Binance Hit by Record $6.3 Billion Hack as $3 Billion Is Frozen and Bitcoin Slides

Binance said the estimated total impact of a security incident on Oct. 29 is around $6.3 billion, with about $3 billion frozen on-chain so far. Its initial investigation points to a compromised DevOps engineer's laptop that gave an attacker access to a service container used to submit unauthorized withdrawal transactions, and it found no evidence of any wallet private key leak. The exchange said it will cover all losses from its SAFU fund and the company's funds.

The theft far exceeds the $1.5 billion Bybit hack in 2025, the previous record. Early tallies ranged from a Wall Street Journal floor of at least $1.7 billion to roughly $5.9 billion in outflows counted by The Kobeissi Letter. TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit, with high confidence, and Chainalysis also pointed to North Korea, but Binance has not named a suspect.

On-chain analytics firm Bitquery counted $6.3 billion signed away from 17 hot wallets on nine chains between 20:04 and 23:56 UTC, led by Ethereum at $3.77 billion. Tether CEO Paolo Ardoino said Tether froze more than 1.567 billion USDT and Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC, a combined $2.38 billion per Reuters. Bitquery counts $2.7 billion frozen or rescued across all issuers, but about $729 million was swapped into ETH and TRX before the freezes landed and about $3.2 billion was still with the attacker at 06:43 UTC on Oct. 30.

Bitcoin fell to a six-week low of $76,348 late Thursday from $81,877, a decline of about 6.8%, then traded near $78,381 early Friday. BNB fell about 7% to roughly $699, and about $628 million in leveraged positions, mostly longs, were liquidated within an hour. Crypto stocks followed: HUT and GLXY each fell 7%, while RIOT, CLSK and MARA lost between 5.5% and 5.9%.

Binance said it suspended deposits and withdrawals while security checks are completed and revoked the affected address authorisation. It has promised a detailed technical post-mortem and an updated Proof of Reserves once remediation is complete. Watch how long withdrawals stay paused and how much of the attacker's remaining holdings can be traced or frozen.