Inside the $6.3B Binance hack: how 20 minutes broke crypto's biggest exchange
Binance lost about $6.3 billion in the largest crypto theft on record. A minute-by-minute look at the attack, the North Korea link, the freezes and what comes next.
SECURITY & HACKSEXCHANGESANALYSIS
Lukas Brenner
10/30/20265 min read
In roughly twenty minutes on the evening of October 29, attackers emptied hot wallets belonging to Binance, the world's largest crypto exchange, across ten blockchains. Binance puts the loss at about $6.3 billion. TRM Labs, which values each transfer at the moment it happened, counts $6.36 billion. Either figure makes it the largest theft in the history of crypto, roughly four times the $1.5 billion taken from Bybit in February 2025. By early Friday more than $2.5 billion had been frozen, Binance had pledged to cover every customer loss, and withdrawals remained suspended.
Twenty minutes, ten blockchains
On-chain records reconstructed by TRM Labs show a fast, sequenced operation. Between 20:05 and 20:09 UTC, five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single address, each left holding only its minimum balance. Wallets on Solana and Optimism followed. At 20:20 UTC a Binance bitcoin hot wallet sent 18,270 BTC to the attacker in eleven transactions, all confirmed in the same block. Within two minutes a Tron hot wallet released 612.7 million USDT and 46.4 million TRX.
The largest single blow landed on Ethereum. Minutes after 20:20, the attacker swept the entire balance of the hot wallet labelled Binance 14: 167,464 ETH plus 63 tokens, including 1.615 billion USDT. A second Ethereum wallet sent 28,006 ETH the same way, and further sweeps continued until almost midnight. A second wave hit Binance wallets on Avalanche and Polygon around 23:05 UTC. By TRM's count the haul included more than 200,000 ETH, 1.875 billion USDT, 823 million USDC, 18,270 BTC, about 970,500 SOL and 88.5 million of Ripple's RLUSD stablecoin.
How the attacker got in
Binance's preliminary finding points to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container used to submit withdrawal transactions. The exchange later said its investigation had uncovered additional points of breach, without giving details, and that it had found no evidence that wallet private keys were leaked. A full technical post-mortem has been promised.
The Ethereum leg relied on EIP-7702, a feature introduced with the Pectra upgrade in May 2025 that lets an ordinary wallet run smart-contract code after signing an authorization. According to TRM, the operator submitted one transaction containing 50 pre-signed authorizations for consecutive nonces, so that one would still be valid however fast the hot wallet's transaction count moved. One matched, turning Binance 14 into a sweeper that obeyed only the attacker and kept working until it was revoked. On the other nine chains the stolen funds left through ordinary, validly signed transfers. TRM's assessment is that the attacker gained the ability to make Binance's hot-wallet signing system approve transactions across chains, which matters more than any single Ethereum feature.
The North Korea fingerprints
TRM Labs attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI blamed for the Bybit theft. Chainalysis, Blockaid and investigator ZachXBT also point to Pyongyang. The pattern is familiar: the operator wallet was funded with small Tornado Cash withdrawals on the morning of October 28, the attack code was rehearsed on test wallets hours before the theft, and signatures obtained in advance were executed in a single burst. TRM's head of policy Ari Redbord called the attack a watershed and warned that theft on this scale helps fund weapons programmes.
A race to freeze
The response from stablecoin issuers was unusually fast. Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep, and its chief executive Paolo Ardoino later put Tether's total freezes at more than 1.57 billion USDT. Circle froze about 823 million USDC three minutes later in coordination with law enforcement. Ripple froze 40.5 million RLUSD before the rest could be sold, World Liberty Financial froze 27.8 million USD1, and Arbitrum's Security Council forcibly moved about $30 million in ETH and ARB out of an attacker wallet shortly after midnight. Binance said about $3 billion had been frozen with the help of partners and law enforcement.
What issuers cannot touch is the problem. The 18,270 BTC were split through a peel chain into 19 wallets, 17 of them holding exactly 1,000 BTC, and as of early Friday none had moved. Bitcoin has no issuer that can blacklist an address, so those coins can only be stopped when they reach an exchange, an OTC desk or a swap service. The attacker also sold about 325 million USDT for roughly 122,300 ETH through intent-based swap contracts, accepting a discount of more than 10% to escape the freezes, and borrowed around 20,000 ETH from Aave against stolen USDT before Aave froze the affected markets. TRM estimates that more than 420,000 ETH and all 18,270 BTC, about $2.4 billion, remain beyond any issuer's reach.
Binance's balance sheet and the user question
Co-CEO Yi He said Binance would cover all losses, and founder Changpeng Zhao, now the largest shareholder, said he expects users to be made whole. On October 30 Binance said it had set aside more than $6.34 billion: about $5 billion already held in the affected tokens from corporate funds, with the remaining shortfall being bought on public markets and over the counter. Its SAFU emergency fund, created in 2018, has typically held about $1 billion in bitcoin. The roughly $3 billion frozen by partners is not counted in that reserve, so any recovery would come on top.
Reserve data show why the pledge matters. Binance 14 appeared in the exchange's October 1 proof-of-reserves report, meaning the stolen coins had been counted as backing customer balances. CoinDesk estimates that the ETH taken equals about 5.6% of Binance's ETH reserves. The next snapshot, due on November 1, will show whether the gap has been filled. Binance, which held roughly $144 billion in assets before the hack according to DefiLlama, has said all user funds will be verified publicly through proof of reserves.
Market fallout
The reaction was sharp but not chaotic. On October 29 bitcoin fell almost 5% to below $77,000, ether lost about 6% and BNB dropped 8%, while liquidations of leveraged positions reached about $1.57 billion. India's CoinDCX paused new futures positions, citing disrupted liquidity. Bitcoin was trading just below $78,000 on Friday as the exchange said it remained on track to restore withdrawals within roughly 45 to 48 hours.
What to watch next
Four things will decide how this story ends. The first is the bitcoin: if the 19 wallets start moving, exchanges and OTC desks will be under pressure to screen and freeze in real time. The second is Binance's post-mortem, which must explain how a single compromised machine could authorize transfers across ten chains. The third is the November 1 reserve snapshot. The fourth is regulators, who are likely to ask whether hot-wallet limits, signing separation and EIP-7702 monitoring should become formal requirements. For users, the oldest lesson in crypto applies again: assets left on any exchange are only as safe as that exchange's weakest laptop.
Source: TRM Labs, CoinDesk, Binance, Chainalysis, TechCrunch, Al Jazeera, DefiLlama