$6.3 Billion Gone in Minutes: Binance Hit by the Biggest Crypto Heist in History

Most of it was gone in about 20 minutes.

On Thursday evening, hackers emptied Binance hot wallets on ten different blockchains and walked away with roughly $6.3 billion in crypto, according to the exchange's own estimate. Blockchain analysts at TRM Labs put the figure at $6.36 billion, and Chainalysis at $5.9 billion at the time of the theft.

Either way, it is the largest crypto theft ever recorded, about four times the $1.5 billion stolen from Bybit in February 2025.

How it happened

The drain began at 20:05 UTC on 29 October, when five Binance XRP wallets sent out 233 million XRP. At 20:20, a Bitcoin hot wallet sent 18,270 BTC, worth about $1.47 billion. Within two minutes, a Tron wallet lost 612.7 million USDT.

On Ethereum, the attacker used 50 pre-signed authorisations to turn a hot wallet into a sweeper. TRM Labs says the full balance, including 167,464 ETH and 1.6 billion USDT, was gone in about three and a half minutes. Further sweeps and a second wave on Avalanche and Polygon followed through the night.

Binance first said a compromised laptop belonging to a DevOps engineer had let an attacker reach a service container and submit unauthorised withdrawals. On Friday morning it said its investigation had found "additional points of breach".

Co-CEO Richard Teng said it was "a more complex attack process", not a single click, and that there was no evidence of a leak of wallet private keys.

Who is behind it

TRM Labs attributes the attack with "high confidence" to TraderTraitor, a North Korean hacking unit the FBI previously linked to the Bybit theft. Blockchain investigator ZachXBT named the Lazarus Group as the likely attacker, and Blockaid's chief executive said the tactics were consistent with North Korean operations.

Binance itself has been more careful. "Our investigation has not attributed responsibility to any individual," Teng said.

Watch: Binance US$6.3b crypto heist likely linked to North Korea, says expert (CNA)

The race to freeze the money

As the funds moved, stablecoin issuers and blockchains raced to lock them down. Binance says about $3 billion has been frozen so far.

• Tether froze more than $1.57 billion in USDT.
• Circle froze more than $800 million in USDC, in coordination with law enforcement.
• Ripple froze RLUSD linked to the hack, and World Liberty Financial froze $27 million in USD1.
• Arbitrum's Security Council froze about $30.5 million in ETH and ARB.
• Aave froze markets after the attacker deposited 60 million USDT and borrowed against it.

The rest is on the move. TRM says the attacker swapped about 325 million USDT for ETH at a discount of more than 10% and is splitting the bitcoin through a chain of wallets, a classic laundering pattern.

What it means for your money

Binance has paused withdrawals and expects to restart them within about two days. Deposits are working normally, the exchange says. Binance says "user funds are safe" and that it will cover every loss from its SAFU emergency fund and company money.

If you hold Digital USD: First Digital USD (FDUSD), the dollar stablecoin used mostly on Binance, was also caught up in the theft. First Digital chief executive Vincent Chok said the company has frozen the FDUSD stolen in the attack and is "working alongside the Binance team". It has not said how much. Anyone keeping FDUSD, or any other coin, in a Binance account cannot move it until withdrawals restart. So far there is no sign that FDUSD held in wallets outside Binance has been touched.

Markets shudder

Bitcoin fell almost 5% to around $77,000, ether dropped nearly 6%, and Binance's own BNB token slid about 8% to roughly $693. More than $1.5 billion of leveraged bets were liquidated, and the crypto Fear & Greed Index sank to "fear".

Standard Chartered's Geoffrey Kendrick warned the selling may not be over. "I suspect the negative price action still has some way to go," he said.

What to watch

• Whether withdrawals restart on schedule, and whether there is a rush for the exit when they do.
• How much more of the stolen money can be frozen before it is laundered.
• Binance's full technical report on the extra breach points it has found.
• Whether regulators and law enforcement formally name North Korea.

This article is not investment advice. Figures are early estimates and may change. Photos: illustrative image of a hacked laptop by Yuri Samoilov / Wikimedia Commons (CC BY 2.0); Richard Teng by Binance / Wikimedia Commons (CC BY 4.0). Video: CNA. Reporting draws on Binance, TRM Labs, Chainalysis, CoinDesk and Cointelegraph.