Binance Hack Hits $6.3B: $3B Frozen, Full Cover Pledged

Binance said Friday that the October 29 security incident affected an estimated $6.3 billion in crypto, more than double the $2.5 billion first seen leaving a single hot wallet, and that about $3 billion has been frozen so far. The exchange pledged to cover all losses from its SAFU fund and company reserves. Co-CEO Richard Teng said the early investigation points to a compromised DevOps engineer’s laptop, with no evidence that a wallet private key leaked. Chainalysis puts the total near $6.4 billion, which would make this the largest crypto hack on record, more than four times the roughly $1.5 billion taken from Bybit in February 2025.

The first transfer landed at 20:24 UTC on October 29, moving 167,464 ETH, about 1.6 billion USDT and dozens of other tokens out of the wallet labeled Binance 14, a transaction worth roughly $2.5 billion. Twenty-four seconds later, a second wallet, Binance 16, sent another 28,005 ETH to the same destination. Binance co-founder Changpeng Zhao confirmed the exchange “was indeed hacked” in a post on X and said user funds are safe.

What the Blockchain Shows

The on-chain trail points to a compromise rather than routine housekeeping. The wallet that initiated the transfer was funded only through Tornado Cash, which the attacker used for three withdrawals starting October 28. According to security firm Blockaid, the operator rehearsed the full sequence on three of its own wallets, moving between $2 and $6 each time, and deployed a malicious sweeper contract hours before using it.

The receiving address did not exist before Thursday. Within 15 minutes it forwarded 195,460 ETH, around $450 million, to another fresh address. Within 12 minutes of the first sweep, ten more Binance hot wallets across four chains, including Optimism, Arbitrum and Avalanche, sent funds to the same address, bringing the number of Binance keys that signed transfers to eleven.

How the Attacker Took Control of a Binance Wallet

Blockaid traced the main sweep to Ethereum’s EIP-7702 feature, which lets an ordinary wallet delegate its transaction logic to a smart contract. At 20:20:59 UTC the attacker submitted a single transaction carrying 50 signed authorizations aimed at Binance 14, one for each transaction counter from 18,914,775 to 18,914,824. Because the wallet was still processing customer withdrawals, the attacker could not know which counter would be current. Forty-nine authorizations failed. One matched, and the wallet was handed to the attacker’s contract.

The delegation stayed active after the first sweep. At 20:41 UTC the attacker used it to pull 780 million USDC from a Circle smart account owned by Binance 14, and at 21:44 UTC it swept another 200 million USDT that had arrived in the meantime. Blockaid notes that rotating keys does not remove an EIP-7702 delegation, because it belongs to the address. Clearing it requires a new authorization from the same wallet pointing to the zero address. Binance says it has revoked the affected authorizations.

Binance’s Response and the Compromised Laptop

Binance paused withdrawals at about 22:15 UTC on Thursday and, at 00:13 UTC on October 30, said it would cover all losses while suspending deposits and withdrawals for security checks. In an update on X, the exchange said its initial investigation suggests a compromised DevOps engineer’s laptop gave the attacker access to a service container, where unauthorized withdrawal transactions were submitted. It said it has found no evidence of any wallet private key leak.

Teng added that the attacker did not simply use one engineer’s permissions and that this was not a single “one-click” action, but a more complex process. He said the investigation has not attributed responsibility to any individual. The gap between “no key leaked” and eleven keys signing transfers is the central technical question. Jayant Dave of Check Point told the BBC the attackers took over the system that tells the keys what to sign, a reading consistent with Binance’s wording.

Binance co-founder Yi He said in a service update that deposits are unaffected and that withdrawals are expected to resume within 48 hours while the exchange upgrades its withdrawal service and address controls. Binance US said its operations were not affected. Zhao, who no longer runs the exchange, said he expects all user funds to be fully compensated.

How Much Has Been Frozen, and What Is Out of Reach

The freeze total moved several times. Binance first corrected the circulating $1.8 billion figure to a verified $2.54 billion, then raised its estimate to about $3 billion. Tether CEO Paolo Ardoino said the issuer froze more than 1.567 billion USDT, and Circle CEO Jeremy Allaire reported more than 800 million USDC frozen. The Arbitrum Security Council moved 74,559,805 ARB and 8,425 ETH into a restricted wallet that can only be released by further council action or a DAO vote.

Freezes only work on tokens that have an issuer. Bitcoin, Ether, TRX and SOL do not, and that is where the attacker’s remaining position sits. Lookonchain reported that the attacker sold $158.25 million of altcoins, including UNI, ENA, PEPE, LINK, AAVE, ONDO and WLD, for 70,480 ETH. TRM Labs documented about 325 million USDT sold through UniswapX at roughly a 10% discount, a sign the attacker was paying to move faster than the freezes.

Who Is Behind It

TRM Labs says it has high confidence that North Korea’s TraderTraitor group carried out the attack, and Chainalysis co-founder Jonathan Levin has pointed to the same group. TraderTraitor was also linked to the Bybit theft. Binance has not made any attribution, and its investigation is still under way.

Markets Sold First and Asked Questions Later

Derivatives markets reacted before any official word. Bitcoin fell below $79,000 and Ethereum under $2,240 in the minutes after the first transfer, and total crypto liquidations reached $627.7 million in a single hour, according to Coinglass, with $606.6 million of it against long positions and Binance carrying $344.8 million of the total. On Friday, Bitcoin traded near $78,000 to $79,000, and BNB was down roughly 5% to 6% over 24 hours at about $712 to $716.

A Hard Year for Exchange Security

The incident lands on an already damaging stretch for centralized exchanges. In September, attackers took roughly $388 million from Bitget through a third-party security product, and the February 2025 Bybit exploit was the largest exchange hack on record until now, attributed by the FBI to North Korean actors.

Security firm Hacken counted $1.18 billion in crypto hacking losses in the third quarter, up 55% from the prior quarter, with 77% of the damage tied to supply-chain blind spots such as third-party vendors and systems outside the scope of audits. Binance’s estimated $6.3 billion is more than five times that quarterly total.

What Comes Next

The next material updates are the resumption of withdrawals, which Binance expects within 48 hours, and the detailed technical post-mortem the exchange has promised once its investigation is complete. Binance also plans an updated Proof of Reserves after remediation. Open questions include how the attacker obtained the authorizations, how much of the roughly $3 billion frozen is ultimately recovered, and how much of the Bitcoin and Ether still held by the attacker can be traced as it moves through bridges and over-the-counter desks.

This article is not intended as financial advice. Educational purposes only.

FAQ

How much was stolen in the Binance hack?
Binance estimates the impact of the October 29 security incident at about $6.3 billion, with roughly $3 billion frozen so far. Early on-chain counts showed only $2.5 billion leaving a single hot wallet, but further transfers across Ethereum, Bitcoin, Tron and other networks raised the total. Chainalysis puts the figure near $6.4 billion and TRM Labs near $6.36 billion, which makes it the largest crypto hack on record.

How did the Binance hack happen?
Binance says its early investigation points to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container used to submit withdrawals. Blockaid found the attacker used Ethereum’s EIP-7702 feature, sending 50 signed authorizations so that one would match the Binance 14 wallet’s transaction counter and hand it to a malicious contract. Binance reports no evidence that a private key leaked.

Are user funds on Binance safe?
Binance says user funds are safe and has pledged to cover every loss through its SAFU fund and company reserves. Deposits are working normally, while withdrawals were paused during a security overhaul. Co-founder Yi He said on October 30 that the exchange expects to begin restoring withdrawals within 48 hours. Binance US said its operations were not affected, and an updated Proof of Reserves is promised after remediation.

Who is behind the Binance hack?
Binance has not named an attacker or blamed any individual. TRM Labs says it has high confidence that North Korea’s TraderTraitor group is responsible, and Chainalysis co-founder Jonathan Levin has pointed to the same group, which is also tied to the $1.5 billion Bybit theft in February 2025. Investigators are still tracing the funds, and Binance plans to publish a detailed technical post-mortem once its investigation is complete.