The $6.3 billion heist: how hackers emptied Binance in twenty minutes

Twenty minutes that drained the world's biggest exchange

Late on Thursday night, the world's largest cryptocurrency exchange was emptied at machine speed. Binance said on Friday that hackers had stolen an estimated $6.3 billion from its wallets; more than four times the previous record for a single crypto theft. Blockchain records show the bulk of the money moved in about twenty minutes, beginning at 20:05 UTC on October 29, when the attacker's addresses began receiving funds from Binance wallets on ten different blockchains.

The exchange halted deposits and withdrawals and promised to cover every dollar of customer losses, telling Al Jazeera that user funds were safe. Co-CEO Richard Teng said the company's $1 billion Secure Asset Fund for Users, itself held entirely in bitcoin, plus company funds would absorb the hit. Binance's first theory was a compromised laptop belonging to a DevOps engineer, which it said let the attacker into a service container and submit unauthorised withdrawals. By Friday it said its investigation had found "additional points of breach"; an admission that the door was bigger than it first looked.

What the blockchain ledger actually shows

The figures come from two directions and roughly agree. Binance puts the total impact at about $6.3 billion and says the number "may continue to increase" as it traces more assets. US blockchain analytics firm TRM Labs, which counted about $6.36 billion moved across ten blockchains, calls it the largest cryptocurrency theft on record; dwarfing the $1.5 billion stolen from the exchange Bybit in February 2025, a hack the FBI attributed to North Korean hackers.

Roughly $3 billion of the stolen assets has been frozen, Binance says. The freeze is possible because about half the haul was stablecoins, tokens whose issuers can halt them remotely. Tether froze about $1.77 billion in USDT and Circle about $825 million in USDC; Ripple, World Liberty Financial, the Trump family's crypto venture; and the Arbitrum Security Council froze smaller amounts. But there is no issuer for bitcoin or ether, and nobody can freeze those: TRM estimates about $2.4 billion worth of the two coins is already beyond reach. The question of who can freeze what in crypto's market infrastructure now sits at the centre of the investigation.

The gaps the investigators have not closed

Nobody in an official capacity has named the attackers. Two US firms, TRM Labs and Chainalysis, say with high confidence that the operation was the work of TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. Blockchain investigator ZachXBT agrees. But no government agency has issued a formal attribution, in the Bybit case, the FBI named TraderTraitor five days after the theft, and Binance itself has said its investigation "has not attributed responsibility to any individual."

The mechanism is also still being pieced together. TRM says the attackers compromised Binance's signing infrastructure, the system that authorises transactions, and ordered the wallets to empty themselves, in an attack mirroring the Bybit heist. Binance says it found no evidence that any wallet's private key leaked; Mark Karpeles, the former head of the collapsed Tokyo exchange Mt Gox, told Reuters the attackers probably accessed keys for at least two Binance wallets. One of those two claims will prove wrong.

Why this theft is a security story, not just a crypto story

A $6.3 billion theft is, by itself, a market event: bitcoin fell to a six-week low of $76,368 and ether dropped more than 3 percent to a two-month low of $2,178 on Friday; shares in the rival exchange Coinbase, which said it was unaffected, fell 4.8 percent. The stolen sum is more than six times Binance's own emergency reserve. And it lands in a market already under pressure from higher US interest rates and weaker demand from exchange-traded fund buyers, analysts told Reuters.

But the harder question is what the money funds. "When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity," Ari Redbord, TRM's global head of policy, told Al Jazeera. "That makes this a global security issue, not just a crypto theft." North Korea, under United Nations sanctions, has long turned to crypto theft as a source of foreign currency; South Korea's spy agency estimated in December 2022 that Pyongyang's hackers had stolen about $1.1 billion in crypto and other virtual assets over five years. If the attribution holds, the Binance heist is not a bank robbery; it is one of the largest self-financing operations ever mounted against the sanctions regime.

The real target was the signing infrastructure

The most important technical detail is also the least intuitive. TRM says the attackers did not crack the vault; they hijacked the system that tells the vault to release money. "The attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money," Joshua Chu, a Hong Kong lawyer who works on crypto cases, told CNA. Binance's account points the same way: a compromised engineer's laptop gave access to a service container, which then submitted unauthorised withdrawal transactions.

That is why the "private keys safe" claim, if it holds, does not make customers safer. Centralised exchanges hold users' assets on their behalf, and as Sean Foley of Macquarie University told Al Jazeera, "any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange's holdings, the larger a target it becomes." Binance, with the deepest wallets in crypto, is the largest possible target. And once the wallets were told to pay out, nothing on the blockchain stopped them; the only defences that worked were off-chain, the stablecoin issuers' freeze switches and the watchfulness of investigators racing the first few hours of laundering.

Where the shock waves travel next

Three things now move at once. First, the freeze race. Trackers believe the bulk of laundering happens in the first hours; after that, marked funds "usually sit there for years," said Bernardo Brites, CEO of stablecoin infrastructure company Trace Finance. The $2.4 billion in bitcoin and ether, which no issuer can freeze, is the prize in play; and Chainalysis says funds from last month's attack on the exchange Bitget, also attributed to the same North Korean group, were already being mixed with the Binance proceeds.

Second, the compliance reckoning. Binance's founder Changpeng Zhao pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform; US President Donald Trump pardoned him in 2025. The FBI and US Secret Service are now working with Binance on the case, according to CNA's sources. Expect the heist to sharpen demands for proof-of-reserves discipline, custody standards and insurance; a niche business, since most crime and cyber policies do not cover stolen cryptocurrency.

Third, the sanctions arithmetic. Hackers stole $2.87 billion in crypto across nearly 150 attacks in 2025, per TRM's 2026 Crypto Crime Report; the Binance haul alone is more than double that annual total. Every dollar frozen is a dollar that cannot fund a missile programme; which is exactly why the freeze infrastructure now sits at the centre of the story.

The race to freeze what's left

Binance says deposits are operating normally and withdrawals should resume within 45 to 48 hours, after a security overhaul of its withdrawal service and addresses. The figure of $6.3 billion "may continue to increase" as investigators trace further wallets; and the company says the frozen total will rise too as more partners act.

The attribution question will settle on a slower clock. Five days elapsed between the Bybit theft and the FBI's public naming of TraderTraitor; analysts will be watching for the same signal this time, plus the promised Binance technical post-mortem. And beyond this case, the industry faces the structural question the heist exposed: the largest exchange in the world can lose four times the previous record in twenty minutes, and half the loot is recoverable only because a handful of stablecoin companies can press a button. That button, and who controls it, is now the most important instrument in crypto crime prevention.