Binance says $6.3 billion stolen in largest crypto hack on record

Binance, the world's largest cryptocurrency exchange, has disclosed that about $6.3 billion worth of crypto was stolen from its platform. The Verge described it as the biggest cryptocurrency hack on record, roughly four times the previous record of $1.46 billion stolen from Bybit last year.

Binance said in updates on X that user funds are safe and that it will cover all losses. It said it has reserved over $6.34 billion of company funds for the incident, $5 billion of it in the exact token assets affected. The Verge reported that Binance's emergency reserve fund was about $1.3 billion at its last valuation.

According to TRM Labs, most of the theft took place in about 20 minutes on October 29. Wallets on at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana, were drained and the funds sent to addresses controlled by a single attacker. TRM Labs said preparation began at least 36 hours earlier, with test withdrawals from one attacker wallet. Bitquery reported that the withdrawal system signed away $6.3 billion from 17 hot wallets in just under four hours.

Binance said an initial investigation pointed to a compromised laptop belonging to a DevOps engineer, which let an attacker reach a service container and submit unauthorized withdrawals. It later said its investigation had uncovered additional points of breach. Co-CEO Richard Teng said: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process." He said no evidence of a wallet private key leak had been found.

Deposits and withdrawals were suspended. Binance and other firms froze part of the stolen money. Elliptic's Tom Robinson said about $2.8 billion, around 44 percent, was frozen, almost all of it stablecoins. Euronews reported a figure of $2.7 billion, and Binance said at one point that the frozen total had risen to $3 billion. Robinson said the remaining $3.3 billion is mostly Bitcoin, Ether and XRP, which no one can freeze.

TRM Labs and Chainalysis say they believe TraderTraitor, a North Korean hacking group, may be behind the attack. TRM Labs said it made the judgment "with high confidence". Elliptic has not specifically tied it to the group, though Robinson said: "We think North Korea is likely responsible." The FBI named TraderTraitor as responsible for the Bybit hack. Chainalysis said stolen Binance funds were mixing with funds from the Bitget exploit, which had been attributed to North Korean actors.

Binance said it is on track to resume withdrawals in 45 hours, and that it will publish a detailed technical post-mortem once the investigation is complete, followed by an updated Proof of Reserves after remediation. Binance suffered an earlier breach in 2019, when $40 million in crypto was stolen.