Binance, the world's largest crypto exchange, has lost about $6.3 billion in what is now the biggest cryptocurrency theft on record. That is more than four times the previous record, the roughly $1.5 billion taken from Bybit in February 2025. Blockchain analysts at TRM Labs, Chainalysis and Elliptic attribute the attack to TraderTraitor, a North Korean hacking group that also carried out the Bybit theft.
According to TRM Labs, most of the money left Binance's wallets in about 20 minutes on October 29, across ten blockchains. About $3 billion has since been frozen by stablecoin issuers, blockchains and industry partners, Binance says. The rest is still being moved.
What happened
Binance's first account, posted on X, pointed to a compromised laptop belonging to one of its DevOps engineers. That access, the company said, let the attacker reach an internal service container and submit unauthorized withdrawal transactions. Binance later said its investigation had uncovered "additional points of breach."
Co-CEO Richard Teng has pushed back on the idea that one employee's mistake caused the loss. "The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he wrote. "It involved a more complex attack process." He said the company has found no evidence that wallet private keys leaked, and that the attacker used a "self-destruct mechanism" to wipe its tools and traces, which is slowing the investigation.
On Ethereum, the attacker used EIP-7702, a feature added to the network in May 2025 that lets an ordinary wallet temporarily run smart-contract code. According to TRM Labs and Chainalysis, the attacker had 50 authorizations signed in advance that turned a Binance hot wallet into a "sweeper" under its control, then drained it in one sweep. Teng said that delegation "did not pass through our normal approval controls."
That detail matters for how the theft is understood. An EIP-7702 delegation still needs a valid signature from the wallet itself, and Binance wallets on the other nine chains sent funds through ordinary signed transfers. TRM Labs says this points to a compromise of Binance's hot-wallet signing systems, not a flaw in Ethereum.
Who is blamed
TRM Labs attributes the attack to TraderTraitor "with high confidence," based on what it calls robust on-chain and off-chain intelligence. Chainalysis chief executive Jonathan Levin put the theft at $6.4 billion, slightly above Binance's own estimate, and named the same group.
On-chain investigator ZachXBT reported that funds from the Binance theft and from an earlier $351 million hack of the exchange Bitget ended up in the same address after passing through THORChain, "indicating the same actor is likely behind both incidents." Chainalysis says it is seeing "never-seen-before laundering patterns": thousands of transactions in a short time, suggesting the attackers are automating the movement of funds to hide the trail.
The FBI has named TraderTraitor as the group behind the Bybit theft. U.S. officials have long said North Korea uses stolen crypto to fund its sanctioned weapons programs. Binance says it is working with law enforcement, and a source told Cointelegraph that this includes the FBI. The company itself has not publicly attributed the attack.
What it means for customers
Binance says customer funds are safe and that it will cover all losses. It says it has set aside more than $6.34 billion of company money for that, $5 billion of which is already held in the same tokens that were stolen, plus its emergency SAFU fund of about $1.3 billion. Co-CEO Yi He said the exchange is buying the remaining tokens on the market and through over-the-counter deals, and warned that some purchases could take longer because of thin liquidity.
Withdrawals were suspended after the attack. Deposits are working again, according to Binance. Teng said the company aims to resume withdrawals within about 40 hours and to publish a full proof-of-reserves report by Monday. Until that report is out, the claim that customer funds are safe rests on Binance's word.
Market fallout
The theft shook the wider market. Bitcoin fell almost 5 percent to about $77,000 and Binance's BNB token dropped about 8 percent. Ether fell nearly 6 percent. The Bitcoin Fear and Greed Index fell to "fear," its lowest level since August. The lending protocol Aave briefly froze new deposits and borrowing across its markets as a precaution before reopening, saying its contracts were not affected. Shares of listed crypto companies also fell, although some Wall Street analysts told CoinDesk they saw the drop as a buying opportunity.
Standard Chartered's head of digital-assets research, Geoffrey Kendrick, argued that the hack could push more trading toward decentralized exchanges such as Uniswap, which hold no customer funds in a central wallet.
The questions now
Three questions will decide how lasting the damage is:
- How a single entry point reached billions. Binance will face questions about why access that began on one laptop could reach systems able to move this much money, and whether outside auditors had tested those controls.
- Whether the reserves hold up. The proof-of-reserves report promised for Monday is the first independent check on Binance's promise to make customers whole.
- How much more can be recovered. About half of the stolen funds is frozen. The rest is moving through automated laundering paths that analysts say they have not seen before.
This is not the first time Binance has been hacked: it lost about $40 million in 2019. But the scale of this theft, and the speed of it, puts the security of the industry's largest custodian in question at a moment when crypto has been working hard to look like mainstream finance.
