$6.3 Billion Gone: What the Binance Hack Tells You About Where to Keep Your Crypto

Binance says it has found no evidence that any wallet key leaked. It also says that about $6.3 billion in crypto left the exchange on the night of October 29. According to TRM Labs most of it moved in roughly twenty minutes, and the analytics firm Bitquery counts 17 hot wallets emptied in just under four hours.

This story was written with the assistance of an AI writing program.

That makes it the largest crypto theft on record, more than four times the $1.5 billion taken from Bybit in February 2025. On Saturday the FBI said North Korea was behind it and named the same group it blamed for Bybit, TraderTraitor. Bitcoin slid to about $76,300 at the low and was back near $78,000 on Monday. Binance says it will cover every loss itself, and it began reopening withdrawals on Sunday.

Binance has not published a technical post-mortem yet, and most of what is known so far comes from outside analysts, mainly TRM Labs, Elliptic and Chainalysis.

How the money got out

Binance's own account is short. It says a DevOps engineer's laptop may have been the way in, and that the attacker went from there to a service container and submitted the unauthorized withdrawals. Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions," and Binance later said investigators had found additional points of breach.

TRM Labs has pieced together what the chains show, as The Hacker News summarized . The attacker started at least 36 hours earlier. Three small withdrawals from the Tornado Cash mixer funded an operator wallet on October 28, and the attack code was tested on three wallets a few hours before the theft. At 20:20 UTC on October 29 the operator sent a single transaction carrying 50 authorizations. Binance's own hot wallet had signed each one, and each pointed to a contract that took orders only from the attacker. Three minutes and 24 seconds later the operator told the hot wallet to send out everything it held, which came to 167,464 ETH, 63 other tokens and 1.615 billion USDT.

The mechanism leans on an Ethereum feature called EIP-7702, live since last year's Pectra upgrade, which lets an ordinary wallet lend its powers to a program for a while. Teng said, as Decrypt reported , that the attacker used a delegation of that kind to get around Binance's normal approval controls, and a self-destruct mechanism to wipe its tools afterward. Elliptic's reading is that the attacker never took a key and got Binance's own systems to sign for it. One developer analysis argues that switching off EIP-7702 alone would not have stopped the transfers on the other nine chains.

That is how "no key leaked" and "six billion gone" can both be true. A key signs only when something asks it to, and exchanges wrap that request in rules about who may ask and for how much. Whoever controls the machine that asks can make the key work for them. Binance has not said how its own rules were arranged. Bybit lost its money in 2025 in much the same place, in the tooling around the signing and not in the cryptography, as it was widely reported at the time.

Nobody yet knows how the laptop was compromised or which authorization Binance revoked. A post that went viral over the weekend claimed an engineer had been romantically involved with a North Korean spy. X's Community Notes flagged it as unverified and false, and nothing in Binance's statements supports it.

Who took it, and what is gone for good

The FBI said the stolen assets were being converted mostly into Ethereum and that it expects more laundering in stages, according to Al Jazeera . TRM Labs attributes the attack to TraderTraitor with high confidence and Chainalysis agrees. Elliptic is more careful, pointing to differences in laundering speed and the lack of a root cause.

TRM's breakdown, reported by Coinpaper , includes about 233 million XRP worth roughly $296 million and 18,270 BTC worth roughly $1.47 billion, on top of the Ether and stablecoins, spread over ten blockchains. The XRP went first, between 20:05 and 20:09 UTC.

Within hours about $2.7 billion was frozen. Tether froze more than 1.567 billion USDT and Circle froze 800 million USDC, and with Ripple and World Liberty Financial the stablecoin freezes came to about $2.67 billion. Arbitrum's Security Council froze another $30.5 million. Binance puts the total at about $3 billion, and Elliptic at $2.84 billion.

A stablecoin has a company behind it, and the company can block addresses. Bitcoin and Ether have nobody behind them. So the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion by The Hacker News' count and $3.33 billion across roughly 43 wallets by Elliptic's. The two estimates differ because the thief keeps moving funds and each firm drew its line at a different hour. The part of crypto with an administrator could be reversed within a day. The part without one could not.

What Binance paid

Before the hack the emergency fund, SAFU, held about $1 billion, roughly a sixth of the loss. Binance set aside more than $6.34 billion, drawing on part of SAFU, part of its futures insurance fund, a Bitcoin reserve and its corporate treasury, and about $5 billion of that was already sitting in the exact tokens that were taken. By Friday it said 80% of the stolen assets had been replaced, by Saturday 90% and by Sunday 95%. The rest is in less liquid tokens that it is still buying, and it plans to top SAFU back up to about $1 billion, according to the Feld Thoughts update .

Teng said customer funds were untouched because the stolen coins sat in Binance's own hot wallet. For a customer the difference matters less than it sounds. A balance on an exchange is a line in the company's books, backed by coins in wallets the company controls, and if those coins disappear the line is worth whatever the company can and will refill. Binance had the money and spent it within days. When FTX failed in 2022 there was nothing to refill with.

Two days without withdrawals

Binance paused deposits and withdrawals in the early hours of Friday and began reopening them on Sunday, Bitcoin first and then 14 other networks. The first phase covered 15 assets, and critics noted that only a small part of the 252 listed assets was open. In the first nine and a half hours $4.65 billion went out and $1.01 billion came in, a net outflow of about $3.64 billion that Binance puts at 2.1% of its $171 billion in assets, per The Block . The ten next-largest exchanges took in only about $368 million between them, so most of that money did not simply hop to a rival. Binance called the flow "stabilising." Larger totals in circulation, such as $16 billion, mix withdrawals with falling prices and the theft itself.

Binance's reserve snapshot of October 31 showed Bitcoin, Ether, XRP and seven other assets fully backed, though it predates the withdrawal wave and some of the wallets emptied in the hack were reportedly among those listed. The full zero-knowledge proof, delayed because it takes 40 to 50 hours to compute, is due on Tuesday, November 3 UTC. It lets each customer check that their balance is counted in what Binance owes. Whether the coins are there is a different check, and a clean result on one says little about the other.

Where to keep your coins

Customers who wanted out on Friday could not leave for about two days. On an exchange the risk is somebody else's failure, whether a hack, a freeze or a pause. In your own wallet the risk is yours, in the form of phishing or a lost recovery phrase. Neither is free.

Money you trade with can sit on an exchange, but only as much as you could live without for a week. Money you plan to hold for years is better off in a hardware wallet, with the recovery phrase written on paper or metal and kept offline in two places, and never typed into a website or an app. Try the setup with a small amount first. Larger sums can be split across devices or providers, and serious amounts across a multi-signature wallet, where no single laptop or person can move the money.

On the exchange itself, an authenticator app or hardware key beats SMS, and a withdrawal address allowlist means a stolen login cannot send funds somewhere new right away. Fake compensation pages follow every big hack, and Binance has warned customers about scams. It says customer funds are covered, so nobody needs to submit anything to a stranger.

Running your own server is no cure either. On November 1 and 2 the BTCPay Server project warned that attackers had gained administrator access to older self-hosted installations, version 2.4.1 or earlier, and drained the Bitcoin hot wallets attached to them, according to crypto.news . It has not said how much was taken or how the attackers got in. Its advice is to update to 2.4.7 and to move anything beyond a small working balance into cold storage.

Notes and sources

Facts are as of the afternoon of November 2, 2026, Asia time, before Binance's full proof of reserves and technical post-mortem. Figures such as the amount frozen or still held by the attacker differ between sources and keep changing. Nothing here is financial advice.