Billions of dollars left Binance wallets on October 29. By the following day, the exchange was describing a complex intrusion with multiple entry points—and customers were still waiting for withdrawals to resume.
The Binance hack caused an estimated $6.3 billion in losses, according to the exchange’s October 30 security update. Blockchain investigator TRM Labs calculated $6.36 billion across ten blockchains, calling it the largest crypto theft on record: roughly four times the $1.5 billion Bybit hack in February 2025. Most of the money moved in about 20 minutes; further transfers followed.
The Binance hack was bigger than one laptop
Binance’s preliminary account traced the intrusion to a compromised DevOps engineer’s laptop, followed by access to a service container and unauthorized withdrawal transactions. Its subsequent update identified additional points of entry. The company cautioned against treating the breach as a single employee’s mistake or assuming one engineer could move funds with one click.
The exchange says it has found no evidence of leaked wallet private keys. That does not settle how the transactions were authorized. TRM’s assessment points to compromised hot-wallet signing infrastructure: attackers may have gained the ability to make Binance’s systems sign transfers they wanted.
That distinction matters. Stealing a secret key and abusing the machinery authorized to use it are different routes to the same dangerous outcome: a transaction that the blockchain accepts. A final technical account is still pending.
TRM attributes the attack to North Korea’s TraderTraitor group with high confidence. Elliptic’s analysis also identifies North Korea as the likely culprit. Those are investigators’ assessments, rather than a completed public attribution by Binance.
Frozen billions are not recovered billions
Binance says approximately $3 billion has been frozen. Elliptic independently verified $2.84 billion frozen in its October 30 snapshot. These are evolving measurements; neither figure means the assets have already been returned.
Elliptic explains why the response is a race: some token issuers can freeze stolen assets, while Bitcoin and Ether have no equivalent central issuer. Moving between assets can therefore change what responders can immobilize.
Binance has promised to cover losses using its SAFU emergency fund and company resources. That commitment is not independent confirmation that reimbursement or reconciliation is complete. Its corrected announcement says deposits are operating normally, while withdrawals remain suspended in the updates reviewed for this report.
The unresolved question is how many controls the intruders crossed before the money moved. Freezing assets limits their options afterward. Explaining how Binance’s own systems authorized the transfers is what will determine whether the same route can be closed.
