A day after billions of dollars left its hot wallets, Binance has given its first full account of the attack. The world’s largest crypto exchange now puts the loss at about $6.3 billion, the biggest crypto theft on record, and says it has set aside more than $6.34 billion of its own money so that no customer loses anything. Two blockchain investigation firms say North Korean hackers were behind it.
Key facts
- Size: Binance puts the loss at about $6.3 billion. The investigation firms TRM Labs and Chainalysis estimate between $6.36 billion and $6.4 billion. Most of it left within about 20 minutes on Thursday, October 29, across several blockchains.
- Cover: Binance has reserved more than $6.34 billion of company funds. About $5 billion of that is already held in the same tokens that were stolen; the rest is being bought on the market and from large over-the-counter sellers, which Binance warns may take some time.
- Customers: Binance says balances will be restored one for one and that all user funds will be shown in its public proof of reserves. Co-chief executive Richard Teng said: “Your money is safe, and we’re covering every loss.”
- Withdrawals are still paused while security checks finish. Deposits remain open.
How it happened
Binance says the attack started with a compromised laptop belonging to one of its engineers, which gave the attackers a way to send unauthorized withdrawal requests. It later found additional points of breach and said the attack was not a single “one-click” action. Binance says it has seen no evidence that the private keys of its wallets were stolen.
About $3 billion is frozen
Around $3 billion of the stolen money has been frozen with the help of other companies, and this is counted separately from Binance’s own $6.34 billion. Most of it is stablecoins (digital dollars) that their issuers can block, led by Tether and Circle. The bitcoin and ether still held by the attacker cannot be frozen the same way. Binance says it is working with law enforcement to recover the funds.
Who is blamed
TRM Labs and Chainalysis both said, with “high confidence”, that a North Korean hacking group known as TraderTraitor carried out the attack. The FBI blamed the same group for the previous record theft, about $1.5 billion from the exchange Bybit in February 2025. Binance itself has not named anyone.
Market reaction
- Bitcoin fell to about $77,000 on Friday.
- More than $1.5 billion in leveraged crypto bets were wiped out as prices dropped.
Why it matters
Binance’s promise to cover the full loss from its own money is the main reason this has not turned into a crisis for its customers. The next tests are when withdrawals reopen and whether the next proof-of-reserves report shows every balance fully backed. The attack is also a reminder that the biggest risk at large exchanges is often a single compromised person or device, not the blockchain itself. Customers should follow only Binance’s official channels and ignore “security” links sent by message or email.
This article is for information only and is not financial advice.
