Binance has confirmed that $6.3 billion in digital assets were impacted by a security breach, making it the largest crypto theft on record. The exchange said about half of the assets have been frozen, that a substantial sum remains with the attackers, and that it will cover all losses.
Withdrawals are disabled while Binance confirms the environment is secure. Binance.US said it was not affected.
At a glance
| Metric | Figure |
|---|---|
| Assets impacted | $6.3 billion |
| Hot wallets involved | 17 |
| Chains involved | 9 |
| Withdrawal approvals | 50 |
| Attack window | 20:04–23:56 UTC, October 29 |
| Frozen or rescued | About $2.7 billion |
| Still with attacker | About $3.2 billion at 06:43 UTC |
The on-chain figures come from Bitquery's investigation and are consistent with Binance's own statement that about half of the affected assets were frozen. Tether and Circle alone accounted for roughly $2.4 billion of the freeze.
What happened
Binance co-CEO Richard Teng said the initial investigation pointed to a compromised engineer's laptop. That gave the attacker access to a service container, where they submitted unauthorized withdrawal transactions. Teng stressed that the attacker did not simply use one engineer's permissions and that this was not a one-click action. The company later said its investigation had uncovered additional breach points and that it was still gathering facts.
Binance said it had found no evidence of a wallet private key leak. A detailed post-mortem is expected after the investigation.
Bitquery's timeline is more specific: between 20:04 and 23:56 UTC on October 29, Binance's withdrawal system signed away $6.3 billion from 17 hot wallets on nine chains. The attacker's code ran against Binance's busiest Ethereum hot wallet for about three hours and 50 minutes, using 50 approvals signed by Binance's system.
Who is suspected
Two analytics firms attributed the attack to TraderTraitor, a North Korean hacking unit also known as Lazarus Group. Chainalysis said it had high confidence in the North Korean link. Check Point and TRM Labs said the attack resembled earlier North Korean-linked incidents, including the $1.5 billion Bybit hack in 2025 and the $388 million Bitget hack in September.
Western security agencies have previously said North Korean operatives steal crypto to fund weapons and missile programs. Binance did not directly answer questions about the North Korea link, saying it was working with law enforcement to confirm identities.
How the funds moved
According to Bitquery, the attacker swapped about $729 million of stolen USDT into ETH and TRX before Tether's freezes landed. The attacker ended up holding 508,621 ETH, about 2.5 times the 200,630 ETH it originally took; the rest was bought with stolen stablecoins and tokens.
At 06:43 UTC on October 30, about $3.2 billion was still with the attacker, mostly ETH and BTC held in wallets that had never sent a transaction. Bitquery said it had not traced any of those funds to a known exchange or a mixer at the time of its analysis. That can change as tracing continues, but it shows how much of the haul remains outside the freeze.
The freeze
Tether, Circle, Arbitrum's Security Council, and four smaller issuers locked about $2.7 billion, according to Bitquery. Tether and Circle said they froze a total of about $2.4 billion. Six of Tether's eleven freezes hit wallets that had already been emptied, which limited how much could be recovered.
World Liberty Financial said it worked with partners to freeze stolen funds. Coinbase said it was unaffected and was monitoring the situation.
Market reaction
Bitcoin fell more than 4% after alerts about the breach, and Ethereum and Solana also dropped sharply. The incident eclipses the 2025 Bybit hack and is the largest crypto theft on record, according to Check Point and Binance's own estimate.
Binance at a glance
Binance was founded in China in 2017 and has grown into the world's largest crypto exchange, with more than 300 million registered users. In 2024 it said it held more than $160 billion in assets under custody. It has also faced regulatory scrutiny in several jurisdictions. Binance.US, the smaller American platform, said it was not affected by the incident.
The Lazarus playbook
TraderTraitor is the name used by several security firms for a North Korean unit also known as Lazarus Group. The group has been linked to a long list of crypto thefts, including the $1.5 billion Bybit hack in 2025. The Bitget incident in September 2026, in which $388 million was lost, is another comparison point cited by Check Point.
Check Point's Jayant Dave said the Binance attack shows that attackers no longer need the vault keys. Instead, they target the systems and people with authority to use them. That is a shift from the classic cold-wallet breach narrative: the keys can stay secure while the approval path is compromised.
Timeline
- October 29, 20:04 UTC: The attacker's withdrawal transactions begin.
- October 29, 23:56 UTC: The attack window closes; about $6.3 billion has left 17 hot wallets on nine chains.
- October 29: Binance confirms the security incident and disables withdrawals. Tether and Circle begin freezing assets. Bitcoin falls more than 4%.
- October 30: Binance says about half of the $6.3 billion has been frozen, warns of additional breach points, and says it will cover all losses.
What Binance says
Binance says it will cover all losses and is working with law enforcement. It has promised a detailed post-mortem. The exchange has not attributed responsibility to any individual and says it has not found evidence of a private key leak.
What we still do not know
Several important questions remain open. Binance has not published a full account of the additional breach points or said how long withdrawals will stay disabled. The final loss figure may change as tracing and freezes continue. The North Korea attribution is widely supported by analytics firms but has not been confirmed by Binance or by governments in the reporting so far. And it is still unclear how much of the $3.2 billion still held by the attacker can be recovered.
What happens next
Binance is expected to publish a post-mortem, reopen withdrawals only after confirming the environment is secure, and continue working with law enforcement and blockchain analysts. Tether, Circle, and other issuers will keep monitoring the frozen addresses. Regulators are likely to ask how a single compromised laptop and a service container could authorize billions in withdrawals.
What users should know
Withdrawals are disabled, so users cannot move funds off the exchange right now. Binance.US says it is unaffected. Be sceptical of phishing messages, fake support accounts, and anyone offering to recover funds or speed up withdrawals. Verify updates through Binance's official channels.
Why it matters
The attack is a reminder that exchange security is not only about cold wallets and private keys. The initial entry point was an engineer's laptop, and the damage was done through a service container with withdrawal authority. The scale also matters for the wider crypto market: a $6.3 billion incident, with billions frozen and a suspected state-linked actor, is a watershed moment for exchange security and for how the industry thinks about operational access.
FAQ
Is Binance.US affected?
No. Binance.US said its platform is not affected by the incident.
Have private keys leaked?
Binance says it has found no evidence of a wallet private key leak.
How much has been frozen?
About $2.7 billion, according to Bitquery, including about $2.4 billion frozen by Tether and Circle.
Who is TraderTraitor?
A North Korean hacking unit also known as Lazarus Group, linked to previous crypto thefts including Bybit and Bitget.
Can the stolen funds be recovered?
Some have been frozen, but about $3.2 billion was still with the attacker at the last on-chain snapshot. Recovery is uncertain and will depend on tracing, issuers, and law enforcement.
When will withdrawals resume?
Binance has not given a date. It says withdrawals will stay disabled until the environment is confirmed secure.