/
Binance reports record $6.3 billion breach; nearly $3 billion frozen, withdrawals paused, bitcoin down 4%
Binance said a security incident affected about $6.3 billion of assets, the largest crypto theft on record, with nearly $3 billion frozen. It blames a compromised engineer's laptop, paused withdrawals and pledged to cover all losses. Bitcoin fell over 4%. Binance.US was not affected.
P
4 min
Binance, the world's largest cryptocurrency exchange, said on Thursday, 29 October, that a security incident affected about 6.3 billion dollars in assets, which would make it the largest crypto theft on record. The exchange said that nearly 3 billion dollars of the affected assets had been frozen on-chain, that it would cover all losses, and that it had paused deposits and withdrawals while it carries out security checks. Bitcoin fell more than 4 per cent as the news spread. The figures differ between reports and Binance has warned that the totals could change.
What Binance says happened
Binance's first assessment is that a compromised laptop belonging to one of its DevOps engineers allowed an attacker to reach a service container and submit unauthorised withdrawal transactions. It said that it had found no evidence that the private key of a wallet had leaked. It has not published a root cause. Binance said that it revoked the authorisation of the affected address, brought in law enforcement and blockchain intelligence partners to trace and recover funds, and expects withdrawals to resume within about 48 hours after what it calls a security revamp of the withdrawal service and related addresses.
How big it is
Chainalysis, the blockchain analysis firm, estimated that about 5.9 billion dollars was taken at the time of the theft, nearly four times the next-largest crypto theft, which was the roughly 1.5 billion dollars taken from the exchange Bybit in February 2025. The 6.3 billion dollar figure is Binance's estimate of the assets affected.
| Item | Figure |
|---|---|
| Assets affected (Binance) | about 6.3 billion dollars |
| Stolen at the time (Chainalysis) | about 5.9 billion dollars |
| Frozen on-chain (Binance, loosely) | nearly 3 billion dollars |
| Frozen, Binance's verified total | 2.54 billion dollars |
| Frozen by Tether | more than 1.567 billion dollars |
| Frozen by Circle | 800 million dollars |
| Previous record (Bybit, 2025) | about 1.5 billion dollars |
Tether, Circle, Ripple and World Liberty Financial together froze about 2.67 billion dollars of stablecoins, and the security council of the Arbitrum network froze about 30.5 million dollars. Binance.US, the exchange's separate American business, said it was not affected.
Blockchain analysis firm TRM Labs has set out a timeline. Preparation began at least 36 hours before the theft. At 20:20 UTC, the operator submitted one transaction containing 50 pre-signed authorisations from Binance's hot wallet, pointing to a contract that sweeps funds. About three minutes and 24 seconds later, the operator instructed the hot wallet to send its entire balance to an address controlled by the attacker, which moved 167,464 ether and 63 tokens, including 1.615 billion tethers. TRM attributes the attack, with high confidence, to North Korea's hacking group known as TraderTraitor, citing similarities to the Bybit theft and to an April 2026 attack on KelpDAO. It says that the laundering so far has relied on large swaps through market makers and lending protocols, unlike the heavy use of bridges after the Bybit theft. Binance has not itself named a culprit.
Binance said it will cover all losses from its emergency fund, called SAFU, and from its own funds. One analyst estimated the fund at about 1.2 billion dollars, which could cover roughly a third of the remaining losses if the frozen stablecoins are eventually returned. The reports do not describe the effect on individual customers beyond the pledge to cover losses. Users with money on the exchange should watch Binance's official announcements for the reopening of withdrawals, and should be careful of phishing messages that claim to offer refunds.
Bitcoin fell more than 4 per cent on Friday as the news weighed on the market. A large share of the frozen amount is in stablecoins, which the issuers can freeze, while assets such as bitcoin and ether cannot be frozen in the same way, which is why the issuers' action matters to the recovery.
The next steps are the reopening of withdrawals, a published explanation of the root cause, the tracing of the funds that are not frozen, and the response of regulators. In India, where crypto assets are taxed and widely traded on exchanges, the incident may draw attention to how such platforms are supervised.
P
4 min
What did you think?
