The crypto industry woke up on Friday to a loss it had never seen before. Roughly $6.36 billion in digital assets vanished from wallets belonging to Binance, the world’s largest cryptocurrency exchange, in what is already being called the Binance crypto heist — a theft that blockchain investigators are describing as the biggest in the history of the asset class.
The Binance crypto heist began at 20:05 UTC on Thursday, October 29. In the twenty minutes that followed, most of the money was already gone. TRM Labs, the blockchain intelligence firm that has been tracing the stolen funds across the network, said in a statement: “An attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes.”
Binance’s own estimate puts the total impact at about $6.3 billion. The first reports on Thursday night told a much smaller story — between $2.5 and $3.3 billion — but the number more than doubled as analysts kept pulling at the on-chain threads and uncovering more drained wallets. Every new wallet found pushed the Binance crypto heist further past the old records. To put the scale in perspective: the new total is roughly four times the $1.5 billion Bybit hack of February 2025, which until yesterday stood as the industry’s worst theft.
How the Binance crypto heist unfolded
The attacker spread the operation across ten blockchains, moving a mix of stablecoins, Bitcoin and Ether out of Binance wallets in a rapid-fire sequence of unauthorized transactions. TRM Labs later refined the tally to about $6.36 billion — with roughly $3.79 billion of it on Ethereum alone. The speed mattered as much as the size. Twenty minutes is barely enough time for an incident-response team to assemble on a conference call, let alone to lock down hot wallets spread across multiple chains.
That is precisely why the early estimates were so far off. The initial $2.5 billion figure reflected only the first wallets investigators could confirm. As the hours passed and analysts traced the full trail, the total kept climbing — past $3 billion, past $5 billion, and finally to the $6.3 billion range that both TRM Labs and Binance now cite.
A trail that points to Pyongyang: who is behind the Binance crypto heist?
Investigators have not waited long to name a suspect. TRM Labs attributed the attack to TraderTraitor, North Korea’s elite hacking unit, “with high confidence,” citing what it called robust on- and off-chain intelligence. According to the firm, the heist carries features matching earlier North Korea-linked operations, including the Bybit hack — which the FBI attributed to the same group back in February 2025.
Chainalysis said separately that it had “high confidence” North Korea was behind the theft, and the firm’s chief strategy officer Jonathan Levin put the figure at $6.4 billion. Singapore-based Pangolin Intelligence concurred with the assessment, as reported by The Jerusalem Post. But no government agency has yet confirmed the attribution, and that gap matters. North Korea has previously denied hacking allegations, even as U.S. and South Korean officials and United Nations reports describe Pyongyang-linked hackers as a key revenue source for the sanctions-hit regime. If the Binance crypto heist is formally tied to Pyongyang, it would mark the group’s most lucrative operation by a wide margin. But attribution in crypto thefts is a murky business, and the on-chain evidence is still being assembled.
The race to freeze the funds
If the theft itself took twenty minutes, the response is measured in billions recovered. About $3 billion has been frozen so far through a coordinated effort by Binance and blockchain partners, an unusually effective counter-operation by the industry’s standards.
Stablecoin issuers did most of the heavy lifting. TRM Labs reported that Tether, Circle, Ripple and World Liberty Financial collectively froze roughly $2.67 billion in stablecoins — Tether alone blacklisted nearly $1.57 billion in USDT, and Circle froze more than $800 million in USDC. Arbitrum’s Security Council invoked emergency powers to freeze about $30.5 million — counted within the roughly $3 billion frozen total, not on top of it.
The Binance crypto heist is also becoming a showcase for how quickly stablecoin issuers can move when the target is big enough. The limits of that effort are also on display. About $3.3 billion is still outstanding, and roughly $2.4 billion of it sits in BTC and ETH under the attacker’s control — much of it in assets nobody can freeze. On-chain data shows approximately 442,000 ETH and around 18,270 BTC still sitting in wallets tied to the heist. As one Pangolin Intelligence analyst told CNN: “I think the cat and mouse game has barely begun yet.”
How the breach happened
Binance’s initial investigation paints a picture of a carefully planned intrusion rather than a smashed window. A DevOps engineer’s laptop was compromised, and that foothold gave the attacker access to a service container from which unauthorized withdrawal transactions were submitted.
Co-CEO Richard Teng addressed the incident publicly on October 30, saying the attack was not a “one-click” action but a complex, multi-stage process — and that the breach went beyond the compromised laptop. The company said no individual has been held responsible and that investigators have found no evidence of a wallet private key leak — a detail that, if it holds, suggests the attacker exploited operational access rather than broken cryptography.
What Binance is telling its users
The exchange is leaning hard on reassurance. Binance says it will cover all losses from company funds and its Secure Asset Fund for Users, known as SAFU, with the familiar refrain that “user funds are safe.” The Binance crypto heist puts that safety fund to its first true test at this scale. Deposits and withdrawals were temporarily suspended while security checks run. In a service update issued at 04:36 UTC on October 30, Binance said deposits were processing normally and withdrawals were expected back within about 48 hours — the company’s stated target, not yet a confirmed fact.
Founder Changpeng Zhao weighed in on X, saying he expects user funds to be fully covered. Zhao co-founded Binance in 2017 and is a Canadian national. He stepped down as CEO in 2023 after pleading guilty to U.S. anti-money-laundering violations, served four months in federal prison, and was pardoned by President Donald Trump in October 2025.
Market reaction — and what the Binance crypto heist means for crypto
Markets flinched, then steadied. Bitcoin fell roughly 5% to below $77,000 on the news, Al Jazeera reported, before partially recovering. Ether moved in sympathy. It was the latest jolt for a market that had already been on edge: Bitcoin had been slipping below $80,000 ahead of the Fed’s October 28 decision, and a weekend sell-off had wiped out $725 million in leveraged positions. The muted reaction reflects two things at once: genuine shock at the scale of the Binance crypto heist, and confidence that the rapid freeze operation has contained the worst of the fallout.
Aravind Srinivasan, head of GSR’s systematic OTC business, told Reuters: “It’s the biggest hack in history.” He is right on the numbers, but the deeper significance may be structural. The heist is a reminder that the central chokepoints of crypto — the giant centralized exchanges where most users still keep their funds — remain the industry’s softest targets. Twenty minutes of unauthorized access at the world’s largest exchange produced the largest theft in crypto history. Regulators, who have been circling the industry for years, will almost certainly sharpen their questions now.
For the moment, though, the focus stays on the frozen billions and the missing ones. Investigators, exchanges and issuers are still racing the clock on roughly $3.3 billion that remains outstanding — including about $2.4 billion in BTC and ETH under the attacker’s control. As the freeze lists grow and the on-chain trail widens, the Binance crypto heist is set to become the case study everything else gets measured against — for attackers, for defenders, and for the industry’s claim that it can police itself.