What happened

At about 20:05 UTC on October 29, attackers got into Binance's hot wallets and pushed through unauthorized withdrawals worth roughly $6.3 billion in tokens. Blockchain analytics firm TRM Labs puts the figure at about $6.36 billion, moved across ten blockchains, "most of it in about 20 minutes." That makes it the largest crypto theft on record, more than four times the $1.5 billion taken from Bybit in February 2025.

Binance paused withdrawals but kept deposits and its other services running. The first explanation, in the co-CEOs' Security Incident Update #2, pointed to a compromised laptop: a DevOps engineer's machine that gave the attacker a way into a service container, which then submitted the withdrawal transactions. The story did not hold for long. Further investigation found "additional points of breach," and co-CEO Richard Teng later said the attack was more complex than one engineer's permissions being misused, CNBC reported. Binance says it has found no evidence that wallet private keys leaked. How the attacker actually got in is still not public.

Who did it

Private investigators named a suspect first. TRM Labs attributed the attack to TraderTraitor, a North Korean state hacking group, writing: "We make this judgment with high confidence." Chainalysis CEO Jonathan Levin posted on X that it was "likely done by DPRK group TraderTraitor," as reported by Hawaii News Now. TRM pointed to tradecraft it had already seen at Bybit and at KelpDAO in April 2026. Small Tornado Cash withdrawals funded an operator wallet. Staging began well before the theft. Signatures obtained in advance were then executed in one burst.

The FBI moved more slowly. On October 30 it said only that it was "aware of the incident and is engaged with relevant public and private partners," Nextgov reported. A day later it went on the record: North Korea "was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance," AFP reported. TraderTraitor is the group the FBI blamed for Bybit, and it is believed to sit inside the Lazarus Group, best known for the 2014 Sony Pictures hack.

Not everyone in Washington signed on. Asked by reporters at his Florida residence late Saturday, President Trump said: "I'm not concerned. We're learning about it. We don't know if it's North Korea."

Are user funds covered?

Binance's line is blunt: "Binance will absorb the financial impact of these stolen funds, not our users." It set aside more than $6.34 billion of company money, including $5 billion in the affected tokens themselves (USDC, USDT, BTC, ETH, BNB and others). The money comes from SAFU, its Secure Asset Fund for Users, from part of the futures insurance fund and from the corporate treasury, topped up with market and OTC purchases until coverage reaches 100%.

Coverage went from about 80% on October 30 to up to 90% on October 31 and about 95% on November 1. Binance says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are "fully backed 100%." The remaining gap is less liquid tokens outside the top 10, which take longer to buy in size.

Two words get blurred in a lot of the coverage, and they mean different things. "Covered" means Binance replaced the loss with its own money. "Recovered" means stolen funds coming back, and that has not happened. About $3 billion is frozen on-chain with help from law enforcement, analytics firms and token issuers, and that sum sits outside the replacement funds. A spokesperson said Binance is working with law enforcement "to confirm the identity of the criminals and bring them to justice."

Withdrawals reopen, and $3.64 billion leaves

Binance switched withdrawals back on in phases from 06:00 UTC on Sunday, November 1: Bitcoin first, then Ethereum and BNB Smart Chain. All 15 networks and assets in that first phase were live by 12:36 UTC, CNBC reported. Others are still being tested, so not every coin can leave yet.

Customers used the open door. Between 06:00 and 15:30 UTC, Binance processed $4.65 billion in withdrawals against $1.01 billion in deposits, a net outflow of $3.64 billion by its own figures posted on X. That is 2.1% of the $171 billion in total assets its proof-of-reserves data showed on October 28.

Changpeng Zhao in June 2022, at the Vietnam NFT Summit. The photo is not from this incident.

Founder Changpeng Zhao, who speaks as a shareholder rather than for the company, read the same numbers the other way: "98% choose to stay!" He said most of the outflow came in the first couple of hours, and added: "Trust isn't earned by what you say in good times. It's earned by what you do in hard times."

The market had already priced in some damage. Bitcoin fell nearly 5%, ether nearly 6% and BNB, the token tied most closely to Binance, nearly 10%, per AFP. For how Binance's fees and withdrawal limits work in normal times, see our Binance review.

What is still open

As of November 2, 2026, three of Binance's four promises are unfinished. Proof-of-reserves results are due today, from a snapshot taken within 12 hours of Update #2. The technical post-mortem, the document that should finally say how the attacker got in, has no date. And the frozen $3 billion still has to be pried loose.

For anyone running an exchange, a bridge or a DeFi front end, the FBI's request is the part that changes work this week. It says TraderTraitor actors are converting the stolen assets into Ethereum, expects more laundering through DeFi and instant-swap services, and urged the private sector to "block transactions with or derived from addresses TraderTraitor actors are using." "Derived from" is the operative phrase: screening only the first hop misses funds that have already passed through a few fresh wallets.

For Binance customers, the before and after is narrower than the headline. Balances in the ten fully backed assets are whole, by Binance's own account. Holders of smaller tokens should check that their network has reopened before planning a transfer, and read today's reserve figures as the first numbers that test the coverage claims.

Image credits: Binance logo by Bxalber, CC BY-SA 4.0; Changpeng Zhao photo by Aevozer, CC BY-SA 4.0; BNB logo by Binance, CC BY-SA 4.0; FBI seal, public domain; Ethereum logo by the Ethereum Foundation, CC BY 3.0. All via Wikimedia Commons.