Binance Hack: What the $6.3 Billion Theft Means for Your Account

If you keep crypto on Binance, your money is probably not gone, but you may not be able to move it for a day or two. The Binance hack disclosed late Thursday, October 29, drained roughly $6.3 billion from the exchange's wallets, and Binance says it has paused withdrawals while it checks its systems.

That figure, if it holds, would make this the largest crypto theft on record, according to the Associated Press. The previous record was the roughly $1.5 billion taken from Bybit in February 2025.

Here is what has been confirmed, what is still unclear, and what Binance customers should do right now.

Binance says customer balances will be made whole

In its security incident update, Binance said it will cover all losses from its SAFU fund, an emergency reserve built for this kind of event, plus company money. "User funds are safe," the exchange wrote.

Binance also said it has frozen about $3 billion of the affected crypto with help from blockchain partners. It promised a technical post mortem and an updated Proof of Reserves report, which is the exchange's public accounting of the assets it holds for customers.

Former CEO Changpeng Zhao echoed that message on X, writing "User funds are safe!" according to AP.

How attackers got into Binance's hot wallets

Binance's early explanation points to a single weak link. The company said the incident "may involve a compromised DevOps engineer's laptop," which the attacker used to reach a service container and submit withdrawal transactions that were never authorized.

Binance added that it found "no evidence of any wallet private key leak" and has revoked the address authorization that was abused. A later post from the exchange said investigators had "uncovered additional points of breach," as reported by CoinDesk and CBS News, so the full picture may still change.

Speed was the striking part. Blockchain analytics firm TRM Labs told AP that about $6.36 billion left Binance wallets across ten blockchains, "most of it in about 20 minutes."

Investigators point to North Korea's TraderTraitor

Binance has not named a suspect. It says it is working with law enforcement to identify those responsible.

Two of the biggest names in blockchain tracking have. TRM said with "high confidence" that the theft was carried out by TraderTraitor, a North Korean hacking unit, and Chainalysis CEO Jonathan Levin said the attack was "likely done by DPRK group TraderTraitor," according to AP. Al Jazeera notes the group has been linked to the wider Lazarus operation.

That matters for recovery. Funds stolen by North Korean groups are usually laundered fast, which is why the frozen $3 billion is the most important number for Binance right now.

Prices fell as the news spread

The market reacted quickly. Bitcoin dropped below $77,000 on Friday, and CoinDesk showed ether trading near $2,233, down nearly 4%. CoinDesk also reported about $1.57 billion in liquidations of leveraged crypto positions. Bitcoin was already weak before the hack, after its slide below $80,000 last weekend.

Five things Binance users should do this week

1. Do not panic sell inside the app. Selling locks in today's lower prices and does nothing to speed up withdrawals. Binance says losses come out of its own reserves, not customer balances.
2. Expect a short wait on withdrawals. CBS News reported Binance expects withdrawals to resume "in the next day or two," and CoinDesk cited a target of about 45 hours. Deposits were not affected.
3. Watch for fake "refund" messages. Big hacks bring a wave of phishing emails and texts offering compensation or asking you to "verify" your wallet. Binance will not ask for your password or seed phrase. Our story on the Coinbase Amplitude incident shows how quickly scammers use moments like this.
4. Check your security settings. Turn on an authenticator app or passkey, review active devices, and confirm your withdrawal address allowlist only contains addresses you recognize.
5. Rethink how much you keep on any exchange. Once withdrawals reopen, consider moving long term holdings to a wallet you control. The NGRAVE hack is a reminder that self custody has its own risks, so store your recovery phrase offline and never type it into a website.

The post mortem is the next document to read

Binance's promised technical report should answer the biggest open question: how one laptop led to withdrawals worth billions in minutes. Until it lands, keep an eye on the updated Proof of Reserves, which will show whether the exchange's assets still match what it owes customers. For more coverage, follow our crypto news page.