Hackers take $6.3bn from Binance, and stablecoin issuers freeze over $2.6bn of it

Binance, the world's largest crypto exchange, said on 30 October that an attacker had taken assets worth about $6.3bn the previous evening. TRM Labs, a firm that traces money on public blockchains, calls it the largest crypto theft on record, about four times the $1.5bn taken from Bybit, a rival exchange, in February 2025. Binance has paused withdrawals while it checks its systems. It says customers' money is safe, because it will cover all losses from an emergency fund and its own money.

TRM counts about $6.36bn leaving Binance wallets on ten blockchains, most of it in about 20 minutes from 20:05 GMT on 29 October. It blames TraderTraitor, a North Korean hacking unit, and says it holds that view with high confidence. Chainalysis, another tracing firm, told CNN it had "high confidence" North Korea was responsible. Binance has not named a culprit. Its early findings suggest the attack may have begun with an engineer's compromised laptop, which let the attacker into part of its systems to submit unauthorised withdrawals. It says it has found no sign that its private keys, the secret codes that control its wallets, leaked. TRM's account goes further. Wallets on many chains, using different keys and signing methods, all produced valid signatures for the attacker. Its most likely explanation is that the attacker could make Binance's own signing system approve transactions of its choosing. Binance has promised a full technical account once its investigation is complete.

What slowed the thieves was a feature of stablecoins, tokens pegged to the dollar whose issuers can lock any wallet holding them. By TRM's count, Tether froze about 1.77bn of its USDT tokens and Circle about 825m of its USDC. Ripple froze 40.5m of its RLUSD and World Liberty Financial 27.8m of its USD1. Arbitrum, a network built on top of Ethereum, used its security council's emergency powers to move about $30m out of the attacker's reach. Binance puts the total frozen at about $3bn. TRM counted about $2.7bn at 00:30 GMT. Ledger Insights, a trade publication, reported Tether's own figure as $1.57bn, below TRM's count.

The attacker raced the freezes. TRM says it sold about 325m USDT to professional market makers through UniswapX, a system that auctions trades to dealers. It accepted a discount of more than 10% to get ether, which no issuer can freeze. It also pledged USDT on Aave, a lending protocol, to borrow about 19,760 ether before Aave froze the markets involved. TRM reckons about $2.4bn in ether and bitcoin is now beyond any issuer's reach. Preparation began at least 36 hours before the theft, it says.

A freeze is not a refund. "A freeze stops the money from moving, and recovery follows through legal process," Ari Redbord of TRM told CNBC. Eric Jardine of Chainalysis said returning funds "can take months or years". Sean Farrell of Fundstrat, a research firm, told CNBC the theft does not, for now, appear to threaten Binance's ability to pay its debts. He put its emergency fund at about $1.2bn. Binance has promised to publish fresh proof that it holds its customers' assets once the clean-up is done. The FBI told CNN it was "aware of the incident" and working with partners.

Accounts differ on some details. CNN and CNBC reported that Binance had suspended deposits as well as withdrawals. Binance's notice was later updated to say deposits are unaffected. In CNBC's report, Chainalysis's chief executive describes a $6.4bn hack, above the figures from Binance and TRM. CNN reported that Binance expects withdrawals to resume by Sunday morning, a date the exchange's notice does not give.