The world’s largest cryptocurrency exchange has pledged to replace the stolen assets after hackers exploited its wallet infrastructure, raising fresh questions about crypto security, customer protection and the risks of leaving digital assets on exchanges.
Hackers stole approximately $6.3 billion in cryptocurrency from Binance on October 29, with most of the funds transferred in about 20 minutes across 10 blockchains, according to blockchain intelligence firm TRM Labs.
Binance says it will cover the losses through its Secure Asset Fund for Users (SAFU) and company funds, setting aside more than $6.34 billion. The exchange is also working with blockchain partners to freeze the stolen assets, with approximately $3 billion frozen so far.
The breach raises a difficult question for crypto investors: How safe is money held on an exchange, even when that exchange is one of the world’s largest?
How the $6.3 Billion Binance Crypto Heist Unfolded
The theft did not require hackers to crack the cryptography protecting Bitcoin or steal Binance’s wallet private keys. Investigators say the attackers appear to have compromised the systems that authorize transactions, giving them a way to move billions of dollars out of the world’s largest cryptocurrency exchange.
Most of the money was transferred in roughly 20 minutes across multiple blockchains. The subsequent effort to trace and freeze the assets has exposed another weakness in crypto security: once stolen funds are converted into assets that have no central issuer, stopping them becomes much harder.
Key Highlights
- Hackers stole an estimated $6.3 billion from Binance hot wallets on October 29, in what appears to be the largest crypto theft on record.
- Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop, but the exchange later identified additional breach points.
- Blockchain investigators say the attackers exploited transaction-signing infrastructure rather than simply stealing private keys.
- Around $3 billion in assets has been frozen, while investigators estimate that billions more in Bitcoin and Ether may be difficult to recover.
- Binance says it will cover customer losses and has set aside more than $6.34 billion in company funds.
What happened?
On October 29, attackers drained approximately $6.3 billion in cryptocurrency from Binance-controlled wallets. Blockchain analytics firm TRM Labs put the total at about $6.36 billion, with transfers spanning 10 blockchains.
The bulk of the theft took place in a window of roughly 20 minutes. The speed and scale of the transfers made the incident one of the largest known cryptocurrency thefts, surpassing the $1.5 billion Bybit hack in February 2025.
Binance initially said its investigation had identified a possible compromise involving a DevOps engineer’s laptop. The exchange later said investigators had found additional points of breach, indicating that the incident was more complex than a single compromised device.
The exchange said it found no evidence that wallet private keys had been leaked.
How did the attackers get in?
The distinction between stealing a private key and compromising the system that uses it is central to understanding the breach.
Crypto exchanges commonly keep some assets in hot wallets, which are connected to the internet and used to process withdrawals. These wallets rely on security systems and authorization procedures to ensure that transactions are legitimate.
Binance’s preliminary account points to an attacker gaining access through a compromised employee laptop and then reaching a service container used to submit withdrawal transactions. Investigators believe the attackers were able to manipulate the infrastructure responsible for authorizing transfers.
Analysis by TRM Labs and Elliptic suggests that, on Ethereum, the attackers used EIP-7702, a feature that allows a standard wallet to temporarily delegate certain functions to smart-contract code. The attackers appear to have used this mechanism to give a malicious contract control over a Binance wallet and sweep out its assets.
EIP-7702 does not explain the transfers across other blockchains. Investigators say those transactions appear to have been authorized through Binance-controlled wallets, pointing to a broader compromise of the exchange’s signing infrastructure.
In other words, the attackers may not have needed to break the wallets themselves. They appear to have exploited the internal systems and wallet-signing mechanisms used to authorize transactions, allowing them to move billions of dollars.
Who is behind the attack?
Blockchain investigators have pointed to North Korea, although the attribution has not been confirmed by Binance or law enforcement.
TRM Labs attributed the theft with high confidence to TraderTraitor, a North Korean hacking group previously linked to major cryptocurrency thefts. The firm cited similarities in the attackers’ preparation, use of pre-signed authorizations and movement of stolen funds.
Elliptic reached a similar assessment, pointing to links between some of the stolen assets and funds associated with a separate suspected North Korean-linked attack on crypto exchange Bitget. It cautioned, however, that the overlap does not conclusively establish that the same group carried out both attacks.
The suspected North Korean connection is significant because the FBI attributed the $1.5 billion Bybit hack in 2025 to TraderTraitor. But the Binance investigation remains ongoing, and the exchange has not publicly identified the perpetrators. TRM Labs+2
Where did the stolen cryptocurrency go?
The attackers began moving the stolen assets almost immediately, but the different types of cryptocurrency have made recovery uneven.
Stablecoins such as Tether’s USDT and Circle’s USDC have centralized issuers that can freeze tokens held at specific blockchain addresses. That gave investigators and crypto companies a way to stop some of the stolen funds from moving.
Tether, Circle, Ripple and other companies froze assets linked to the attack. Binance said approximately $3 billion had been frozen with help from industry partners. Elliptic independently verified about $2.84 billion in frozen funds in its October 30 analysis. Reuters+2
The remaining funds are harder to contain. Bitcoin and Ether do not have centralized issuers that can freeze individual wallets. Once the attackers converted assets into these cryptocurrencies, investigators could track the transactions on public blockchains but could not simply stop the transfers.
TRM estimated that roughly $2.4 billion in Bitcoin and Ether was beyond the reach of token issuers. Elliptic’s later analysis put the value of assets it considered non-freezable at around $3.23 billion, illustrating how estimates can change as investigators trace additional transfers and market prices move. TRM Labs+2
The attackers have also tried to make the funds harder to follow. Investigators have tracked rapid swaps between cryptocurrencies, transfers across blockchain networks and the use of decentralized finance platforms. Elliptic reported that one attacker-controlled wallet deposited $59.9 million in stolen USDT as collateral on Aave to borrow Ether.
These transactions do not make the funds untraceable, but they complicate efforts to freeze them or identify where they will eventually be cashed out.
Will Binance customers lose their money?
Binance has pledged to cover all losses from its Secure Asset Fund for Users (SAFU) and company funds.
On October 30, the exchange said it had set aside more than $6.34 billion to address the incident. That included approximately $5 billion in affected cryptocurrencies already held by the company, with the remaining amount being acquired through market and over-the-counter purchases.
The commitment is intended to ensure customers do not bear the direct cost of the theft, even if the stolen assets cannot be recovered. Binance also said it would publish an updated Proof of Reserves report after completing remediation work.
The exchange temporarily suspended withdrawals on multiple networks while it investigated the breach and carried out security checks. It also said deposits were not affected and that user funds remained safe.
There is an important distinction between Binance replacing the stolen assets and investigators recovering them. The exchange’s financial commitment addresses the customer shortfall; frozen funds still need to go through the relevant recovery and legal processes before they can be returned.
What happens to your Crypto when an Exchange gets Hacked?
A major exchange hack does not automatically mean customers lose their cryptocurrency permanently. What happens next depends on whether the stolen assets can be frozen, whether the exchange has sufficient reserves to cover the losses, and whether it is willing and able to reimburse customers.
Binance has pledged to cover the losses from its own funds, but not every exchange has the resources to make the same commitment.
The collapse of FTX in 2022 showed how badly customers can be exposed when an exchange misuses their assets. Despite contractual language stating that customer assets belonged to users, FTX had misappropriated billions of dollars.
The 2019 hack of New Zealand-based Cryptopia offers another example. The exchange entered liquidation after losing approximately NZ$30 million in cryptocurrency. Customer distributions did not begin until 2024, years after the breach.
As Martin Mulyadi, YHB Endowed Chair in Accounting and professor of accounting at Shenandoah University, explains to CNBC: “When you leave crypto on an exchange, you are relying on that company’s controls and its balance sheet. A pledge to make customers whole is only as strong as the resources behind it.”
The distinction is important: recovering stolen cryptocurrency and reimbursing customers are two different processes. An exchange may replace customer funds even if investigators never recover the stolen assets.
What happens next?
Binance has said it will publish a technical post-mortem once its investigation is complete. That report should help clarify how the attackers gained access to the transaction-signing systems, how long they had access and why existing controls did not stop the transfers.
The exchange also plans to update its Proof of Reserves. The report can provide information about assets held against customer balances, but it is not a full financial audit and cannot, on its own, establish the exchange’s overall financial health.
For investigators, the immediate challenge is tracking the assets that have not been frozen and identifying opportunities to stop them when they reach exchanges, brokers or other services. The public blockchain record provides a trail, but following that trail does not guarantee recovery.
The Binance breach also highlights a wider security issue for crypto exchanges. Protecting private keys is not enough if attackers can compromise the people, software and internal systems that authorize transactions. In this case, investigators believe the attackers found a way to use Binance’s own infrastructure to move billions of dollars.
That makes the incident more than a record-breaking theft. It is a reminder that the security of a crypto exchange depends on every layer between its wallets and the systems that control them.
