Binance Hack Becomes the Biggest Crypto Theft Yet

The Binance hack of 29 October is now the largest theft in the history of cryptocurrency. Binance puts the impact at about $6.3bn. Blockchain analysts at TRM Labs measured $6.36bn at the prices assets carried when they were taken.

For scale, the previous record was the Bybit theft of February 2025, at $1.5bn. This one is roughly four times the size, and most of it was gone in twenty minutes.

How the Binance hack unfolded

The first outflows began at 20:05 UTC and ran across ten separate blockchains: the XRP Ledger, Ethereum, Bitcoin, Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. A second wave followed at about 23:05 UTC.

• Ethereum. An EIP-7702 delegation carrying 50 pre-signed authorisations turned a Binance hot wallet into a sweeper. One transaction then carried out 167,464 ETH and 63 tokens, including 1.615bn USDT.
• Bitcoin. 18,270 BTC moved at 20:20 UTC and was split through a peel chain.
• XRP Ledger. 233.46m XRP left between 20:05 and 20:09 UTC.
• Tron. 612.7m USDT and 46.4m TRX moved within about two minutes of the bitcoin transfer.

On the other nine chains the transfers were ordinary signed sends, which TRM reads as a compromise of the signing infrastructure behind Binance hot wallets rather than a flaw in any one network.

What was recovered and what the exchange promised

Roughly $3bn was frozen, including $2.3bn of USDT and USDC. Tether chief executive Paolo Ardoino said his company froze more than $1.57bn of USDT; Circle chief executive Jeremy Allaire put Circle’s figure above $800m. TRM’s count of frozen funds is about $2.7bn, leaving roughly $2.4bn with the attacker, including more than 420,000 ETH and the 18,270 BTC.

Binance suspended withdrawals and said they would restart once the issue was resolved. Co-chief executive Yi He wrote on X that the platform would cover “all hacking losses”, drawing on the Secure Asset Fund for Users, which holds about $1bn in bitcoin, plus company money. Founder Changpeng Zhao said user funds are safe and noted he no longer runs the company. Binance held around $144bn in assets before the incident, so the theft represents about 4% of the book.

The cause and the attribution

Binance’s first finding points at a compromised laptop belonging to a DevOps engineer, which may have given an attacker reach into a service container able to submit withdrawals. The company says it found no evidence that wallet private keys leaked.

Attribution so far comes from private analysts rather than any government. TRM Labs ties the theft to TraderTraitor, a North Korean unit, with high confidence, and Chainalysis links the same group. The FBI attributed the Bybit theft to TraderTraitor in 2025. Bitcoin fell 4.8% to below $77,000 as the news spread, ether lost 5.7%, BNB 8% and AAVE 11%. Anyone holding keys of their own should read our guide to the best password managers, and a reliable VPN is worth having on any machine used for exchange logins.

What is still unresolved

Three things. The root cause has not been published beyond the initial finding about the engineer laptop, so how an attacker reached signing infrastructure across ten chains at once is not yet explained. The attribution rests on private analysis rather than any government statement, which is a meaningful difference from the Bybit case where the FBI named TraderTraitor itself. And roughly $2.4bn remains under the attacker’s control.

What is settled is the exchange’s position. Binance says no wallet private keys leaked, that user funds are safe, and that it will cover the losses from its insurance fund and company reserves rather than passing them to customers. Against roughly $144bn of assets held before the theft, the sum taken is about 4% of the book, which is why that promise is credible rather than aspirational.

Related Articles

• Best VPN Services Ranked
• How to Reset an Apple ID Password
• Best Payment Processors for Small Business
• Microsoft Bond Sale Raises $25bn for AI Spending
• Claude Code Extension Backdoor Hits Cursor Users