Binance pauses withdrawals after a theft it puts at $6.3 billion, the largest crypto hack on record

Binance, the largest cryptocurrency exchange by volume, said late on Oct. 29 that attackers had drained its hot wallets across at least ten blockchains in an incident it estimates at about $6.3 billion. The exchange paused withdrawals at roughly 22:15 UTC, briefly paused deposits as well, and said it expects to restore withdrawals within 45 to 48 hours once it finishes rebuilding its withdrawal service and the addresses behind it. Blockchain analytics firms TRM Labs and Elliptic both describe it as the largest cryptocurrency theft on record.

Binance says it will cover every customer loss. In an update on the morning of Oct. 30 it said it had set aside more than $6.34 billion in company funds for that purpose, about $5 billion of it already held in the same tokens that were stolen, with the rest being bought on the open market and through over-the-counter desks. Co-CEO Yi He said the exchange was buying altcoins in quantities matching what was taken ahead of an updated proof of reserves. Founder Changpeng Zhao said that as a shareholder he expects user funds to be covered in full.

What Binance has said about the cause

Binance's explanation has developed over the day, and the times matter. At 02:25 UTC on Oct. 30 it said its initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which may have let an attacker reach a service container and submit unauthorized withdrawal transactions. It said it had found no evidence that wallet private keys were leaked. At 07:37 UTC co-CEO Richard Teng wrote that the attack involved a more complex process than a single click and that the investigation had not attributed responsibility to any individual.

At 08:37 UTC Binance said investigators had found additional points of breach and were still establishing the full attack path with law enforcement. It has promised a post-mortem once the facts are verified. The exchange also said it submits weekly fund reports to Abu Dhabi's Financial Services Regulatory Authority under a requirement that predates the hack.

How the funds moved, according to the trackers

TRM Labs and Elliptic have each published on-chain reconstructions, and they largely agree. Both put the start at about 20:05 UTC on Oct. 29, when five Binance wallets on the XRP Ledger sent 233 million XRP to a single attacker address. Within about 20 minutes, hot wallets on Solana, Bitcoin, Tron, Ethereum, Arbitrum, Optimism, Base and Avalanche had been emptied as well. A second wave hit Avalanche and Polygon wallets around 23:00 UTC, and sweeps on Ethereum continued until just before midnight. TRM counts ten chains; Elliptic counts eleven, adding NEAR.

The Ethereum leg is the most unusual. According to TRM, a single transaction at 20:20 UTC carried 50 authorizations signed by a Binance hot wallet under EIP-7702, a 2025 Ethereum change that lets an ordinary wallet hand control to a smart contract. The 50 signatures covered 50 consecutive transaction counts so that one would be valid at execution. One was. About three and a half minutes later the wallet's full balance, 167,464 ETH and 63 tokens including 1.6 billion USDT, went to the attacker. Because the delegation stayed in place, the attacker swept new deposits into the same wallet at least six more times over the next three and a half hours.

On the other chains the funds left through ordinary signed transfers rather than any delegation trick. TRM's conclusion is that this points to a compromise of Binance's hot wallet signing infrastructure rather than its cryptography, a pattern Elliptic compares to the Bybit theft of about $1.5 billion in February 2025. Elliptic also found preparation the day before: small Tornado Cash withdrawals funding an operator wallet on Oct. 28, and the attack code rehearsed on other wallets about four hours before it ran.

The headline figures differ because the firms value the assets at different moments. Binance's own estimate is about $6.3 billion. TRM counts $6.36 billion at the price of each asset when it was taken, or about $6.23 billion at current prices. Elliptic counts $6.43 billion, excluding $169 million that left Binance after withdrawals were paused and that it believes was Binance moving its own money. Chainalysis has put the figure at roughly $5.9 billion at the time of theft, according to CoinDesk. By Elliptic's count, stablecoins made up $3.46 billion of the total, and USDT on Ethereum, Bitcoin, USDC and USDT on Tron together accounted for 74% of it.

The freeze response

The most useful operational detail in the trackers' reports is how fast issuers moved. Elliptic says Tether froze the main attacker wallet 37 minutes after the USDT arrived, locking 1.18 billion USDT, then froze four more addresses within 17 minutes. Circle froze 823 million USDC in the same wallet three minutes after Tether acted. Tether CEO Paolo Ardoino later put his company's total above $1.567 billion, and Circle CEO Jeremy Allaire said his firm had frozen more than $800 million in coordination with law enforcement.

Ripple froze RLUSD, World Liberty Financial froze USD1, Paxos and First Digital froze their stablecoins, Tether froze tokenized gold, and the Arbitrum Security Council moved about $30 million in ETH and ARB out of the attacker's reach. Aave froze the affected lending markets, which blocked new activity but seized nothing. Binance puts the verified frozen total at about $3 billion; Elliptic verifies $2.84 billion, or 44% of the theft, and says stablecoins were 94% of what was frozen.

The attacker converted some stablecoins before the freezes landed. TRM saw about 325 million USDT sold through intent-based swap contracts for roughly 122,300 ETH at about 10% below market, 300 million USDT parked in a Tron lending protocol, and about 48 million RLUSD sold before Ripple froze the rest. Elliptic estimates about $786 million of stablecoins became ETH and TRX, with implied losses of 12% to 26% on some swaps, which it reads as the attacker trading price for speed. Roughly $3.3 billion, including about 18,270 BTC split across 19 addresses, remains outside any issuer's reach.

Who did it, and who says so

Three blockchain analytics firms have pointed at North Korea. TRM Labs attributes the attack with high confidence to TraderTraitor, the unit the FBI named for the Bybit theft, citing shared patterns with Bybit and the April 2026 KelpDAO exploit: small Tornado Cash withdrawals, staging well before the theft, and pre-obtained signatures executed in one burst. Chainalysis CEO Jonathan Levin said TraderTraitor likely carried it out. Elliptic says North Korean actors are likely responsible, citing funds from Binance and the September 2026 Bitget exploit reaching the same Ethereum address, but it lists caveats: the overlap is small, the laundering has been slower than usual for the group, and Binance has not published a root cause.

Binance itself has not attributed the attack, and no government or law enforcement agency has confirmed attribution. Elliptic notes that the group is believed to have stolen more than $6.5 billion in recent years, so this incident alone would nearly double that total.

Markets and counterparties

CoinDesk reported on Thursday evening that bitcoin fell 4.8% to below $77,000, ether 5.7%, BNB 8% and AAVE 11%. By Friday morning, Yahoo Finance had bitcoin at $78,106 after a low of $76,518, ether down 3.7% at $2,232, and Coinbase, Robinhood and Strategy each down about 5% in premarket trading. Glassnode's breakdown of the stolen assets, cited by Yahoo Finance, said Binance's BNB holdings were untouched.

Market makers disclosed their exposure quickly. Wintermute's Evgeny Gaevoy said the firm's Binance exposure was under 20% of net equity, and GSR's Xin Song put its exposure under 5%; neither expected major disruption, according to Cointelegraph. Standard Chartered's Geoffrey Kendrick said the hack could accelerate the shift to decentralized exchanges. Blockaid CEO Ido Ben-Natan told CoinDesk the tactics were consistent with North Korean operations and suggested signing-infrastructure compromise rather than key theft.

What to watch

The first checkpoint is withdrawals. Counting from Binance's 08:37 UTC update, its 45-hour estimate runs to roughly Nov. 1 UTC. The second is the promised post-mortem and the updated proof of reserves, which will show whether the $6.34 billion set aside fully replaces what was taken, token by token. The third is the roughly $3.3 billion still moving: TRM expects it to head for bridges, swap services and OTC brokers, and the Beacon Network it runs with partners is tracking it. The last is formal attribution, which so far rests on private analytics firms rather than any government.

For anyone running custody or treasury operations, two details from the trackers stand out. The attack did not break any cryptography; it got Binance's own signing infrastructure to sign for the attacker, and the Ethereum delegation kept working until it was revoked. And the money that was saved was saved by issuers who could freeze within minutes, which is an argument for knowing, before an incident, who can freeze what and how to reach them.