Binance said it will absorb an estimated $6.3 billion loss after attackers breached its hot wallets, as the exchange investigates the incident and keeps withdrawals paused for security checks.
The exchange said the breach began at 4:05 p.m. ET (20:05 UTC) Oct. 29. Binance said customers would not bear the financial impact and that it would cover losses through the Secure Asset Fund for Users (SAFU) and corporate funds.
Blockchain intelligence firm TRM Labs valued the transfers at $6.36 billion at the time they occurred, across 10 blockchains. It called the theft the largest in crypto history and compared it with the $1.5 billion Bybit attack in February 2025, describing Binance’s incident as about four times larger.
TRM said Ethereum’s account-delegation feature let a sweeper contract act through a Binance hot wallet. The firm said the activity pointed to compromised signing infrastructure and attributed the attack with high confidence to TraderTraitor, a North Korean hacking unit. Binance has not confirmed that attribution and said it was working with law enforcement to identify those responsible.
Binance’s initial investigation raised the possibility that a compromised DevOps engineer’s laptop opened access to a service container. The exchange later reported that investigators had found additional breach points and no evidence that wallet private keys were exposed.
Binance said about $3 billion had been frozen on-chain. TRM counted roughly $2.7 billion frozen as of 00:30 UTC on Oct. 30. Binance also reported that funds set aside for the incident exceeded $6.34 billion, including $5 billion in affected tokens, or about 80% of the impacted amount; it said it was buying the rest.
For personal account security, Binance recommends using a different password for each service, enabling two-step sign-in, securing linked email accounts and limiting withdrawals to approved addresses. It also advises users to rely on official company channels and enable an anti-phishing code. Binance Academy says hardware wallets keep keys offline and advises storing recovery phrases offline, away from cloud accounts, email drafts or screenshots. These steps address customer accounts and personal wallet storage; Binance said the wallets breached in this incident belonged to the exchange.
Binance aimed to start restoring withdrawals in phases by 1:33 p.m. UTC+8 on Nov. 1, pending security checks. It also set Nov. 2 as the target for proof-of-reserves results.
