Binance hack: $6.3 billion impact and withdrawals paused

Hackers stole cryptocurrency from Binance on October 29 in an attack the exchange estimates affected about $6.3 billion. Binance is a platform for buying, selling and holding digital currencies. It has suspended withdrawals while rebuilding security systems, leaving customers unable to move crypto out.

Blockchain investigators at TRM Labs traced transfers across ten networks. Binance initially suspected a compromised engineer’s laptop, then said it had found additional breach points. The investigation has not produced a final public explanation or identified an individual responsible, the company says.

This report reflects statements checked through 11:27 a.m. Eastern Daylight Time on October 30.

What moved, and when?

TRM places the first main outflows at approximately 20:05 UTC on October 29, or 4:05 p.m. EDT. Its analysis describes Binance wallets sending assets to attacker-controlled addresses on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and other networks. The affected assets included bitcoin, ether and stablecoins, rather than a single cryptocurrency.

The first burst included transfers from five XRP wallets. TRM then tracked activity on Solana and Optimism, followed by a Binance Bitcoin wallet sending 18,270 BTC at about 20:20 UTC. Ethereum and Tron also suffered substantial transfers during the same period. A later wave reached Avalanche and Polygon around 23:05 UTC, so the roughly 20-minute description does not cover every movement.

TRM’s report values transfers when they occurred and describes observations through 00:30 UTC on October 30. That cutoff matters when comparing its analysis with company updates issued later. It documents a sequence of transfers and freezes, not a final account of every asset’s subsequent location.

At 3:37 a.m. EDT Friday, co-chief executive Richard Teng described Binance’s response, including revoked address authorizations and work with law enforcement. A 4:47 a.m. company update said investigators had found additional breach points and that unauthorized outflows stopped when withdrawals were paused. Binance has not published a complete incident timeline explaining every compromised system and transaction.

What does the withdrawal pause mean for customers?

Binance’s latest reviewed executive statement says it is rebuilding the withdrawal service and will not restore it until rigorous tests pass. Deposits are operating normally, according to the company’s earlier update. An account balance may therefore remain visible while outgoing transfers are unavailable; a functioning deposit service does not restore that ability to withdraw.

Teng says the theft affected Binance’s own hot wallet and customer funds were unaffected. Those assertions have not been independently verified. A hot wallet is connected to the internet and used to process transfers. Teng says most user assets are held in cold wallets and moved when needed for withdrawals. His description of custody does not change the announced service restriction.

The scope of notices also matters. Binance Japan said no impact on its customers’ assets had been confirmed, while announcing precautionary suspensions of deposits and withdrawals. That local notice and the global statement describe different services; neither should silently be substituted for the other.

How might the attacker have gained access?

Teng’s initial account said a compromised DevOps engineer’s laptop may have allowed access to an internal service container used to submit unauthorized withdrawal transactions. He rejected the explanation that one employee’s permissions enabled a single action and said responsibility had not been attributed to an individual. Subsequent findings expanded the investigation beyond that initial laptop hypothesis.

The company says it has found no evidence of leaked wallet private keys. In his Friday transcript, Teng also said the attacker destroyed tools and traces while operating, complicating the investigation. Both are company accounts of an unfinished inquiry, rather than independently verified conclusions about which controls failed.

TRM’s on-chain analysis offers more detail about the Ethereum transactions. It says the attacker used wallet authorizations signed in advance to make a Binance hot wallet execute attacker-controlled code. Fifty authorizations were prepared to account for the wallet’s changing transaction counter. One valid authorization was enough to install the mechanism, after which the attacker repeatedly swept arriving assets.

Other affected chains used ordinary signed transfers, TRM says. The firm interprets valid signatures across different networks and signing systems as evidence pointing toward a compromise of Binance’s hot-wallet signing infrastructure. That is its analysis; it does not establish a finished root cause, and it should not be confused with the company’s preliminary account of how access began.

Who is investigating, and who is suspected?

TRM attributes the attack to North Korea-linked TraderTraitor with high confidence, citing on-chain and other intelligence. That remains a private investigator’s assessment, not an announced government finding for this incident. The FBI’s February 2025 attribution of the separate Bybit theft to North Korea is an established earlier case, not proof of responsibility here.

Reuters reports that the FBI and U.S. Secret Service are working with Binance, citing a person familiar with the situation. Its report says the U.S. Embassy in London declined comment and the Secret Service had not responded to an emailed request outside U.S. business hours.

What do the different money figures mean?

Binance’s approximately $6.3 billion figure is its estimate of the incident’s impact. TRM separately values transferred assets at approximately $6.36 billion, using their prices at the time of each transfer. These are different estimates of the same incident, not amounts to add together or a confirmed allocation of losses to customer accounts.

Binance says roughly $3 billion in affected assets has been frozen with help from industry partners. A freeze restricts movement of assets; it does not by itself mean Binance has recovered them or customers have received money. The final recovery total and customer impact remain unresolved.

In his Friday funding announcement, Teng said Binance had reserved more than $6.34 billion of company funds to cover stolen assets. He said $5 billion was already held in the affected tokens, including USDC, USDT, bitcoin, ether and BNB, with the outstanding amount being acquired through markets and over-the-counter channels. The $5 billion is part of that funding commitment.

Teng says Binance will cover all hacked losses with company resources. That is a promise by the exchange, not an independently audited account of completed reimbursement. The frozen-assets estimate and corporate funding commitment describe separate parts of the response.

What happens next?

Teng hopes to restore withdrawals before the company’s Sunday target, subject to testing. He also targets a full proof-of-reserves report for Monday, November 2, with an earlier initial view if possible. Those are stated objectives, not confirmation of restored service or a countdown that restarts when this article is read.

The PCAOB’s investor advisory explains that proof-of-reserves reports can examine selected assets at a particular time without covering all liabilities, ownership rights or internal controls. A proof-of-reserves report is not a full financial-statement audit. Its general warning predates this hack and is not a finding against Binance in this incident.

The next concrete evidence will be a dated, scoped restoration notice; a technical account of the breach and repairs; and a reconciliation of assets frozen, recovered or returned. The promised reserves report will need its own scope and observation date.

The Federal Trade Commission warns that recovery scams can follow crypto losses. Unsolicited demands for advance fees or account information are not authenticated by a widely reported hack. The FBI’s complaint center provides official cryptocurrency-crime reporting information.

*Want more? Explore today's headlines on NewsCubby and join My Day free to make NewsCubby part of your day.*

*ARCHIVE PHOTO — Web Summit's opening night at Altice Arena in Lisbon, November 1, 2022; Binance co-founder and then-CEO Changpeng Zhao appears on the screens during a conversation with Katie Prescott. Company background only; this does not show the October 2026 hack or imply that anyone pictured was responsible. Photo: Ben McShane / Web Summit via Sportsfile, “BE1_1776,” CC BY 2.0. Original photograph; no alteration.*

*NewsCubby articles are produced with AI assistance.*