Binance loses an estimated $6.3 billion in a hack
The exchange says it will cover every loss and has frozen about $3 billion. Blockchain analysts TRM Labs blame North Korean hackers with high confidence.
Binance, the world's largest cryptocurrency exchange, estimates that a breach of its withdrawal system on Oct. 29 cost it about $6.3 billion. The company says it has already frozen around $3 billion with help from industry partners.
Withdrawals are suspended while Binance reviews its infrastructure; deposits, it says, still work. And no user, the company promises, will foot the bill:
Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe.
Blockchain analytics firm TRM Labs reconstructed the attack in its report. Most of the money left in about 20 minutes starting at 2:05 p.m. Mexico City time, a second wave followed around 5:05 p.m., and the total reached $6.36 billion across 10 blockchains. TRM calls it the largest crypto theft on record. Preparations began at least 36 hours earlier, with withdrawals from Tornado Cash, a service that mixes funds to hide where they came from.
Binance has revised its own account of how it started. It first pointed to a compromised laptop; later, in an update on X, it acknowledged "additional points of breach" and a "complex attack." It still says it has found no evidence that wallet private keys leaked.
TRM blames TraderTraitor, a North Korean hacking unit it links to the February 2025 hit on Bybit, which came to about $1.5 billion. That is the judgment of a private firm, not of an authority. Outside Ethereum, the funds left through ordinarily signed transfers, and from that TRM concludes that the infrastructure Binance uses to sign its transactions was probably compromised, not the blockchains themselves.
The freezes TRM counts add up to about $2.7 billion:
| Asset | Frozen by | Amount |
|---|---|---|
| USDT | Tether | about $1.77 billion |
| USDC | Circle | about $825 million |
| RLUSD | Ripple | $40.5 million |
| USD1 | World Liberty Financial | $27.8 million |
| ETH and ARB | Arbitrum Security Council | 8,426 ETH and 74.6 million ARB |
The attacker still holds about $2.4 billion, including more than 420,000 ETH and 18,270 BTC, and has begun laundering it. TRM sees USDT sold to market makers at discounts above 10%, loans on Aave, swaps on Uniswap and bitcoin split into chunks of 1,000 and 100 BTC. It expects bridges between chains and OTC brokers, who trade privately away from exchanges, to come next.
The two totals differ because Binance and TRM use different cutoff dates and valuations. Neither is final.
For anyone holding crypto on the platform, including in Mexico, the immediate change is that withdrawals are blocked. Binance did not set a date in its announcement; on X it spoke of about 45 hours from its Oct. 30 post. It also promised updated proof of reserves and a full technical post-mortem once the investigation closes.
