Binance Loses $6.3 Billion in the Largest Crypto Theft on Record
Binance, the world's largest cryptocurrency exchange, said hackers took about $6.3 billion in almost 200 different tokens from its customers' wallets on Thursday. It is the largest theft in the industry's history, more than four times the $1.5 billion taken from Bybit in February 2025. According to blockchain analytics firm Elliptic, the theft began at 8:05 p.m. GMT and lasted about half an hour, with a second wave of withdrawals after 11 p.m. Binance suspended deposits and withdrawals and said it will cover all user losses.
Per the Financial Times, Nikou Asgari and Phillip Stafford report that the attack appears to have begun with the laptop of one of Binance's DevOps engineers. The attackers did not need users' private keys. They used a device that already had access to the systems that approve transactions, and had Binance's own systems send the money. "They got Binance's own systems to send the money for them," Elliptic co-founder Tom Robinson told the FT. Binance has since said it found "additional points of breach" beyond the laptop. Alistair Heggie, chief executive of crypto insurer DA Insured, said the controls on how withdrawals are initiated, where they can be sent and how they are approved had all failed.
The funds came from hot wallets, where crypto from many users is pooled so it is available for immediate withdrawal. Binance says it has more than 300 million registered users, and both individual traders and large institutions hold assets there. Some of its largest clients had already pushed the exchange to let them keep assets off the platform, the FT previously reported. Many others did not. Lending platform Jupiter Earn said on Friday it was facing a liquidity crunch affecting withdrawals.
Elliptic said four tokens made up 74% of the stolen funds: bitcoin, and Tether's USDT and Circle's USDC stablecoins. It verified that $2.8 billion in stablecoins had been frozen by their issuers, which can block tokens they issue. Binance puts the frozen total at about $3 billion. The remaining $3.3 billion, including 18,270 bitcoin worth about $1.4 billion, cannot be frozen. Elliptic said the attackers had converted much of the unfrozen balance into assets such as ETH and were still moving funds before cashing out. Frozen stablecoins can be reissued to victims, but Robinson said issuers usually do so only after a law enforcement request or court order, which can take weeks or months.
TRM Labs and Chainalysis have linked the attack to TraderTraitor, the North Korean unit tied to the Lazarus Group and blamed by the FBI for the Bybit theft. Binance has not attributed responsibility, and no government has confirmed the link. Chainalysis estimates North Korean hackers stole about $2 billion last year, more than half the global total.
Binance says losses will be repaid from its emergency fund and its own balance sheet. The fund holds about $1.2 billion in bitcoin, according to its wallet, less than a fifth of the loss. The company says it has reserved $6.34 billion, $5 billion of it in the affected tokens, and is buying the rest on the open market. Co-chief executive Yi He said the company's revenue for the year is enough to cover the losses. Binance does not publish financial accounts, so that claim cannot be verified. It is regulated in Abu Dhabi, where the Financial Services Regulatory Authority said it is monitoring the incident.
The structure of the loss is the lesson. Customers' assets were pooled in wallets controlled by one company, and a single compromised machine inside that company could approve withdrawals for all of them at once. Whether users are made whole depends on the company's willingness and ability to pay, which outsiders cannot verify. Assets held under the owner's own keys, with signing authority split across independent parties, do not depend on any one institution's internal controls.
What to watch is whether Binance resumes withdrawals on schedule, whether the unfrozen $3.3 billion moves through exchanges or mixers, whether US or other authorities confirm attribution to North Korea, and whether more large holders follow the institutions that already moved their assets off the exchange.
Note: figures are as of Friday afternoon, October 30, and may change. The bitcoin value assumes about $76,800 per BTC.