On Thursday evening, someone emptied a chunk of the world’s biggest crypto exchange faster than most people finish a lunch break. Binance says about $6.3 billion in customer assets left its wallets in an unauthorized attack on October 29, and blockchain analysts say most of it moved in roughly 20 minutes. That makes it the largest crypto theft ever recorded, about four times the size of the $1.5 billion Bybit hack that held the title until yesterday.
The detail that set social media off came from Binance co-CEO Richard Teng. The company’s initial investigation suggests the incident “may have started with a compromised DevOps engineer’s laptop.” A single work computer as the doorway to a multibillion dollar heist is a tidy, terrifying story. It’s also only part of it, and Binance has already said so.
The short version
- About $6.36 billion moved out of Binance wallets on ten blockchains starting at 20:05 UTC on October 29, according to TRM Labs.
- Binance traced the start to a compromised DevOps engineer’s laptop, then said it found “additional points of breach.”
- TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a North Korean state-backed group.
- Stablecoin issuers froze roughly $2.7 billion. The attacker still holds about $2.4 billion in ETH and BTC that nobody can freeze.
- Binance says it will cover all losses. Deposits work; withdrawals are paused and expected to resume within about 48 hours.
What happened, minute by minute
According to TRM Labs’ analysis quoted by BleepingComputer, the attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, “most of it in about 20 minutes starting at 20:05 UTC.” TRM’s Ari Redbord told Sky News the preparation began at least 36 hours earlier, and that the speed of the withdrawals was something the industry had never seen.
Binance’s explanation of how it started has shifted in a way worth paying attention to. The first account said the compromised laptop “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” Then Teng clarified: “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.” By Friday morning the exchange said it had “uncovered additional points of breach” and was still gathering facts.
One reassuring line from Binance: it has “found no evidence of any wallet private key leak.” That matters. A leaked key would mean the vault itself is compromised. Unauthorized withdrawals pushed through internal systems point to a breach of the machinery around the vault, which is bad, but fixable.
Who is TraderTraitor?
Binance hasn’t named a culprit. Two blockchain intelligence firms have. TRM Labs attributes the theft to TraderTraitor, a North Korean state-backed unit that also overlaps with the groups tracked as Lazarus and APT38. Chainalysis said it reached the same conclusion “with a high degree of confidence,” based on on-chain activity in the hours after the theft.
TRM pointed to familiar fingerprints: small withdrawals from the Tornado Cash mixer used to fund an operator wallet, staging that began well before the theft, and transaction signatures “obtained in advance then executed in one burst.” The same group was linked by the FBI to the Bybit hack in February 2025, and TRM says the pattern also matches the KelpDAO hack in April 2026.
The laptop detail fits the playbook, too. The Bybit theft began when attackers compromised a developer machine at Safe, the wallet software provider Bybit relied on. North Korean operators have spent years targeting engineers directly, with fake recruiters, poisoned coding tests and trojanized apps. We’ve covered how the same state hackers spent five weeks inside defense firms using a fake “dream job” lure, and how North Korean IT workers run remote job scams to get inside companies. One engineer with privileged access is a far softer target than a hardened wallet.
Where the $6.36 billion is now
The race after the theft was almost as fast as the theft itself. Circle CEO Jeremy Allaire said the company froze more than $800 million in USDC tied to the incident. Tether CEO Paolo Ardoino said his firm froze more than $1.5 billion in USDT. Ripple, World Liberty Financial and Arbitrum’s Security Council froze more on their networks.
The attacker saw the freezes coming. TRM says they “raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave,” and now hold more than 420,000 ETH and 18,270 BTC, about $2.4 billion “beyond any issuer’s reach.” Stablecoins have a central company that can block an address. Bitcoin and Ether don’t. Freezing also isn’t the same as getting money back, as Crypto Watchdog’s Chapin Fay pointed out to UNILAD Tech: frozen tokens still need a legal process before anyone sees them again.
Are Binance customers going to lose money?
Binance says no. “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” the exchange said. SAFU, short for Secure Asset Fund for Users, is an emergency reserve Binance created in 2018 for exactly this situation. The company also promised an updated Proof of Reserves once the cleanup is done and a full technical post-mortem when the investigation ends.
| Service | Status right now | What Binance says |
|---|---|---|
| Deposits | Working | Unaffected and operating normally, per co-founder Yi He |
| Withdrawals | Paused | Expected to begin resuming within about 48 hours |
| Customer balances | Covered | Losses paid from SAFU and company funds |
| Private keys | No leak found | Post-mortem promised once facts are verified |
Binance has around 335 million registered users, and it has asked all of them to watch out for scams. That warning deserves more attention than it’s getting. Every big exchange hack is followed by a wave of fake “refund” emails, cloned support accounts and phishing pages promising to fast-track a withdrawal. Bill Gates recently predicted that the next year of AI will belong to hackers rather than rogue robots, and convincing, personalized scam messages are exactly where that shows up first.
If you have money on Binance, do this today
- Ignore anyone who offers to “release” your funds. Binance is resuming withdrawals on its own schedule. Nobody can speed it up for a fee.
- Only trust announcements from the app itself or Binance’s verified accounts. Don’t click links in emails, texts or DMs about the hack.
- Check your security settings. Use a passkey or an authenticator app instead of SMS codes, and review your withdrawal address whitelist.
- Don’t panic sell into a falling market. Your balance on the exchange is covered, according to Binance. Selling locks in whatever price you get today.
- Consider self-custody for long-term holdings. Exchanges are convenient, but they’re also the biggest targets in crypto.
The market shrugged, then winced
Bitcoin fell more than 4% to about $77,995 on Friday, CNBC reports, and some smaller tokens dropped around 10%. Shares of Circle slid about 5% in after-hours trading Thursday. That’s painful, but it’s not the collapse some feared when the first numbers came out, largely because Binance immediately promised to make customers whole.
The bigger question is what this does to the argument that crypto is safer than traditional finance. Financial writer Izabella Kaminska put it bluntly: “The vast majority of crypto platforms, and in some cases assets too, are just as structurally centralised as conventional banking platforms.” Unlike banks, she noted, “there is no recourse to a lender of last resort or deposit insurance fund.” Binance happens to have a big enough reserve to absorb this hit. A smaller exchange wouldn’t. And as Kaminska warned, “the crossover contagion risk is no longer zero.”
Binance says a detailed post-mortem is coming. Until then, the safest assumption is that the investigation is still moving, the numbers may still change, and anyone contacting you about this hack is probably not from Binance.
Sources and further reading
- UNILAD Tech: Binance CEO reveals how an employee’s laptop may have triggered the heist
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
- CNBC: Biggest-ever crypto hack impacts $6.3 billion from Binance
- TechRadar: Binance hit by largest crypto theft on record
- Sky News: Crypto worth billions frozen over potential security issue
- Cointelegraph: Live updates on the Binance hack
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
