Seven days ago, on the evening of 29 October, an attacker drained about $6.3 billion from $Binance hot wallets across ten blockchains. It is the largest theft in crypto history, roughly four
Seven days ago, on the evening of 29 October, an attacker drained about $6.3 billion from $Binance hot wallets across ten blockchains. It is the largest theft in crypto history, roughly four times the Bybit hack of 2025. Binance survived the week, withdrawals are open again and the market has stopped falling. But the bill is only now becoming visible. Here is the full picture.
According to TRM Labs, the theft started at 20:05 UTC on 29 October and a second wave followed three hours later. The attacker compromised the signing infrastructure behind Binance's hot wallets, not individual customer accounts. Binance halted withdrawals the same night and reopened them in phases a few days later, starting with Bitcoin.
The way in is the part that should worry every exchange: the attackers used fake job interviews to get malware onto employee devices and breached an internal AI tool along the way. No smart contract was exploited. Humans were.
The FBI attributed the attack on 31 October to TraderTraitor, the North Korean state unit that also drained $1.5 billion from Bybit last year. TRM Labs and Chainalysis reached the same conclusion, and Elliptic says its tracing of the funds through thousands of wallets supports it.
North Korea disagrees. Kim Yo Jong, the sister of Kim Jong Un, called the accusation "absurd rhetoric" and "a trite provocation" in a statement carried by state media on 3 November. President Trump initially said investigators were not yet certain. Between $2.7 billion and $3 billion of the stolen assets have been frozen so far, with Arbitrum among the networks that locked down funds.
CEO Richard Teng promised on 30 October that Binance would cover every dollar and that customer funds were never touched. The money is coming from three pots: the SAFU emergency fund, part of the futures insurance fund and the corporate treasury. Binance said on 31 October that about 90 percent of affected assets were already covered, and co-founder Yi He confirmed the exchange is buying back the stolen altcoins on the open market.
That is where the real cost shows up. On-chain data indicates Binance has already spent about half of the Bitcoin held in SAFU, roughly $580 million worth, to plug the hole. Add the altcoin buybacks and the fines of recent years, and one analysis puts the damage at close to half of the profits Binance made in the last five years.
Yes, in size. More than $4.6 billion left the platform once withdrawals reopened, and Binance has visibly lost market share to rival exchanges over the week. Some of that money will come back; some went straight into hardware wallets.
Binance also warned of a second wave of theft attempts, and the warning is already playing out elsewhere: Brazil's Mercado Bitcoin and BitMart both confirmed hacks this week and suspect the same group. The attackers have a playbook now, and they are reusing it.
The honest answer: the exchange is solvent, deposits are covered and withdrawals work. The attack targeted Binance's own infrastructure, so if you kept coins there, they were never individually at risk. The lesson is not "Binance is finished". The lesson is that the biggest exchange in the world can lose $6 billion overnight to a phishing email, and every other exchange runs on the same kind of infrastructure.
If this week pushed you toward self-custody, the CryptoTicker shop lists hardware wallets alongside books, accessories and everything else crypto. And for the market reaction, Bitcoin, BNB and the rest are on our crypto prices page.
