Binance confirms $6.3 billion hack, the largest crypto theft ever, as $3 billion is frozen

Binance says a security breach has affected about $6.3 billion in crypto assets, in what blockchain intelligence firm TRM Labs calls the largest crypto theft on record. About $3 billion has been frozen on-chain, and the exchange has pledged to cover all losses from its SAFU fund and company funds. Withdrawals remain suspended, with Binance targeting a restart within 48 hours.

TRM attributes the attack to North Korea’s TraderTraitor unit with “high confidence.” Binance says it is still working with law enforcement to identify the attackers.

Engineer’s laptop emerges as suspected entry point

Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop. The company said the attacker may have used that access to enter a service container and submit unauthorised withdrawal transactions.

The exchange said it had found no evidence of a wallet private-key leak, revoked the affected address authorisation and engaged law enforcement and blockchain intelligence partners. It promised a technical report once the investigation was complete.

TRM’s separate analysis said the attacker used Ethereum’s EIP-7702 delegation feature to make a Binance hot wallet run attacker-controlled code that swept funds away. Transfers on other networks used ordinary signed transactions. The firm assessed that Binance’s hot-wallet signing infrastructure had been compromised.

Billions moved across multiple blockchains

TRM traced approximately $6.36 billion in transfers across ten blockchains, with most of the funds moving in roughly 20 minutes from 20:05 UTC on October 30—12:05 AM in Dubai time.

Its breakdown put Ethereum outflows at about $3.79 billion, Bitcoin at $1.47 billion and Tron at $628 million. The firm said its findings reflected blockchain activity observed by 00:30 UTC on October 30.

TRM valued assets at the time of each transfer. Its $6.36 billion estimate and Binance’s rounded $6.3 billion impact figure are separate assessments, rather than additional losses.

Tether, Circle and other issuers freeze assets

The response involved several cryptocurrency issuers and infrastructure providers.

Reuters reported that Tether froze nearly $1.57 billion connected to the incident, while Circle froze more than $800 million. Binance co-founder Yi He also reported approximately $200 million frozen by Ripple, alongside $27 million in stablecoins and about $2 million in World Liberty Financial tokens.

Binance subsequently put the overall frozen amount at approximately $3 billion. Frozen assets should not be described as recovered or returned: Binance’s statement reports a freeze, not a completed recovery. Nor does subtracting that figure from the estimated impact establish the exchange’s final net loss.

Customer backing comes under scrutiny

CoinDesk reported that wallets drained during the attack appeared in Binance’s October 1 proof-of-reserves disclosure as assets backing customer balances.

Its analysis estimated that the ether removed could leave ETH backing near 94% unless Binance replaced the assets. That calculation used an earlier reserve snapshot; it is not a verified, current audit of Binance’s financial position.

Binance has promised to publish an updated proof of reserves after remediation. Its commitment to cover losses does not mean customers can currently withdraw their balances.

Bitcoin and BNB fall as investigation continues

The Financial Times reported that bitcoin fell approximately 4% and BNB dropped 7.5% following news of the breach. Those figures describe the reported market reaction, rather than live prices.

The immediate questions are when withdrawals actually reopen, how much of the frozen cryptocurrency can be returned and what the final investigation establishes about the breach. Binance’s latest operational update says the incident involved multiple factors and that investigators are still tracing the full attack path.