Binance has paused withdrawals after attackers moved about $6.3 billion out of its wallets on Thursday, October 29. The exchange says it will cover every loss from its SAFU user-protection fund and its own money, and that deposits are working normally. Binance.US, the separately run American exchange, says it was not affected.
What Binance has said
In its incident announcement, last updated Friday, Binance puts the total impact at about $6.3 billion and says roughly $3 billion of it has been frozen on blockchains so far. Its first finding was that the attack may have started with a DevOps engineer's compromised laptop, which gave the attacker access to a service container used to submit unauthorized withdrawals. Binance says it has seen no evidence that wallet private keys leaked, has revoked the affected address authorization and is working with law enforcement.
A later investigation update on the company's X account said follow-up work had "uncovered additional points of breach" beyond the laptop in what Binance called a complex attack. The company has not named them or published a root cause, and it has not given a date for withdrawals to restart.
Where the money went
TRM Labs, a blockchain analytics firm, traced about $6.36 billion leaving Binance across ten blockchains, most of it in roughly 20 minutes starting at 1:05 p.m. Pacific on Thursday. Ethereum accounted for about $3.79 billion and Bitcoin for 18,270 BTC, worth about $1.47 billion. TRM attributes the attack with high confidence to TraderTraitor, a North Korean hacking group, and calls it the largest crypto theft on record. In February 2025 the FBI blamed TraderTraitor for the $1.5 billion Bybit theft, the previous record.
Stablecoin issuers froze a large share within hours, according to TRM's tally as of 5:30 p.m. Pacific Thursday:
- Tether: about 1.77 billion USDT
- Circle: about 825 million USDC, frozen in coordination with law enforcement
- Ripple: 40.5 million RLUSD
- World Liberty Financial: 27.8 million USD1
- Arbitrum Security Council: about $30 million in ETH and ARB
The attacker still held more than 420,000 ETH and the 18,270 BTC, about $2.4 billion together, and had begun swapping and borrowing against some of the stolen stablecoins, TRM found.
What it means for US customers
Binance.US said Thursday that the Binance.com incident did not affect it, that it is a separate, independent platform and that its customers' funds and services are operating normally. Binance.com account holders can still make deposits, but cannot withdraw until Binance lifts the pause.
Binance tells customers to trust only its official channels for news about the incident, and the FBI takes tips about TraderTraitor activity through ic3.gov or its field offices.
