Pomegra
Binance says hackers stole about $6.3 billion in the largest crypto heist on record; $3 billion is frozen, North Korea's TraderTraitor is blamed, and users will be made whole.
- Hackers moved about $6.3 billion out of Binance wallets across 10 blockchains, most of it within roughly 20 minutes on October 29.
- Around $3 billion has been frozen, and Binance has set aside $6.34 billion of its own funds to restore user balances one-for-one.
- Blockchain intelligence firms link the attack to North Korea's TraderTraitor group, which was also tied to the $1.5 billion Bybit theft in 2025.
Lead
Binance, the world's largest cryptocurrency exchange, said on October 29 that a security breach drained about $6.3 billion in client assets. It is the biggest crypto theft on record, well above the $1.5 billion taken from Bybit in February 2025. The exchange paused withdrawals while it investigated. It says roughly $3 billion of the stolen assets have been frozen with help from industry partners, and that it will cover all user losses.What Happened in the Binance Hack?
Attackers moved approximately $6.36 billion out of Binance-controlled wallets across ten blockchains, most of it in about 20 minutes. The exchange's investigation points to a compromised laptop belonging to a DevOps engineer. That access was used to reach an internal service container and submit unauthorized withdrawal transactions. Further investigation identified additional points of breach.
Binance says it has found no evidence that wallet private keys leaked. On Ethereum, the attacker is reported to have used the EIP-7702 account-delegation feature, with 50 pre-signed authorizations, to hand control of wallet operations to malicious smart contract code.
Who Is Behind the Attack?
Blockchain intelligence firms TRM Labs and Chainalysis have attributed the theft with high confidence to TraderTraitor, a North Korean state-linked unit associated with the broader Lazarus Group. The same group was tied by the FBI to the Bybit heist. The speed and sophistication of the operation matched that earlier case.
North Korea has become one of the most prolific thieves in digital assets. Proceeds from such attacks are widely seen as a source of hard currency for Pyongyang, which is under international sanctions. That gives the incident a security dimension beyond the exchange itself.
How Much of the Stolen Money Has Been Frozen?
About $3 billion has been frozen, roughly half of the total. Stablecoin issuers Tether and Circle Internet Group (CRCL) froze affected tokens, with Circle putting its USDC freeze above $800 million. Ripple and World Liberty Financial also froze assets, and Arbitrum's Security Council intervened on its network.
The frozen share is unusually large for a crypto theft. It reflects how much of the loot sat in centrally issued stablecoins, which can be blocked, rather than in assets that move beyond reach. The remaining roughly $3.3 billion is the part investigators now have to trace as it is laundered through mixers, bridges and over-the-counter brokers.
Will Binance Cover User Losses?
Yes. Binance says it will use corporate funds, alongside its Secure Asset Fund for Users (SAFU), to restore affected balances one-for-one. It has arranged $6.34 billion for the purpose. Roughly $5 billion is already held as exact token matches for affected users, and the rest is being bought on public markets and through over-the-counter deals.
The SAFU fund typically holds around $1 billion, so the payout depends mostly on Binance's own balance sheet. Binance has said withdrawals should resume within about 45 to 48 hours after security checks. It has also promised an updated proof of reserves once remediation is complete.
Market Reaction
Crypto prices fell sharply. Bitcoin dropped more than 3% to about $76,400 in early trading and was down roughly 4.7% by Friday morning in New York. Ethereum fell about 5.4%, Solana about 7% and XRP about 3.5%. Binance's BNB token lost around 5%. Shares of Coinbase (COIN) and Strategy (MSTR) also declined in extended trading.
The buying Binance needs to make users whole adds a further variable. Purchases of roughly $1.3 billion in remaining tokens on open markets and over-the-counter could add demand just as sentiment weakens.
What Comes Next for the Exchange and the Industry?
Three issues will shape the next several weeks. The first is whether withdrawals resume on schedule and without a rush of outflows. The second is how much more of the stolen money law enforcement and stablecoin issuers can freeze. The third is regulatory: a breach of this size at the largest exchange is likely to draw scrutiny of custody controls, internal access management and the concentration of assets on a single platform.
Outlook
Binance has moved quickly to contain the damage with freezes and a full reimbursement pledge, and user balances are expected to be restored. The open questions are how much of the remaining $3.3 billion can be recovered and whether confidence in centralized exchange custody holds. The attack underlines that the largest losses in crypto now come from compromised operational systems, not broken code.
Mentioned tickers: COIN, MSTR, CRCL
