The Binance exploit on the night of 29 October took about $6.3 billion out of the exchange, which makes it the largest theft the cryptocurrency industry has recorded. Binance published that figure itself. CoinDesk reported Chainalysis arriving at about $5.9 billion using prices at the moment of theft.
The previous record holder, the Bybit theft of February 2025, took $1.5 billion. This one is about four times larger and the bulk of it moved inside twenty minutes.
A timeline of the Binance exploit
Outflows started at 20:05 UTC and touched ten chains at once: XRP Ledger, Ethereum, Bitcoin, Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. A second wave arrived near 23:05 UTC.
| Chain | What moved | When |
|---|---|---|
| Ethereum | 167,464 ETH and 63 tokens in one transaction, including 1.615bn USDT | From 20:05 UTC |
| Bitcoin | 18,270 BTC, split through a peel chain | 20:20 UTC |
| XRP Ledger | 233.46m XRP | 20:05 to 20:09 UTC |
| Tron | 612.7m USDT and 46.4m TRX | Within two minutes of the BTC move |
The Ethereum leg used an EIP-7702 delegation with 50 pre-signed authorisations, which converted a Binance hot wallet into a sweeper. Everywhere else the transfers were normal signed sends, and TRM Labs reads that as a compromise of the signing setup behind the exchange’s hot wallets.
How much came back
Stablecoin issuers moved quickly. Tether chief executive Paolo Ardoino said his company froze more than $1.57 billion of USDT and Circle chief executive Jeremy Allaire put Circle’s figure above $800 million, part of roughly $3 billion frozen overall. TRM counts about $2.7 billion locked and roughly $2.4 billion still under the attacker’s control, including more than 420,000 ETH and 18,270 BTC.
Binance paused withdrawals and said they would resume once the problem was closed out. Co-chief executive Yi He committed the exchange to covering “all hacking losses” through the Secure Asset Fund for Users, holding about $1 billion in bitcoin, topped up with company funds. Founder Changpeng Zhao said user funds are safe. Against roughly $144 billion of assets held before the incident, the theft is about 4% of the total.
Where the blame is being placed
Binance’s initial investigation points to a compromised DevOps engineer laptop that may have opened a path into a service container able to issue withdrawals, and the company says no wallet private keys leaked. TRM Labs attributes the theft to the North Korean group TraderTraitor with high confidence and Chainalysis agrees, though neither is a government finding. Prices moved on the news: bitcoin dropped 4.8% to under $77,000, ether 5.7%, BNB 8% and AAVE 11%. If you keep funds on an exchange, our notes on building a strong password and on cloud security practice cover the account side of the risk.
How this compares with past thefts
The Bybit theft of February 2025 held the record at $1.5 billion, and the FBI attributed it to TraderTraitor, the same group analysts name here. This incident is roughly four times that size, which moves it out of the category of large exchange losses and into something closer to a sovereign-scale operation.
The response has been faster than in earlier cases, and that is the one encouraging detail. Around $3 billion was frozen within hours, mostly because so much of the haul was in stablecoins whose issuers can freeze balances at will. The part held in bitcoin and ether, roughly $2.4 billion, has no such control attached to it and is the portion that realistically stays gone.
