovers most stolen funds after record freezes

Possible Resolves by Q2 2027

Discussed by: Elliptic, TRM Labs, industry analysts

$2.84 billion was verified frozen on-chain within hours, close to Binance's estimate of $3 billion. Stablecoin issuers froze the attacker's main wallets and followed the funds as they moved, giving recoverers significant leverage. The Bybit precedent suggests full recovery is unlikely, but a majority recovery is within reach if the attacker cannot launder the remaining assets fast enough through mixers and bridges.

US government formally blames North Korea for Binance hack

Likely Resolves by End of 2026

Discussed by: Chainalysis, Elliptic

Chainalysis and TRM Labs name TraderTraitor and Elliptic attributes the theft to North Korea, citing infrastructure overlap with the Bitget exploit and method similarities to Bybit. The FBI attributed the Bybit hack within five days in February 2025. A formal US or UN designation would trigger sanctions and likely freeze additional assets. Attribution depends on Binance publishing its post-mortem and the FBI completing its own investigation.

US regulators open enforcement action against Binance over hack

Possible Resolves by End of 2027

Discussed by: Reuters, regulatory analysts

Binance settled US criminal and regulatory charges in 2023 and has operated under continued scrutiny. A $6.3 billion breach tied to a compromised DevOps laptop raises questions about access controls and key management. If Binance's post-mortem reveals systemic weaknesses in its custody infrastructure, the Department of Justice, Securities and Exchange Commission, or Commodity Futures Trading Commission could open formal proceedings.

Historical Context

2 moments from history that rhyme with this story — and how they unfolded.

February 2025

Bybit hack (February 2025)

North Korean hackers stole $1.5 billion from the Bybit exchange by compromising a developer's machine at wallet provider Safe{Wallet} and manipulating the transaction Bybit's signers approved. It was the largest crypto theft at the time, more than twice the size of any previous hack.

Then

The FBI attributed the hack to North Korea within five days. Hackers laundered much of the stolen funds despite freeze attempts.

Now

Established that modern crypto heists come from compromising infrastructure around wallets, not breaking cryptography.

Why this matters now

The Binance attack followed a similar method — a compromised developer machine used to instruct signing infrastructure to drain wallets.

February 2016

Bangladesh Bank heist (2016)

North Korean hackers stole $81 million from the Bangladesh central bank's account at the Federal Reserve Bank of New York by exploiting Swift messaging credentials. They routed funds through casinos in Manila.

Then

Most of the money was laundered through the Philippines. US and Philippine authorities recovered about $18 million.

Now

Put North Korea on the map as a prolific state-sponsored cyber-theft actor and exposed weaknesses in the global Swift banking network.

Why this matters now

Shows how hard full recovery is once funds enter the laundering pipeline — and why the freeze within hours of the Binance theft matters.