Binance sets aside $6.34 billion to cover what analysts call the largest crypto theft on record, as two tracing firms point to North Korea

Binance, which Reuters calls the world’s largest cryptocurrency exchange, said early Friday, Oct. 30, that it has set aside more than $6.34 billion of its own money to cover an attack that drained about $6.3 billion from its wallets on Thursday afternoon, Pacific time (Reuters on X). “Binance has already reserved over $6.34B of company funds to cover this incident,” the exchange wrote on X at 3:55 a.m. PT, adding: “$5B of these funds are already held in the exact token assets that were impacted.” It said it would buy the rest of the tokens “through market channels and OTC channels,” and warned that the step “can take longer because some tokens may have low liquidity and OTC settlement also takes time.” The post closed: “We will weather this storm” (Binance on X).

Blockchain analysts describe the loss as the biggest on record for the crypto industry. In a report published at 7:10 p.m. PT Thursday, TRM Labs wrote: “On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC” — 1:05 p.m. PT — and called the theft “about four times the USD 1.5 billion Bybit hack of February 2025” (TRM Labs; BleepingComputer). By TRM’s count, Ethereum accounts for about $3.79 billion of the total, bitcoin for 18,270 BTC (about $1.47 billion), Tron for about $628 million, the XRP Ledger for about $296 million and Solana for about $96 million; at current prices, the same assets come to about $6.23 billion (TRM Labs). Chainalysis puts the figure at $6.4 billion (Chainalysis), and Jayant Dave, chief information security officer at Check Point, called it “the largest crypto theft on record,” the BBC reports (BBC).

The sources give slightly different clocks. Chainalysis says funds began leaving Binance hot wallets around 4:20 p.m. Eastern time (1:20 p.m. PT), and that over nearly 20 minutes the attacker swapped $325 million in stablecoins into $285 million in ETH; by 5:14 p.m. Eastern (2:14 p.m. PT), “the freezes started,” it writes (Chainalysis). Several crypto observers flagged a possible hack hours before Binance confirmed it, and bitcoin dropped by more than 4% after the alerts, the BBC reports (BBC). Binance’s first post on the incident came at 5:13 p.m. PT: “We are working non-stop to resolve this issue. Binance will cover all losses.” It suspended all deposits and withdrawals as a precaution (Binance on X).

Binance’s account of how the attack worked has shifted over the night. At 7:25 p.m. PT, the exchange said its initial investigation “suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” adding: “We have found no evidence of any wallet private key leak” (Binance on X). Co-chief executive Richard Teng said, according to BleepingComputer: “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual” (BleepingComputer). At 1:47 a.m. PT Friday, Binance wrote that “our subsequent investigation has uncovered additional points of breach,” and called the incident “a complex attack” (Binance on X). The exchange has promised a full technical post-mortem (Binance on X).

Outside analysts point at the system that signs Binance’s transactions rather than at stolen keys. The hot wallets involved “use different chains, key types and signing schemes,” yet “All of them produced valid signatures for the attacker within about half an hour,” TRM Labs wrote, as quoted by SecurityWeek. In TRM’s assessment, “the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains” (SecurityWeek). On Ethereum, the attackers used EIP-7702, a mechanism that lets a standard wallet hand its behavior to a smart contract by signing a permission, and sent a batch of 50 such permissions, SecurityWeek reports (SecurityWeek). TRM says preparation began at least 36 hours before the theft, with small withdrawals from Tornado Cash, a service that obscures where crypto comes from (TRM Labs). Check Point’s Dave linked the method to a $388 million hack on the Bitget exchange in September: “This implies that attackers no longer need the vault keys. They target the systems and people with authority to use them” (BBC).

Two blockchain-tracing firms name the same suspect. “TRM attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence,” TRM Labs said (SecurityWeek). Chainalysis reached the same view and announced it at 12:30 a.m. Eastern on Oct. 30 (9:30 p.m. PT Thursday), citing what it calls its strongest evidence: its investigators saw funds taken from Binance “commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors” (Chainalysis). Blockchain investigator ZachXBT named the Lazarus Group as the probable attacker, and the FBI attributed the Bybit theft to TraderTraitor, SecurityWeek reports (SecurityWeek); Check Point says the industry also knows the unit as Lazarus Group, according to the BBC (BBC). Binance did not directly respond to BBC questions about possible links to North Korea, the BBC says, but said: “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice” (BBC). This desk found no public response from North Korea.

The freezes hit stablecoins hardest, because their issuers control the token contracts. “Tether, Circle, Ripple and World Liberty Financial froze about USD 2.67 billion in stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB on its network, for a total of roughly USD 2.7 billion,” TRM Labs wrote, counting freezes as of 00:30 UTC (5:30 p.m. PT Thursday) (TRM Labs; BleepingComputer). Binance co-chief executive Yi He posted on X at 5:24 p.m. PT that the Arbitrum Security Council had frozen about $30.5 million (@heyibinance on X). The attacker fought the clock: “The attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer’s reach,” according to TRM (BleepingComputer). SecurityWeek reports that the attackers sold USDT for ETH at more than 10% below market price (SecurityWeek).

A freeze does not return the money on its own. “A freeze stops the money from moving, and recovery follows through legal process,” Ari Redbord, global head of policy at TRM Labs and a former federal prosecutor, told CNBC (CNBC). “Stablecoins are the most recoverable asset class in crypto because the issuer controls the token contract,” CNBC quotes him as saying; bitcoin and ether, which no issuer can freeze, require tracing through exchanges and other services (CNBC). Eric Jardine, head of research at Chainalysis, told CNBC: “There is no standard recovery timeline. A technical freeze may happen quickly, while returning funds can take months or years” (CNBC). Binance says its $6.34 billion figure leaves out frozen or protected assets, “which remain subject to ongoing recovery and verification” (Binance on X).

For customers, the rules changed during the night. Binance’s first posts said it had suspended deposits and withdrawals (Binance on X); at 9:36 p.m. PT, it wrote that “Deposits remain unaffected and continue to operate as normal,” while withdrawals stayed paused during “a security revamp of the withdrawal service and its related addresses,” with a target of resuming “within 48 hours” (Binance on X). At 1:47 a.m. PT, it said it remained “on track towards the expected timeline to resume the withdrawal service in 45 hours” (Binance on X). “Safety first: withdrawals are currently disabled until the environment is confirmed to be secure,” Yi He said, according to the BBC (BBC). Binance.US, a separate and much smaller platform for American residents, said the issue did not affect it, and Coinbase said it saw no effect and kept monitoring, the BBC reports (BBC). Binance also promises an updated Proof of Reserves once it finishes the repair work (Binance on X).

Analysts split on what the theft means for the wider market. “The most important takeaway for markets is that this does not currently appear to create meaningful solvency risk for Binance,” Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, told CNBC; he estimated that around $3.3 billion stayed unfrozen and, assuming the frozen stablecoins eventually come back, that Binance’s SAFU emergency fund, worth about $1.2 billion, could cover roughly a third of the remaining losses, CNBC reports (CNBC). “The key tell will be how quickly withdrawals resume and whether outflows stay orderly,” he added. Bobby Lee, chief executive of Ballet, told Bloomberg the hack looks “not the end of the world” and suggested the multitrillion-dollar market can absorb the shock, according to Bloomberg’s post on X (@business on X). Chris Perkins of Franklin Templeton called on CNBC for stronger cybersecurity standards and more coordination among governments: “We need to make sure standards are incredibly high, but we have to really focus on the criminals” (CNBC). Bitcoin traded below $78,000 on Friday, CNBC reports, and Reuters says the attack could prompt investors to rethink the risks of owning digital assets (CNBC; Reuters on X).

For now, Binance itself carries the cost. Binance has pledged to cover all losses from its SAFU fund and company money, and says “User funds are safe” (Binance on X). TRM Labs counts the attack as matching earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026, in small Tornado Cash withdrawals funding an operator wallet, staging well before the theft, and signatures obtained in advance then used in one burst (TRM Labs). Binance said it will keep sharing “verified updates as recovery efforts progress” (Binance on X). Seems News earlier covered an International Monetary Fund warning that lists a cyberattack among the shocks that could unsettle markets (Seems News, IMF warning).