How the $6.3 Billion Binance Hack Unfolded in About 20 Minutes

How the $6.3 Billion Binance Hack Unfolded in About 20 Minutes

The largest crypto heist on record

On October 29, attackers drained roughly $6.36 billion from Binance hot wallets across ten blockchains, most of it in about 20 minutes, according to blockchain intelligence firm TRM. Binance itself put the impacted amount at $6.3 billion. Either figure dwarfs the previous record, the $1.5 billion Bybit hack of February 2025.

It started with one engineer's laptop

In its first account at 02:23 UTC on October 30, Binance said its "initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." Co-CEO Richard Teng stressed this was not a single "one-click" action using one engineer's permissions but "a more complex attack process," involving malicious software designed to delete evidence.

A 20-minute sweep across ten chains

On-chain reconstructions show the first transfers at 20:05 UTC, when five Binance wallets on the XRP Ledger sent 233 million XRP to a single address. Solana and Optimism followed within minutes. At 20:20 a Bitcoin hot wallet sent out 18,270 BTC, and a Tron wallet sent more than 600 million USDT. At 20:24 a single Ethereum transaction moved about $2.53 billion out of one wallet. Security firm Blockaid found the attacker bundled 50 EIP-7702 authorizations into one transaction against hot wallet "Binance 14," delegating it to an unverified sweeper contract that let a designated operator drain tokens and Ether. One account's takeover then cascaded into an associated wallet holding 823 million USDC.

The official line: all losses covered, withdrawals paused

Co-founder Changpeng Zhao posted: "User funds are safe!" and "It does look like a hack on Binance." Binance said only its own hot wallets were hit, deposits were unaffected and later running normally, while withdrawals stayed suspended for an estimated 48 hours. All user losses will be covered by its emergency SAFU fund plus company funds, and an updated Proof of Reserves will follow. Trading on Binance Alpha was temporarily suspended.

Attribution points to North Korea's TraderTraitor

TRM attributed the attack to TraderTraitor, which it called North Korea's elite hacking unit, saying "we make this judgment with high confidence." Chainalysis CEO Jonathan Levin echoed that assessment, and on November 1 the FBI confirmed North Korea was responsible for the theft of more than $6 billion from Binance. Zhao noted that in bitcoin terms, the old Mt. Gox case had a larger impact.

The fallout: half frozen, $3.6 billion withdrawn

Binance said about half the assets were frozen with industry help. Zhao thanked Tether for freezing about $971 million and Circle for about $823 million. Stablecoin issuers and others froze roughly $2.8 billion in total. Investors pulled about $3.6 billion from Binance after the hack; the exchange said withdrawal volumes later stabilized while deposits "remained substantial." The U.S. Secret Service is helping trace the funds, much of which was converted into Ether that cannot be frozen.

What comes next: recovery race and trust test

Binance says it has begun recovering assets for users and keeps working with law enforcement and tracing firms on the remaining "points of breach." With billions already swapped into unfreezable assets and laundering routes built around market makers and lending protocols, full recovery looks uncertain. Whether withdrawals resume on schedule and the new Proof of Reserves satisfies users will decide how lasting the damage is.