Binance Rocked by $6.3B Crypto Heist as Hackers Drain Wallets and Exchange Freezes Withdrawals

About $6.36 billion (£4.75 billion) was transferred out of Binance wallets in minutes in what analysts say is among the biggest cryptocurrency thefts on record, prompting other major crypto firms to freeze billions of dollars linked to the incident.

The attack took place on 29 October, with blockchain intelligence firm TRM Labs tracking transfers from Binance wallets across ten blockchains. Most of the money was moved in about 20 minutes. Binance estimated the impact at around $6.3 billion, while TRM put the figure at $6.36 billion.

Following the incident, other large cryptocurrency firms moved to block assets connected to the suspected theft.

Billions Frozen, but the Money Is Still Missing

TRM Labs said Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion (£1.99 billion) in stablecoins linked to the incident. Arbitrum's Security Council separately froze 8,426 ETH and 74.6 million ARB, bringing the total frozen to roughly $2.7 billion.

Tether chief executive Paolo Ardoino said the company had frozen more than $1.57 billion (£1.1 billion) in USDT. Circle, the issuer of USDC, froze more than $800 million (£6 million), according to reporting by The Block and CoinDesk. Ripple and World Liberty Financial also participated in the response.

World Liberty Financial, a cryptocurrency venture associated with the Trump family, was reported to have frozen approximately $27 million (£20 million) in its USD1 stablecoin.

The frozen assets have not been automatically returned to Binance or its customers. Billions in other cryptocurrencies linked to the incident remain outside the direct control of those companies.

The Coins Even Crypto Giants Cannot Touch

TRM Labs estimated that the attacker still held more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion (£1.79 billion) at the time of its assessment.

Unlike USDT and USDC, Bitcoin and Ethereum are not issued by a central company with the power to blacklist individual tokens. Tether and Circle can restrict transactions involving their own stablecoins, but they cannot freeze Bitcoin or Ether held in a private wallet.

Stablecoins such as USDT and USDC are issued and managed by companies that can intervene in transactions involving their tokens. Bitcoin and Ethereum operate on public blockchains without a central issuer that can block or reverse movements of funds in the same way.

Binance Security Under Scrutiny

Binance's initial investigation suggested that a compromised DevOps engineer's laptop may have allowed an attacker to access a service container and submit unauthorised withdrawal transactions. The exchange said it had found no evidence of a wallet private-key leak.

Binance later said its investigation had uncovered additional points of breach, without publicly detailing them. The exact method used by the attacker remains under investigation.

TRM Labs gave a detailed account of the Ethereum transactions, saying the attacker exploited an EIP-7702 delegation feature to turn a Binance hot wallet into a mechanism that automatically forwarded incoming funds to an attacker-controlled address.

Transfers from wallets on the other nine blockchains involved ordinary signed transactions, according to the firm.

Binance co-CEO Richard Teng has said customer funds are safe and that the exchange will cover the losses. The company said it would use its Secure Asset Fund for Users, known as SAFU, and its own resources to meet the shortfall.

The Block reported that Binance had allocated more than $6.34 billion in company funds and reserves for that purpose, including approximately $5 billion (£3.7 billion) in affected digital assets, with the remainder being acquired. That commitment is separate from the approximately $3 billion (£2.2 billion) frozen by industry partners.

North Korean Link Probed, but Not Proven

TRM Labs has attributed the attack with 'high confidence' to TraderTraitor, a hacking unit it says is linked to North Korea. Reuters reported the firm's assessment, and other blockchain investigators have also pointed to possible North Korean involvement.

Binance has not publicly confirmed this attribution. The company has said it is working with law enforcement and intelligence partners to identify those responsible.

TRM Labs compared the theft with the February 2025 Bybit attack, in which approximately $1.5 billion (£1.1 billion) was stolen.

The Binance incident involved what TRM Labs and Binance estimate to be more than $6.3 billion in unauthorised withdrawals, making it one of the largest reported cryptocurrency thefts to date. Industry participants including Tether, Circle, Ripple, World Liberty Financial and Arbitrum have frozen a proportion of the assets linked to the attack.