The exchange says about $3billion in affected assets has been frozen, while investigators point to a suspected compromise of its wallet-signing infrastructure.
Binance has pledged to cover all customer losses after hackers stole an estimated $6.3billion in digital assets, in what blockchain investigators describe as the largest cryptocurrency theft on record. The October 29 attack forced the world’s biggest crypto exchange to suspend deposits and withdrawals as it investigated the breach and worked with industry partners to stop the stolen funds from moving.
By Friday, Binance said approximately $3billion in affected assets had been frozen. Withdrawals remained suspended while the company carried out security work, with co-founder and co-chief executive Yi He saying they were expected to resume by Sunday, November 1. That timetable remained a company forecast, rather than confirmation that services had been restored.
Blockchain intelligence firm TRM Labs estimated the theft at $6.36billion across 10 blockchain networks, valuing the assets at the time they were taken. Most of the money moved in roughly 20 minutes, beginning at 20:05 UTC on Thursday, although further withdrawals continued for hours. The total was approximately four times the $1.5billion stolen from Bybit in February 2025, the previous record-setting crypto heist.
Binance promises compensation as withdrawals remain paused
Binance co-chief executive Richard Teng said the company would use its emergency reserve and corporate funds to absorb the losses. “Your money is safe, and we’re covering every loss,” he told customers, according to the BBC.
The exchange’s Secure Asset Fund for Users, known as SAFU, was established in 2018 to protect customers in emergencies. The approximately $1billion fund is substantially smaller than the reported theft, making Binance’s commitment to contribute company funds an important part of its response.
The compensation pledge is separate from the effort to recover stolen cryptocurrency. Binance has promised to make customers whole, but that does not mean all stolen assets have been returned or that the recovery process is complete.
The breach affected Binance.com, the global exchange. Binance.US, the separate platform serving American customers, said it was unaffected. Coinbase also said it had not been affected.
Investigators examine access to wallet-signing systems
Binance’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer, whose work involves the systems used to develop and operate software. Teng said that access allowed an attacker to reach an internal service container and submit unauthorised withdrawal transactions.
The company subsequently said it had uncovered “additional points of breach,” complicating the initial explanation. Binance also said it had found no evidence that wallet private keys—the cryptographic credentials controlling the wallets—had leaked. A definitive account of the intrusion had not been published in the reporting reviewed for this article.
TRM’s analysis points to a possible compromise of Binance’s hot-wallet signing infrastructure: the systems that authorise transactions from internet-connected wallets used to process withdrawals. Wallets on different blockchains, with different signing mechanisms, produced valid transactions sending funds to the attacker within a short period.
That distinction matters. Investigators are examining whether the attacker obtained the ability to make Binance’s systems approve transfers, rather than necessarily stealing every affected wallet’s private key. TRM described that explanation as its assessment, not a confirmed root cause.
Ethereum delegation enabled repeated withdrawals
On Ethereum, the attacker used a feature called EIP-7702 to delegate a Binance wallet’s behaviour to a malicious smart contract, according to TRM. Introduced in Ethereum’s Pectra upgrade in May 2025, the feature allows an ordinary wallet to run smart-contract code after signing an authorisation.
The attacker submitted 50 pre-signed authorisations covering consecutive transaction-counter values. One matched the Binance wallet’s counter when it was processed, giving the attacker’s contract control over the wallet’s behaviour.
Three minutes and 24 seconds later, the attacker instructed the wallet to transfer 167,464 ether and 63 tokens, including approximately 1.615billion USDT. The delegation remained active, allowing additional funds arriving in the wallet to be swept out in subsequent transactions.
The Ethereum mechanism does not explain the entire theft. TRM said wallets on Bitcoin, Solana, Tron, the XRP Ledger and other affected networks sent funds through ordinary signed transfers. Its findings therefore point to a broader authorisation failure, rather than an Ethereum feature directly draining assets across all 10 networks.
Billions frozen, but recovery remains uncertain
Stablecoin issuers played a central role in containing the losses. Tether, Circle, Ripple and World Liberty Financial restricted stolen tokens, while Arbitrum’s Security Council used emergency powers to secure assets on its network.
TRM independently identified approximately $2.7billion in frozen or secured assets as of 00:30 UTC on October 30. That earlier snapshot included about $1.77billion in USDT, $825million in USDC and roughly $30million in ether and ARB secured on Arbitrum. Binance subsequently reported a broader total of approximately $3billion frozen. The figures reflect different reporting cutoffs and should not be added together.
Crucially, frozen does not mean recovered. Blocking an address can prevent further transfers without immediately returning the assets to Binance. Recovery may require coordination with law enforcement and additional legal procedures, potentially taking months or years, according to reporting by CNA and Kompas.
The attacker also moved to exchange assets that issuers could freeze for cryptocurrencies beyond those issuers’ control. TRM traced approximately $325million in USDT exchanged for about 122,300 ether, as well as a transaction in which stolen USDT was deposited into Aave to borrow ether.
At TRM’s reporting cutoff, the attacker controlled more than 420,000 ether and 18,270 bitcoin, together worth approximately $2.4billion. Those holdings remained traceable, but lacked the issuer-controlled freezing mechanism available for centrally issued stablecoins.
Analytics firms point to North Korean hackers
TRM Labs attributed the attack with “high confidence” to TraderTraitor, a North Korean hacking operation linked to the Lazarus Group. Chainalysis separately said it had high confidence in the North Korean attribution, according to the BBC.
TRM cited similarities with earlier North Korea-linked thefts, including advance preparation, small Tornado Cash withdrawals used to fund an operator wallet, and signatures obtained before being executed in a coordinated burst. The FBI previously identified TraderTraitor as responsible for the February 2025 Bybit theft.
Binance was more cautious. Teng said its investigation had not attributed responsibility to any individual, while the exchange said it was working with law enforcement to identify those responsible. North Korea has historically denied involvement in cryptocurrency hacks.
Crypto prices fall as the investigation continues
The breach added pressure to cryptocurrency markets. Bitcoin fell as much as about 5% during the initial scare and subsequently reached a six-week low of $76,368. Ether fell more than 3% to a two-month low of $2,178, while CoinDesk reported BNB down more than 6% during the sell-off. Those figures represent different market snapshots, rather than a single synchronised price reading.
The theft struck a market already facing pressure from higher US interest rates and weaker demand from exchange-traded fund buyers, analysts told Reuters, as reported by Al Jazeera. The hack therefore compounded existing weakness rather than accounting for every part of the decline.
For Binance, the immediate tests are whether it can restore withdrawals safely, fulfil its compensation pledge and explain how unauthorised transfers passed through its controls. For investigators, tracing the remaining assets is only part of the task: preventing their further movement and securing their return remain separate, unresolved challenges.
