Binance Hack: $6.3bn Hit in Largest Crypto Theft

Key takeaways

Binance says an estimated $6.3 billion was impacted in a security incident on 29 October, with about $3 billion frozen so far. Deposits and withdrawals remain suspended while security checks continue. The exchange says it will cover all losses, but the cause is still only an initial finding and the final stolen total is not yet settled.

Flat illustration of a locked digital vault with gold coins and a broken chain on a dark navy background — Illustration: WHAT TODAY?

Crypto exchange Binance has said an estimated $6.3 billion was impacted in a security incident on Thursday, 29 October, in what outlets are describing as the largest crypto theft on record. About $3 billion has been frozen on-chain so far, Binance said in a formal update published early on Friday, leaving about $3.3 billion not yet located on those figures.

The company said it will cover all losses from its emergency insurance fund, known as SAFU, and from company funds, and that it will publish an updated Proof of Reserves once remediation is complete. In its update, Binance said, in short: "User funds are safe."

What Binance says happened

Binance’s initial investigation points to a compromised laptop belonging to a DevOps engineer. According to the company, that compromise may have allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions.

That explanation is important for what it does not yet claim. Binance presents it as an initial finding, not a final confirmed cause, and says it has found no evidence of a leak of wallet private keys. The distinction matters: if no private keys were exposed, the breach would be about access to a withdrawal system rather than direct control of the exchange’s wallets, but investigators have not yet closed that question.

As a precaution, Binance has temporarily suspended deposits and withdrawals while it completes security checks, revoked the authorisation of the affected address, and said it is working with law enforcement and blockchain intelligence partners. Co-chief executive Yi He said withdrawals would stay disabled until the environment was confirmed to be secure. No resumption time has been given.

The incident concerns Binance.com, according to BBC reporting. Binance.US has said its platform is not affected.

Why the $6.3 billion figure needs care

Readers will see several different numbers for this incident, and they are not interchangeable. Binance’s $6.3 billion is an estimated total impact. Separately, blockchain analytics firm Chainalysis is reported to have confirmed at least $5.912 billion stolen as of 8:30 p.m. Eastern Time on 29 October, while data cited from Arkham put more than $5.7 billion in the attacker’s wallets at one point.

Those figures measure different things at different times — an exchange’s estimated impact, an analytics firm’s confirmed stolen total, and a snapshot of wallet balances — so they should not be added together or treated as competing claims that one side must be wrong about. The one point on which Binance, the BBC, CoinDesk and Reuters agree is the headline estimate: about $6.3 billion impacted, with about $3 billion frozen.

The frozen total itself also needs unpacking. Stablecoin issuers account for a large part of it: Tether froze more than $1.57 billion in USDT and Circle froze more than $800 million in USDC, according to CoinDesk, a combined sum of roughly $2.3–2.4 billion depending on rounding. Those freezes are components of the roughly $3 billion frozen total, not extra amounts on top of it.

Who is blamed — and who is not blaming them

Attribution is, for now, an assessment by outside researchers rather than a statement by Binance. Researchers at TRM Labs and Chainalysis have linked the incident to TraderTraitor, a cluster associated with North Korea’s Lazarus Group, according to BBC, CoinDesk and Reuters reporting.

That attribution, if it holds, would fit a pattern. The previous record was the roughly $1.5 billion hack of the Bybit exchange in 2025, which was linked to North Korea. The Binance incident, at more than four times that amount on Binance’s estimate, would dwarf it — which is why it is being described as the largest hack in crypto history.

But attribution in crypto thefts is rarely settled in the first 24 hours. Blockchain analysis can trace where funds move, but tying a wallet cluster to a state actor with certainty takes longer, and Binance itself has not made that attribution. Readers should treat the North Korea link as a researcher assessment that is being reported, not as an established fact.

Why it matters

The scale is the story, but the structure of the incident is the warning. Crypto exchanges hold customer assets in large, centralised systems, and a single compromised employee device is, on Binance’s initial account, what may have opened the door to withdrawals worth billions. That is a very different failure from a flaw in a blockchain itself, and it puts the focus on internal access controls: who can authorise withdrawals, how those permissions are checked, and how quickly abnormal outflows are stopped.

It is also a test of the industry’s own safety nets. Freezing funds on-chain worked, in part, because much of the stolen value was in stablecoins whose issuers can freeze tokens at specific addresses. That mechanism does not exist for every asset, and it depends on issuers acting quickly. Binance’s promise to cover losses from SAFU and company funds will likewise be judged not on the announcement but on whether affected users are made whole, and on what the updated Proof of Reserves shows about the exchange’s holdings after remediation.

For regulators, the incident arrives at a moment when crypto is already under close scrutiny over custody, security and consumer protection. A theft of this size at one of the world’s largest exchanges is likely to sharpen questions about whether exchanges should face bank-like security and auditing standards, and about how much protection users really have when an exchange, rather than a blockchain, fails.

What’s next

Three things will show how serious and how contained this incident is. First, whether withdrawals resume, and on what timetable — Binance has given no date, only that security checks must be completed first. Second, whether the frozen share grows beyond about $3 billion as law enforcement and blockchain firms trace the remaining funds, or whether the rest proves harder to recover. Third, what the final investigation concludes about the cause, and whether the researcher attribution to a North Korea-linked group is confirmed or revised.

Until then, the honest summary is narrow: an estimated $6.3 billion was impacted, about half has been frozen, users have been told their funds are safe and losses will be covered, and deposits and withdrawals remain suspended. Everything beyond that — the final total, the final cause, and who was behind it — is still being established.

Frequently asked questions

How much was taken in the Binance hack?
Binance estimates a total impact of about $6.3 billion, with about $3 billion frozen on-chain so far. Analytics firm Chainalysis separately confirmed at least $5.912 billion stolen as of 29 October evening. The figures differ because they measure different things, so the final stolen total is not yet settled.

Are Binance users’ funds safe?
Binance says user funds are safe and that it will cover all losses from its SAFU emergency fund and company funds. It has also promised an updated Proof of Reserves after remediation. That promise will be tested by whether users are made whole and what the reserves update shows.

Can I withdraw from Binance now?
No, not while the suspension lasts. Binance has temporarily suspended deposits and withdrawals while security checks are completed, and has given no resumption time. Trading itself was not stated to be paused in the reports read; only deposits and withdrawals were stated as suspended.

Was this the biggest crypto hack ever?
On Binance’s estimate, yes. At about $6.3 billion in estimated impact, it eclipses the roughly $1.5 billion Bybit hack of 2025, previously the largest on record. Researchers have linked both incidents to North Korea-linked actors, but the Binance attribution remains an outside assessment, not a Binance statement.