Binance to Cover $6.3bn Hack Losses; $3bn Frozen

Binance says it will cover every loss from a security incident that it estimates at around $6.3 billion, and that about $3 billion of the affected assets has already been frozen on-chain. In a security incident update published at 02:23 UTC on 30 October, the exchange said it “will cover all losses from the SAFU fund and the company’s funds”, adding: “User funds are safe.”

SAFU is Binance’s emergency insurance fund for users. The exchange said it would also publish an updated Proof of Reserves, its public accounting of customer assets, once remediation is complete.

Freezes, revoked access and a withdrawal pause

The first line of defence was the stablecoin freezes. Binance said it had worked with blockchain partners to freeze affected assets, and its verified frozen total rose through the night: $2.54 billion in a post on X at 23:22 UTC on 29 October, then “around $3 billion” by 00:52 UTC. Tether chief executive Paolo Ardoino said on X that Tether had frozen more than 1.567 billion USDT, and Circle’s Jeremy Allaire said Circle had frozen more than 800 million USDC.

Binance said it had also revoked the affected address authorisation and brought in law enforcement and blockchain intelligence partners to trace and recover funds. “We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice,” it said.

Its latest update, a service notice on X at 04:36 UTC, changes one detail of the overnight announcement. Deposits, initially suspended, “remain unaffected and continue to operate as normal”. Withdrawals stay paused “while our team completes a security revamp of the withdrawal service and its related addresses”. Binance said: “We expect to resume within 48 hours.”

Binance co-chief executive Richard Teng had earlier written on X: “I want to be direct: user funds remain SAFE.”

What Binance and TRM say happened

Binance first said it was “aware of reports of a potential security issue” at 21:15 UTC on 29 October. Its announcement gives an initial finding: the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions”. It said it had “found no evidence of any wallet private key leak”. In the 04:36 UTC update it said the incident “stems from multiple factors”, and promised a full root-cause report.

Blockchain analytics firm TRM Labs has published its own analysis of the theft. It puts the amount moved out of Binance wallets at about $6.36 billion across ten blockchains, most of it in about 20 minutes from 20:05 UTC. TRM says that makes it the largest crypto theft on record, about four times the $1.5 billion Bybit theft of February 2025.

TRM attributes the attack “with high confidence” to TraderTraitor, a group linked to North Korea that the FBI named over Bybit. That is TRM’s assessment. Binance has not attributed the incident to anyone and says it is still working to confirm who was responsible.

On the cause, TRM’s reading differs in emphasis from Binance’s. Because wallets on many chains, with different key types, produced valid transfers within about half an hour, TRM says the most likely explanation is that the attacker could make Binance’s hot wallet signing system “sign transactions of its choosing across chains”. That is consistent with Binance finding no leaked private keys, but Binance has not confirmed it. TRM counts about $2.7 billion frozen as of 00:30 UTC, a little below Binance’s later figure.

Why the freezes worked and where they stop

The freezes show how much of a large theft now sits in assets that a central issuer can stop. Tether and Circle acted within about an hour of the main transfers, according to TRM, and Binance’s verified frozen figure climbed from $2.54 billion to about $3 billion in about 90 minutes. By TSN’s arithmetic, without them the gap Binance has pledged to fill would be roughly twice as large.

The limit is everything else. TRM estimates that the attacker still controls about $2.4 billion in ether and bitcoin, which no issuer can freeze, and expects those funds to move through bridges, swap services and over-the-counter brokers. Recovery from here depends on exchanges and trading desks screening deposits, which is why TRM is urging them to check counterparties against the addresses it has labelled.

The cause matters for the wider industry. If Binance’s laptop finding holds, this was a break-in through an employee’s device rather than a broken wallet, and Hacken’s third-quarter report found that most of that quarter’s $1.18 billion in losses came via suppliers, another sign that the weak points are often the systems around wallets. TRM recommends that treasury teams watch Ethereum wallets for EIP-7702 delegations, a feature that lets a wallet hand control to a smart contract, and reject unexpected ones. It also advises separating signing systems by chain and wallet tier, so that one compromise cannot reach wallets on ten chains.

The coverage pledge is the other test. Binance has said it will pay from SAFU and its own funds, and the Proof of Reserves it has promised will be the first public check of whether customer balances remain fully backed. The full accounting can take time: CoinDCX admitted “operational losses” from wallets compromised in 2025 well after the event.

The North Korea question will take longer. Microsoft said this week that North Korean groups are using AI to scale familiar attacks on crypto firms, and the US Treasury has sanctioned people over North Korean IT worker schemes. Whether this incident fits that pattern is, for now, TRM’s judgement and not Binance’s.