Binance lost $6.3 billion to hackers, most of it in a 20-minute burst

Binance, the world’s largest cryptocurrency exchange, lost about $6.3 billion to hackers who emptied its online wallets on ten blockchains, most of it in roughly 20 minutes. That makes it the largest crypto theft on record, about four times the previous high of $1.5 billion taken from rival exchange Bybit. Binance has stopped withdrawals while it works out how the attackers got in, so anyone holding coins on the platform cannot move them out for now.

The exchange says its customers will not pay for the loss. “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” it said in a statement, referring to its Secure Asset Fund for Users, an emergency reserve built for this kind of event. Deposits are working normally. The problem is access: until withdrawals reopen, a Binance balance is something you can look at but not take anywhere else, which is exactly the risk people take on when they keep crypto on an exchange instead of in a wallet they control.

Binance’s first explanation pointed to a single machine. Its initial investigation suggested that a compromised DevOps engineer’s laptop let an attacker reach a service container and submit unauthorized withdrawal transactions. Hours later the company widened that picture, saying it had “uncovered additional points of breach” and calling the incident a complex attack. Co-chief executive Richard Teng wrote that “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.” Binance says it has found no evidence that a wallet private key leaked.

Outside investigators describe a heist that was rehearsed in advance. Blockchain analysis firm TRM Labs traced about $6.36 billion leaving Binance wallets on Ethereum, Bitcoin, Tron, the XRP Ledger, Solana and five other networks, and found test runs of the attack code on other wallets hours before the theft. Because wallets with different key types and signing schemes all produced valid signatures for the attacker within about half an hour, TRM concludes the attacker most likely gained the power to make Binance’s own signing system approve transactions of its choosing.

TRM attributes the attack with high confidence to TraderTraitor, a North Korean state hacking unit that the FBI blamed for the Bybit theft, and Chainalysis reached the same conclusion. Binance itself has not named a culprit.

A race to freeze the money started within minutes. Stablecoins can be locked by the companies that issue them, and they were: Tether froze about 1.77 billion USDT, Circle about 825 million USDC and Ripple 40.5 million RLUSD, while Arbitrum’s Security Council forced roughly $30 million out of the attacker’s wallet on its network, according to TRM. Binance puts the total frozen at about $3 billion. Bitcoin and Ether have no issuer who can freeze them, which is why the attacker rushed to swap stablecoins into Ether, selling some at a discount of more than 10 percent to get them out of reach.

That is where the reassurances run thin. TRM estimates the attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion that nobody can lock, and expects the next moves to run through cross-chain bridges, swap services and over-the-counter brokers. Binance has not said how much of its emergency reserve the loss will consume, and it has not published a root cause. For now, the promise that user funds are safe rests on the company’s word, and “additional points of breach” is not the same thing as a breach that has been contained.

Exchanges make tempting targets because they hold coins on their customers’ behalf in hot wallets, which stay connected to the internet so withdrawals can go out quickly. Bitget lost $387.5 million in a raid it also blamed on North Korea last month. The wider market felt this one too: Bitcoin and Ether fell after the news and were trading about 2 to 3 percent lower by midday in Hong Kong, according to CNN.

The pause also opens a window for scammers. Binance has told customers to “remain cautious of scams” and “not trust unofficial links, messages, or requests for account information.” The exchange has not announced any refund or recovery process that asks for passwords, verification codes or wallet details, so a message offering to speed up a withdrawal is a scam, whatever logo it carries. Binance has not said whether any country or network will get access back first.

Withdrawals have been suspended since about 22:15 UTC on October 29. In an update on the morning of October 30, Binance said it remained on track to resume them in about 45 hours, which points to early Sunday, November 1, although it has not said whether every network will reopen at once. The company has promised an updated Proof of Reserves once the repairs are finished and a technical post-mortem when the investigation ends.

Until then, the biggest exchange in crypto is asking its customers for the one thing crypto was designed to make unnecessary: trust.

Tags: Cybersecurity, cryptocurrency, Binance, Bybit, Richard Teng, TraderTraitor