Binance $6.3B Hack Explained: What Users Should Do

Disclosure: This article contains affiliate links. As an Amazon Associate, Daily Crypto Hub earns from qualifying purchases at no extra cost to you.

Late on October 29, attackers drained an estimated $6.3 billion in crypto from Binance hot wallets, making it the largest crypto theft on record. Blockchain intelligence firms including TRM Labs, Chainalysis and Elliptic have linked the attack to TraderTraitor, the North Korean state-backed unit previously blamed for the roughly $1.5 billion Bybit hack in February 2025. Binance says it will cover every dollar of losses, but withdrawals were still paused as of the latest reports, with a phased restart targeted for Sunday, November 1.

This piece is analysis, not a live blog. Below we lay out what has been reported so far, what it tells us about the real risk of leaving coins on any exchange, and a practical checklist for Binance customers and everyone else holding crypto on a centralized platform.

What happened: the confirmed facts so far

According to Binance’s recovery update, signed by co-CEOs Yi He and Richard Teng, the hot-wallet compromise began at roughly 20:05 UTC on October 29. TRM Labs said most of the funds left within about 20 minutes and estimated around $6.36 billion moved out across ten blockchains. Estimates differ slightly: Chainalysis CEO Jonathan Levin put the figure at about $6.4 billion, while an earlier Chainalysis estimate cited by Cointelegraph was $5.9 billion. Binance’s own figure is $6.3 billion.

On how it happened, Binance initially pointed to a compromised DevOps engineer’s laptop that gave the attacker access to a service container used to submit unauthorized withdrawals. A later update said the investigation had found “additional points of breach” and described a more complex, multi-step attack rather than a single click. Security firm Blockaid reported that the attacker used Ethereum’s EIP-7702 delegation feature to point a group of Binance hot wallets at a malicious contract. Teng said that delegation did not pass through Binance’s normal approval controls. Binance says it has found no evidence that its private keys were leaked.

TRM Labs also said preparation started at least 36 hours before the theft, with attacker wallets funded through Tornado Cash in advance, a pattern it associates with earlier North Korea-linked operations. Elliptic and on-chain sleuth ZachXBT tied some of the stolen funds to a wallet used in the $351 million Bitget exploit earlier this year.

The freeze: why roughly half the haul is stuck

The most striking part of this incident is how much was frozen, and how fast. Binance says industry partners have frozen about $3 billion on-chain. Tether reported freezing more than 1.5 billion USDT and Circle more than 800 million USDC. Ripple began freezing linked RLUSD, First Digital froze FDUSD, World Liberty Financial froze USD1 and WLFI tokens, and Arbitrum’s Security Council froze about $30.5 million in ARB and ETH. Aave temporarily froze markets after the attacker borrowed around $44.6 million, then lifted the freeze on October 30.

As TRM’s Ari Redbord explained to CNBC, stablecoins are the most recoverable assets because their issuers can freeze, burn and reissue them. Bitcoin and ether have no issuer, so recovering them depends on tracing funds to exchanges that will cooperate. Chainalysis noted that a technical freeze can happen quickly, but actually returning funds can take months or years, often requiring court orders.

How Binance says it will make users whole

Binance says it has set aside more than $6.34 billion from its SAFU emergency fund and corporate treasury, and that it will absorb the loss rather than pass it to customers. It says it already holds about $5 billion in the exact affected tokens (roughly 80% of the loss) and is buying the rest through OTC deals and on exchanges. A full proof-of-reserves report is scheduled for Monday, November 2. Fundstrat’s Sean Farrell told CNBC the breach does not currently appear to create meaningful solvency risk for the exchange, though he flagged that a shortfall could force reserve sales.

Reports also say the incident concerns Binance.com, and that Binance.US, the separate entity serving American customers, said it was unaffected.

The market reaction

The news hit a market that was already fragile after the Fed’s October decision, which we broke down in our analysis of the Fed’s two hike dissents. Per Cointelegraph’s timeline, bitcoin fell to about $76,937 in the early hours of October 30, down 4.9% over 24 hours, while BNB dropped about 8% and ether about 5.7%. CoinGecko data cited by CoinGabbar showed total crypto market capitalization down 3.7% to $2.67 trillion, and the Crypto Fear & Greed Index slid from 51 to 30 (“fear”) in a day. DeFi tokens such as AAVE and UNI fell more than 10% as traders worried about contagion.

If volatility like this makes you nervous about timing purchases, a fixed schedule takes the guesswork out. Our free DCA calculator lets you model how regular buys would have performed through swings like this one.

Analysis: what this hack really tells us

1. “Biggest exchange” does not mean “safest place to store coins”

Binance is the largest crypto exchange by volume, has an emergency fund and runs one of the most mature security teams in the industry. It was still drained of billions in minutes. The lesson isn’t that Binance is uniquely careless; it’s that any custodial hot wallet is a high-value target for well-funded state hackers. In the space of roughly 20 months, the same group has been linked to Bybit, Bitget and now Binance. Exchanges are built for trading liquidity, not long-term storage.

2. Pauses are the hidden cost, even when you lose nothing

Even if Binance makes every customer whole, users have been unable to withdraw for days. If you needed funds for a bill, a tax payment or to move to another platform during a falling market, you were stuck. That liquidity risk rarely shows up in “is my money safe?” discussions, but it’s real and it repeats with every major incident.

3. Freezability cuts both ways

The fact that stablecoin issuers could freeze billions quickly is a big reason this hack isn’t worse. Standard Chartered’s Geoffrey Kendrick suggested the episode could speed up a shift toward decentralized exchanges, while Senator Cynthia Lummis argued that the CLARITY Act would give crypto firms clearer legal cover to freeze suspicious transactions. Both views can be true at once: centralized controls helped recovery here, and the same controls mean issuers can freeze addresses for other reasons too. Knowing which of your assets are freezable is now part of basic risk management.

4. Wallet features are only as safe as the process around them

Security researchers stressed that EIP-7702 itself was not “broken”; the attacker still needed access or a signature it shouldn’t have had. But new account features add new places where an approval can slip through review. For individuals, the parallel is clear: blind-signing transactions you don’t understand, or approving a delegation from a pop-up, is how ordinary wallets get drained too.

What this means for you: a practical checklist

If you have funds on Binance or any other exchange, here’s a calm, step-by-step approach:

Don’t panic-sell or rush. Binance says customer balances are covered. Wait for the phased withdrawal reopening and the November 2 proof-of-reserves report rather than reacting to rumors.
Use only official channels. Major hacks are followed by fake “claim your refund” emails, texts and support DMs. Binance has not asked users to “verify” wallets to be compensated. We saw this pattern after the Keystone wallet data breach, and the same rules apply: never share a seed phrase, never sign in from a link in a message.
Lock down your exchange account. Turn on a hardware security key or authenticator app for login and withdrawals, and enable withdrawal address allowlisting if your exchange supports it.
Decide what really needs to stay on an exchange. Keep only what you actively trade. Move long-term holdings to a wallet you control once withdrawals reopen and network queues settle.
Buy a hardware wallet the safe way. Order directly from the manufacturer or a trusted retailer, never a marketplace reseller with “pre-configured” devices. Our guide on how to buy a hardware wallet safely walks through what to check.
Back up your seed phrase offline. Write it down, store it somewhere fire- and water-resistant, and never photograph it. Work through our free Seed Phrase Backup Checklist before you move significant funds.
Not sure where to keep what? Our free Exchange vs Hot Wallet vs Cold Wallet checker helps you match each holding to the right storage based on how often you use it and how much it’s worth.

Self-custody isn’t risk-free either: you trade exchange risk for the responsibility of protecting your own keys. For most people, a split works best: a small trading balance on a reputable exchange, and everything else in cold storage.

What to watch next

Withdrawal reopening: Binance has targeted a phased restart around Sunday, November 1. Watch which assets reopen first and whether outflows stay orderly, which Fundstrat’s Farrell called the key signal.
Proof of reserves on November 2: The report should show whether Binance has fully replaced the stolen assets.
Further technical findings: Binance said more verified details on the “additional points of breach” would follow. That will show whether other exchanges using similar setups need to act.
Recovery of frozen funds: Watch for court orders or seizure actions that let issuers release frozen stablecoins. Binance is reportedly working with the FBI.
Policy fallout: President Trump said the administration is “looking into” the incident, and the hack is already being cited in the debate over U.S. market-structure legislation.

Frequently asked questions

Is my money safe on Binance after the hack?

Binance says user funds are safe and that it has set aside more than $6.34 billion to cover the loss from its SAFU fund and company treasury. It plans to publish a full proof-of-reserves report on November 2, which will be the best independent signal of whether balances are fully backed.

When will Binance withdrawals resume?

Binance has said withdrawals will reopen in phases after security testing, with a target of around Sunday, November 1. Timelines shifted several times on October 30, so check Binance’s official announcements rather than social media.

Who was behind the Binance hack?

TRM Labs, Chainalysis and Elliptic have attributed the attack to TraderTraitor, a North Korean state-backed hacking unit that was also linked to the 2025 Bybit theft.

Was Binance.US affected?

According to reports, Binance.US, which is a separate entity serving U.S. residents, said it was not affected by the incident.

Should I move my crypto off exchanges?

Keeping only what you actively trade on an exchange and storing long-term holdings in a hardware wallet you control is a widely recommended approach. If you do move funds, wait until withdrawals are working normally and double-check every address.

Protect your crypto

If this hack has you rethinking where your coins live, these are the tools that make self-custody practical:

Ledger Nano X: a widely used hardware wallet that keeps your private keys offline, so an exchange breach can’t touch coins you’ve moved to it. Check current price on Amazon
Trezor Safe 3: an open-source hardware wallet alternative with a secure element, useful if you prefer auditable firmware. Check current price on Amazon
Steel seed phrase backup plate: stamping your recovery words into metal protects them from fire and water, which paper can’t. Check current price on Amazon
YubiKey 5 NFC: a hardware security key for exchange and email logins that blocks most phishing attempts, exactly the kind that spike after a major hack. Check current price on Amazon

This article is for informational purposes only and does not constitute financial advice.