Binance founder and former chief executive Changpeng Zhao said on October 29 that the exchange might have been hacked, according to the Russian business daily Vedomosti. The next day Binance confirmed the incident and put total losses at about $6.3 billion. According to the tech outlet 3DNews, the attackers gained access to the exchange's systems and used its internal software to authorise transfers across 10 different blockchains, including Bitcoin and Ethereum.
Blockchain analytics firm TRM Labs called the attack the largest recorded theft of cryptocurrency. The previous record was the February 2025 hack of the Bybit exchange, in which about $1.5 billion was stolen. Analysts at TRM Labs and Pangolin Intelligence link the attack to TraderTraitor, a North Korean hacking group, and rate that conclusion as high-confidence, the Russian daily Kommersant reports.
The breach was first blamed on a compromised laptop belonging to one of the exchange's DevOps engineers. Binance CEO Richard Teng later said it was "not the work of one person": the investigation found additional points of entry, and the attackers used a mechanism that wiped their tools and traces as they moved through the systems. Binance said it had found no evidence that private wallet keys were leaked.
Binance suspended withdrawals and, together with industry partners, froze around $3 billion of assets on-chain. Stablecoin issuer Tether blocked more than $1.5 billion potentially linked to the hack, and Circle froze $800 million in tokens. Bitcoin fell below $77,000 on the news, its lowest level since September.
Binance has pledged to cover client losses itself and set aside more than $6.34 billion of its own funds, including its SAFU user protection fund and part of its futures insurance fund. On October 31 the exchange said it had covered 90% of the stolen amount, with BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC fully backed. The remaining 10% is in less liquid tokens, which Binance is buying on the market and through over-the-counter deals.
What is known about the restart
- Binance plans to reopen withdrawals on Sunday, November 1, provided its systems pass security checks.
- Compensation comes from the exchange's own funds. Tracing and recovering the stolen assets is a separate process that is still under way.
- The investigation is not finished, and it is still unclear exactly how the attackers carried out the breach. Binance says it is working with law enforcement, blockchain analytics firms, token issuers and other exchanges.
Sources
This story is based on these reports (in Russian).
- КоммерсантъБиржа Binance оценила ущерб от хакерской атаки в $6,3 млрд
- КоммерсантъСеверокорейских хакеров заподозрили во взломе Binance
- 3DNewsКрупнейший взлом в истории: Binance подтвердила, что хакеры похитили у неё токенов на $6,3 млрд
- ВедомостиГендиректор Binance раскрыл подробности хакерской атаки на $6 млрд
- ВедомостиВ Binance заявили о возмещении 90% убытков пользователям после хакерской атаки
- 3DNewsBinance закрыла 90 % дыры после кражи $6,3 млрд — вывод средств обещают вернуть 1 ноября
Byte VPN
