Binance Discloses $6.3 Billion Hack, Freezes $3 Billion, Says It Will Cover All Losses

Binance, the world's largest crypto exchange, disclosed on Thursday, Oct. 29, that attackers had pulled an estimated $6.3 billion in crypto assets from its wallets. That is the largest crypto theft on record, more than four times the roughly $1.5 billion taken from Bybit in 2025.

About $3 billion has been frozen on-chain so far, according to Binance. That leaves roughly half the total still unrecovered.

How the attackers got in

Binance's initial finding was that a hacker may have reached a service container through a compromised DevOps engineer's laptop, then submitted unauthorized withdrawal transactions. The exchange later said the "complex attack" went beyond the laptop.

"We have found no evidence of any wallet private key leak," Binance said in its statement on X. It has promised a detailed technical post-mortem once the facts are verified.

TRM Labs says about $6.36 billion was drained across ten blockchains, with most of it moving inside a 20-minute window. TRM and a second tracing firm have tied the attack to TraderTraitor, a North Korea-linked hacking unit. Binance itself has not publicly named the attackers. It says it is working with law enforcement to identify them.

The freeze and the cover pledge

Stablecoin issuers moved fast. Tether CEO Paolo Ardoino said his company froze more than 1.567 billion USDT. Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC. Coinbase CEO Brian Armstrong said his team was blocking sends to compromised wallets and had contacted Binance directly.

Binance suspended deposits and withdrawals, revoked the affected address authorization, and brought in law enforcement and blockchain intelligence firms. Deposits have since been restored. Co-founder Yi He said the exchange expected withdrawal services to resume within 48 hours of her Oct. 29 post.

On Friday, Binance said it had begun recovering affected users' assets. It also said it had already reserved over $6.34 billion of company funds to cover the incident, with $5 billion of that held in the exact tokens affected. It said it was buying the rest through market and over-the-counter channels. Those figures exclude frozen assets, which are still subject to recovery and verification.

Losses will come from the SAFU emergency fund and company money, Binance said. It will publish an updated Proof of Reserves once remediation is complete.

The FTX comparison

Some X users compared Binance's "your funds are safe" promise to a pre-collapse claim by FTX founder Sam Bankman-Fried that the exchange could cover all client holdings. The comparison was circulating within hours of the disclosure.

Binance's side points to the numbers. Co-CEO Yi He said annual revenue alone is enough to cover the losses without selling the company's SpaceX shares. Analyst 0xngmi estimated losses at about $1 billion after stablecoin freezes, against the $144 billion in customer assets Binance says it holds. Changpeng Zhao answered that estimate on X: "Loss might be a bit higher than that, but will cover." He did not confirm the $1 billion figure.

Trader Quinten Francois argued there is no FTX-style domino effect. He noted the broader crypto market was down only 2% to 3% and said the money was taken from the player with the deepest pockets in the industry. Those are his arguments, not established fact. Binance has not yet published a reserves audit for the post-hack position.

Musk and Zhao trade posts

Elon Musk drew attention of his own. He replied with fire and laughing emojis under a post Zhao made on Oct. 28 warning people not to click email links or download attachments. When the hack news broke, Musk posted "Everyday is Zeroday." He later answered the FTX comparison with a grimacing emoji.

Zhao replied on Friday, Oct. 30: "Elon, have a lot of respect for you, but bad time to troll. Please stop." He noted that Binance's SPCX shares, from its $500 million investment in Musk's Twitter takeover, are worth more than $1 billion. "Would appreciate if you show a little support," he wrote.

On the earlier warning, Zhao wrote: "I wish everyone followed that advice. The hack is more complex than that, but all hacks generally have a compromised device (or algorithm) at some point."

Zhao is no longer CEO. He stepped down after pleading guilty in 2023 to failing to maintain an effective anti-money laundering program, served four months in prison, and was pardoned by President Donald Trump in October 2025. He says he remains a shareholder.

What comes next

The attackers are still moving roughly half the stolen funds, and tracing firms such as Chainalysis are following them. Binance still owes the public its technical post-mortem and its updated Proof of Reserves. Those two documents will show how the attackers got past the exchange's controls and whether the more than $6.34 billion it says it set aside actually covers the hole.