Binance Loses $6.3 Billion in the Largest Crypto Theft on Record

Binance lost about $6.3 billion from its hot wallets on Thursday evening, the largest theft the crypto industry has recorded. Bitquery's onchain timeline shows funds leaving 17 Binance hot wallets on nine chains between 20:04 and 23:56 UTC on 29 October. TRM Labs puts the total at $6.36 billion at the prices of the moment and says most of it moved in about 20 minutes. The previous record, the $1.5 billion taken from Bybit in February 2025, is about a quarter of it.

Binance suspended deposits and withdrawals and said in its first findings, published at 02:25 UTC on Friday, that "user funds are safe" and that it "will cover all losses from the SAFU fund and the company's funds." Founder Changpeng Zhao wrote that, as a shareholder, he expects "all user funds will be fully covered."

Twenty minutes

The drain ran chain by chain. At 20:04 UTC five Binance accounts on the XRP Ledger sent 233.5 million XRP to a single address. Solana followed at 20:10. At 20:20 the Bitcoin hot wallet sent 18,270 BTC, which the attacker split into 1,000 BTC lots in the same block, and within two minutes the Tron wallet sent 612.7 million USDT and 46.4 million TRX.

Ethereum was the largest piece. At 20:20:59 the attacker submitted one transaction carrying 50 signed EIP-7702 authorizations, one for each consecutive nonce of Binance's busiest Ethereum hot wallet, so that whichever matched would turn the wallet into a sweeper contract under the attacker's control. One matched. Three minutes and 24 seconds later the wallet's whole balance was gone: 167,464 ETH, 1.6 billion USDT and 62 other tokens. The code stayed in place for 3 hours and 50 minutes, until Binance revoked it at 00:10 UTC on Friday, and was called seven times.

The freeze race

What saved part of the money was that much of it was stablecoins, which their issuers can freeze. Tether's first freeze landed at 21:01 UTC, 37 minutes after the main Ethereum drain, and Circle froze 823 million USDC three minutes later. By Bitquery's count Tether locked 1.76 billion USDT across 11 freezes, about 71 percent of the USDT taken on Ethereum and Tron. Ripple, World Liberty Financial, Paxos and First Digital froze about $132 million between them, and Arbitrum's Security Council moved 8,426 ETH and 74.6 million ARB out of the attacker's wallet. The total frozen is about $2.7 billion. Binance's own figure has moved from $2.54 billion late on Thursday to about $3 billion on Friday.

The attacker was faster with the rest. About 700 million USDT left the main receiving wallet before Tether's first freeze, and one wallet passed on 130 million USDT less than a minute before its freeze. About 495 million USDT was turned into ETH, at prices roughly 15 percent over the market, and 60 million USDT was posted on Aave to borrow ETH before Aave froze the affected markets.

What the attacker holds

At 06:43 UTC on Friday Bitquery counted about $3.2 billion still in the attacker's hands: 18,270 BTC across 19 addresses, 17 of them holding exactly 1,000 BTC; 508,621 ETH, two and a half times the ETH taken, after the swaps; 233.5 million XRP; 638.2 million TRX; and 970,551 SOL. ETH was being consolidated into new wallets through Friday morning. TRM expects the next phase to run through cross-chain bridges, swap services and OTC brokers.

How it started

Binance's preliminary investigation points to a compromised laptop belonging to a DevOps engineer, which gave the attacker a way into a service container able to submit withdrawals. Binance says it has found no evidence of a private key leak. Co-chief executive Richard Teng pushed back on the idea that one employee opened the door: "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he wrote, adding that the investigation "has not attributed responsibility to any individual." TRM's assessment is that the attacker likely reached Binance's hot wallet signing infrastructure. Binance has not yet published a root cause.

Who

TRM Labs attributes the theft with high confidence to TraderTraitor, the North Korean unit the FBI tied to the Bybit hack, and Chainalysis has reached the same conclusion. The pattern matches: small Tornado Cash withdrawals to fund an operator wallet at least 36 hours ahead, the attack code tested on two wallets and rehearsed on a third, then pre-signed transactions fired in one burst. Binance has not named an attacker.

The market took the news on Thursday night. Bitcoin fell about 4.3 percent and Ether about 4.6 percent as word spread, according to NBC News. Deposits and withdrawals were still paused on Friday while Binance runs its security checks.