How the $6.3 Billion Binance Hack Unfolded in About 20 Minutes
The largest crypto heist on record
On October 29, attackers drained roughly $6.36 billion from Binance hot wallets across ten blockchains, most of it in about 20 minutes, according to blockchain intelligence firm TRM. Binance itself put the impacted amount at $6.3 billion. Either figure dwarfs the previous record, the $1.5 billion Bybit hack of February 2025.
It started with one engineer's laptop
In its first account at 02:23 UTC on October 30, Binance said its "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Co-CEO Richard Teng stressed this was not a single "one-click" action using one engineer's permissions but "a more complex attack process," involving malicious software designed to delete evidence.
A 20-minute sweep across ten chains
The official line: all losses covered, withdrawals paused
Co-founder Changpeng Zhao posted: "User funds are safe!" and "It does look like a hack on Binance." Binance said only its own hot wallets were hit, deposits were unaffected and later running normally, while withdrawals stayed suspended for an estimated 48 hours. All user losses will be covered by its emergency SAFU fund plus company funds, and an updated Proof of Reserves will follow. Trading on Binance Alpha was temporarily suspended.
Attribution points to North Korea's TraderTraitor
TRM attributed the attack to TraderTraitor, which it called North Korea's elite hacking unit, saying "we make this judgment with high confidence." Chainalysis CEO Jonathan Levin echoed that assessment, and on November 1 the FBI confirmed North Korea was responsible for the theft of more than $6 billion from Binance. Zhao noted that in bitcoin terms, the old Mt. Gox case had a larger impact.
The fallout: half frozen, $3.6 billion withdrawn
What comes next: recovery race and trust test
Binance says it has begun recovering assets for users and keeps working with law enforcement and tracing firms on the remaining "points of breach." With billions already swapped into unfreezable assets and laundering routes built around market makers and lending protocols, full recovery looks uncertain. Whether withdrawals resume on schedule and the new Proof of Reserves satisfies users will decide how lasting the damage is.
