Binance Says About $6.3 Billion Stolen in What Analysts Call Biggest Crypto Hack

The numbers differ by source

Estimates of the loss vary among the companies tracking the funds:

• Binance: about $6.3 billion.
• TRM Labs (via CNBC): about $6.36 billion.
• Elliptic: $6.43 billion. This figure does not include another $169 million that Elliptic says left Binance after withdrawals were suspended. Binance has said outflows stopped when it paused withdrawals.
• Chainalysis: CoinDesk reported an updated Chainalysis estimate of roughly $5.9 billion "at the time of the theft." Chainalysis's own blog, and CEO Jonathan Levin as quoted by CNBC, put the figure at about $6.4 billion.

Elliptic said it has verified $2.84 billion as frozen, or 44% of the theft. Nearly all of that amount is in USDT and USDC. Tether CEO Paolo Ardoino said the company froze USDT; CoinDesk reported the amount as over $1.57 billion, while Bloomberg reported "more than $1.5 billion." Circle CEO Jeremy Allaire said Circle froze over $800 million in USDC. Unlike bitcoin and ether, these stablecoins can be frozen by the companies that issue them. That is why attackers try to swap them quickly, CoinDesk noted. Blockchain data firm Arkham, cited by CoinDesk, said the hacker wallets held over $5.7 billion at their peak.

How the attacker got in remains unclear

Binance and the analytics firms describe the entry point differently. In a statement quoted by CoinDesk, Binance said its early investigation suggests the incident "may involve a compromised DevOps engineer's laptop." According to Binance, that laptop let the attacker reach a service container, a piece of Binance's internal software, and submit unauthorized withdrawals. "We have found no evidence of any wallet private key leak," the company said.

TRM said the attackers appear to have exploited the way Binance authorizes transactions, Bloomberg reported. Chainalysis said that on Ethereum, the attacker used valid signed approvals to make a Binance hot wallet run the attacker's own code and empty it. Co-CEO Richard Teng said the hack was not a single "one-click" action using one engineer's permissions, according to a Cointelegraph live blog. A later entry, carried by TradingView, reported that Binance had uncovered more breach points. Those breach points have not been described in detail. Binance said it "will share a full post-mortem once the investigation is complete."

TRM attributed the attack to TraderTraitor, an elite North Korean hacking unit. "We make this judgment with high confidence," the firm said. Chainalysis also named TraderTraitor, and Elliptic said North Korea was "likely" responsible. On-chain investigator ZachXBT named the Lazarus Group, according to CoinDesk. No government statement attributing this specific hack has been found. The FBI did name TraderTraitor in connection with the 2025 Bybit hack.

What it means for users

Binance said it will cover all losses using its Secure Asset Fund for Users (SAFU), an emergency fund set up in 2018 that holds about $1 billion, along with company money. Former CEO Changpeng "CZ" Zhao wrote that "user funds are safe." Sean Farrell of Fundstrat told CNBC that the hack "does not currently appear to create meaningful solvency risk for Binance." Solvency refers to the exchange's ability to cover what it owes customers. DefiLlama data cited by CoinDesk put Binance's assets at about $144 billion before the hack, so the loss equals roughly 4% of that total.

Teng said Binance is overhauling its withdrawal security and has revoked the affected address permissions, CNBC reported. The company has said withdrawals should resume within 48 hours, and a later Cointelegraph entry said it was "on track" to do so in 45 hours. Accounts of deposits differ. An earlier Cointelegraph entry said Binance had "temporarily suspended deposits." Later updates, including a post on X by co-founder Yi He, said deposits "remain unaffected and continue to operate as normal." CNBC's explainer reported both versions. Binance has not clarified the difference.

Market reaction

Bitcoin fell 4.8% to below $77,000, according to CoinDesk. Bloomberg reported that it was trading at about $78,400 at 2:45 p.m. Singapore time on Oct. 30. CoinDesk said ether fell 5.7%, BNB fell 8% and the AAVE token fell 11%. CoinDesk also reported that the attacker borrowed at least 20,000 wrapped ether, worth about $44 million, on the lending platform Aave. Cointelegraph put the figure at $44.6 million and said Aave then froze markets. Binance said it is working with law enforcement agencies and blockchain analysis firms to trace the funds.