The world’s largest cryptocurrency exchange has confirmed a security breach that investigators now describe as the biggest crypto hack in history, with $6.3 billion in funds impacted and roughly half of those assets frozen. It has also suspended withdrawals, shaken the market, and left millions of users asking one thing: is my money still there?
Here is what we know so far, what remains unclear, and what comes next.
What happened to Binance?
The attack began late on Thursday 29 October. Blockchain analysts at TRM Labs and Chainalysis say most of the theft unfolded over about 20 minutes. TRM’s tracing shows roughly $6.36 billion left Binance-controlled wallets across ten blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger.
Binance called it a “complex attack.” The company first suspended both deposits and withdrawals, then said deposits were unaffected. Withdrawals remain paused while the exchange rebuilds its withdrawal security. Binance has also warned that the headline figure may continue to increase as teams trace more assets.
The previous record belonged to the Bybit exchange, which lost $1.5 billion in February 2025. This heist is more than four times bigger.
How did the hackers get in?
Binance’s early explanation was strikingly ordinary. Its initial investigation pointed to a compromised DevOps engineer’s laptop, which may have let an attacker reach a service container and submit unauthorised withdrawal transactions. According to CoinDesk, the withdrawals drained the exchange’s hot wallets, the internet-connected wallets used to process customer transfers.
Then the story widened. On Friday Binance said further investigation had uncovered additional points of breach. It insists it has found no evidence that any wallet’s private key was leaked. Not everyone buys that. Mark Karpeles, the former head of the collapsed Mt Gox exchange, told Reuters the attackers had probably gained access to keys for at least two Binance wallets.
On-chain reconstructions published by crypto media add technical colour. One account says the attacker submitted a batch of 50 EIP-7702 authorizations, all signed by a wallet labeled Binance 14, pointing at a contract the attacker controlled. EIP-7702 is an Ethereum feature, introduced in the 2025 Pectra upgrade, that lets ordinary wallets act like smart contracts for a limited time. Security researchers have long warned that criminals use it to sweep funds out of wallets once access has been gained. Another report says the attacker’s wallet received small Tornado Cash withdrawals and tested malicious code before targeting Binance. Treat these as early findings, not official conclusions.
Who is suspected?
Blockchain intelligence firms point at North Korea. TRM Labs said it assessed with high confidence that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. Chainalysis reached the same conclusion, and the on-chain investigator ZachXBT also named Lazarus as the likely attacker.
The pattern is familiar. The FBI blamed the Bybit theft on the same unit, and TRM says the attackers ordered Binance’s wallets to empty into wallets they controlled, mirroring the Bybit hack.
Binance itself is being careful. Co-CEO Richard Teng wrote on X that the company’s investigation “has not attributed responsibility to any individual.” North Korea routinely denies involvement in crypto theft.
Why would a state want this? Money. Experts say stolen crypto is a vital source of foreign currency for Pyongyang and helps fund a nuclear programme that is under UN sanctions. TRM’s policy chief, Ari Redbord, told Al Jazeera this makes the case a global security issue and not just a crypto crime.
Are user funds safe?
This is the question that matters most to ordinary account holders, and the honest answer is: probably, but with caveats.
Binance says it will cover all losses. Customer account balances have not been touched, though users cannot move money off the platform while withdrawals stay suspended. Binance co-founder Changpeng Zhao posted early on that user funds were safe.
The messaging has not been perfectly tidy, though. AFP noted that Binance insisted user funds were completely safe, while also saying it would cover all losses, two statements that do not quite sit together.
The numbers help explain the confidence. Binance’s emergency Secure Asset Fund for Users (SAFU) is worth roughly $1.2 billion, far short of $6.3 billion. But Teng said company funds would also be used, and Fundstrat’s Sean Farrell told CNBC the breach does not currently appear to pose a significant solvency risk for the exchange. On his estimate, if frozen stablecoins are eventually returned, SAFU could cover about a third of what remains lost, with Binance’s own balance sheet covering the rest.
Binance has promised a detailed technical post-mortem once the facts are verified, and says it will publish an updated Proof of Reserves after remediation.
How much has been frozen?
This is where the picture is improving, slowly.
Early on, Binance said about $3 billion had been frozen on blockchain networks. That included more than $2.3 billion frozen by stablecoin issuers Tether and Circle. Tether’s chief executive Paolo Ardoino said his firm froze about $1.6 billion related to the potential hack. By Friday afternoon, Binance had updated the frozen figure to $5 billion.
On simple arithmetic, that leaves roughly $1.3 billion unaccounted for. Binance has not said what became of it. The caution here is that freezing is not the same as recovering. Experts quoted by CoinDesk are divided on how much of the frozen money will actually find its way back.
How did the market react?
Badly, then a little less badly. Bitcoin slid to a six-week low of $76,368, and Ether dropped more than 3 percent to a two-month low. Binance’s own BNB token fell by more than 6%. Shares in Coinbase, which said it was unaffected, fell 4.8 percent. Traders also saw more than $1.5 billion in liquidations across the market, according to Blockonomi.
Analysts say crypto was already soft, weighed down by higher US interest rates and weaker demand from exchange-traded fund buyers, so the hack landed on a market with little cushion.
Governments are watching
President Donald Trump said on Friday that the United States was looking into the hack, and the FBI said it was engaged with relevant public and private partners and ready to investigate. Binance says it is coordinating with law enforcement.
The politics around the exchange add another layer. Zhao pleaded guilty in 2023 to a felony linked to anti-money-laundering failures at Binance, and was pardoned by Trump in 2025. He is no longer head of the company.
A big target, and a familiar warning
Binance has been hit before. In 2019, attackers took 7,000 bitcoin, then worth about $40 million, from a hot wallet, and the exchange covered the loss from SAFU. That sum is a rounding error next to this week’s theft.
Sean Foley, a crypto markets expert at Macquarie University, told Al Jazeera that assets on a centralised exchange are only as safe as the exchange itself, and that bigger holdings make a bigger target. Insurance offers little relief, since most crime and cyber policies do not cover stolen cryptocurrency. TRM’s own data shows thieves took $2.87 billion across nearly 150 attacks in the whole of 2025. One Thursday night has now more than doubled that.
Binance has said it expects to resume withdrawals within about 45 hours of Friday morning, which points to Sunday. At the time of writing I could not find confirmation that service has been restored, so check Binance’s official channels for the latest. The post-mortem, the Proof of Reserves update and any US law enforcement findings are the things to watch. If investigators formally confirm North Korea’s role, expect sanctions talk and fresh pressure on exchanges over how they secure hot wallets.
The biggest lesson is an old one. The most advanced security systems in crypto can still be undone by a single compromised laptop.
Frequently asked questions
Was Binance really hacked?
Yes. Binance has confirmed a security incident affecting about $6.3 billion in assets.
Who is behind the Binance hack?
TRM Labs, Chainalysis and Elliptic attribute it to North Korea’s TraderTraitor unit, part of Lazarus Group. Binance has not formally named a culprit, and North Korea denies such activity.
Are my funds on Binance safe?
Binance says account balances were not touched and that it will cover all losses. Analysts see no major solvency risk, but withdrawals remain suspended until security upgrades are complete.
Is this the biggest crypto hack ever?
Yes. It is more than four times larger than the $1.5 billion Bybit theft of February 2025.
