Binance loses about $6.3 billion in what analysts call the biggest crypto hack ever

The skim

• Attackers drained about $6.3 billion in crypto from Binance wallets on Thursday evening, Binance says. Blockchain analytics firm TRM Labs puts it at $6.36 billion across ten blockchains, the largest crypto theft on record.
• Binance says its early investigation points to a compromised DevOps engineer's laptop. It found no evidence that wallet private keys leaked, and says it will cover all losses.
• TRM Labs and Chainalysis attribute the attack to North Korea's TraderTraitor group, the unit behind the $1.5 billion Bybit hack. Binance hasn't named anyone. Withdrawals stay paused for now.

What happened

Starting at 20:05 UTC on Oct. 29 (2:05 p.m. Mountain), Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and five other networks sent their balances to addresses controlled by one attacker, according to TRM Labs. Most of the money moved in about 20 minutes. TRM's tally: roughly $3.79 billion on Ethereum, 18,270 BTC (about $1.47 billion) and about $628 million on Tron, plus smaller amounts elsewhere. That's about four times the Bybit theft of February 2025, the previous record.

Binance first said it was "actively investigating" a potential issue, then paused withdrawals. By Friday its estimate of the damage was around $6.3 billion. Co-CEO Richard Teng said the incident "may have started with a compromised DevOps engineer's laptop," which gave the attacker access to a service container where it submitted unauthorized withdrawals, the BBC reports. "This was not a single 'one-click' action," Teng said, according to BleepingComputer. Binance later said it had found "additional points of breach."

TRM's on-chain analysis suggests the attacker could make Binance's hot-wallet signing system approve transactions on ten different chains within about half an hour. On Ethereum, it used 50 signatures prepared in advance to hand control of a major Binance hot wallet to a sweeper contract, then kept draining new deposits for hours.

Why it matters

Binance is the world's largest crypto exchange, and this hit its global platform, Binance.com. Binance.US says it was not affected, per the BBC. Binance says user funds are safe and that losses will be covered from its SAFU emergency fund and company money.

The freeze race also shows how much of crypto's safety net now sits with a few stablecoin issuers. Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and Arbitrum's Security Council seized about $30 million more, TRM says. But the attacker swapped stablecoins for ether fast, at a steep discount, and still controls roughly $2.4 billion in ETH and bitcoin that no issuer can freeze.

If the North Korea attribution holds, it would be the regime's biggest heist yet. TRM says it has "high confidence" that TraderTraitor did it, and BleepingComputer reports Chainalysis agrees. North Korea has always denied involvement in these attacks.

What's next

Binance says it expects to resume withdrawals within about two days, after a security revamp of its withdrawal service, and has promised a full post-mortem and an updated proof of reserves. Watch where the stolen ETH and bitcoin go: TRM expects bridges, swap services and over-the-counter brokers next. If you use Binance, expect phishing. Security experts quoted by the BBC warn of fake "your funds are at risk" emails and bogus support accounts, so check for updates only in the Binance app or at an address you already trust.

Sources: TRM Labs, BBC, BleepingComputer and TechCrunch.