27 Million Dollars a Minute: Reading the Binance Hack Against the Tape

Bitcoin was quoted at 77,232.43 dollars in our snapshot at 00:44 UTC on 31 October, up 0.04 percent on the previous close and 67 percent of the way through its daily range. Nvidia printed 204.64, down 4.22 percent, at 46 percent of range. Gold futures stood at 3,884.90, down 3.63 percent and at 4 percent of their range, close to the day’s low. The DAX was 0.85 percent weaker at 25,818.21, 16 percent of range. KWEB traded at 22.74, 0.22 percent lower, near the bottom of its range at 18 percent. Read as a single picture, that is money stepping back from gold and from growth equity while the largest crypto asset sits almost exactly where it started. Our regime reading for the session is trend falling, level 3.63, and the busiest signal channel on 30 October was central banks, with two events.

Now put the arithmetic next to that picture. Binance’s own withdrawal system signed away 6.3 billion dollars (5.6 billion euros) from 17 of its hot wallets between 21:04 on Thursday night and 00:56 CET on Friday, according to Bitquery data cited in the reporting (Euronews). [1] That window is 232 minutes. Divide one number by the other and the attacker moved roughly 27 million dollars a minute. Our simulation book, for what it is worth, finished at 3,975.87 dollars with 2,033.42 in cash and took no position in the crypto complex, logging a WATCH on KWEB. That is a description of our own process, not a recommendation.

The reporting describes the incident as the biggest crypto hack in history, with figures that dwarf earlier episodes: Bybit at 1.5 billion dollars (1.39 billion euros), Poly Network at 610 million dollars (545 million euros), Ronin Network at 540 million dollars (482 million euros) (Euronews). [1] The BBC, citing the same Bybit episode, puts it at 1.5 billion dollars (1.1 billion pounds) Bitcoin, at the moment we measured, had barely moved.

What actually happened

Binance is the world’s largest cryptocurrency exchange by trading volume, founded in China in 2017, with hundreds of millions of registered users (BBC). The company says it controls roughly 35% of total crypto market share (Euronews). [1] Like a traditional exchange it holds customer coins in wallets it controls and processes withdrawals from a small number of those wallets that stay online continuously. Binance.com, the global centralised exchange, was the target; Binance.us, which serves US residents, said it was not affected (BBC).

The entry point, per Binance’s initial account, was an engineer’s machine. Co-chief executive Richard Teng: “Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorised withdrawal transactions.” He added that it “was not a simple ‘one-click’ action” but a “more complex attack process” (BBC). The company stated there was no evidence of any wallet private key leak and that investigators had since found additional points of breach.

The sequence published by Euronews traces the night in steps rather than one collapse. At 22:29 CET the company said it was investigating reports of a potential security issue and told customers their funds were “completely safe”, while warning about scams. At 00:06 CET it suspended Binance Alpha trading. At 00:22 CET it acknowledged that assets were affected and put the frozen figure at 2.54 billion dollars (2.26 billion euros). At 01:13 CET it committed to “cover all losses” and suspended deposits and withdrawals. By 01:52 CET the frozen figure had risen to 3 billion dollars (2.68 billion euros). At 03:25 CET the total impact was disclosed: around 6.3 billion dollars (5.6 billion euros). At 09:47 CET the company said withdrawal services were on track to resume within 45 hours. At 11:55 CET it said it had begun recovering affected assets and had reserved 6.34 billion dollars (5.66 billion euros) to cover the incident. On X, the company wrote: “We will weather this storm.”

Where the money actually stopped

The first channel is familiar counterparty risk. Centralised exchanges concentrate custody, and custody concentrates operational risk. Raghu Nandakumara of Illumio told the BBC that early reports suggest the compromised laptop, which already carried sufficient privileges, became “the attacker’s route straight into production, and from there to the wallets”. Dr Clive Summerfield of the biometrics firm FARx framed the same weakness without jargon: “You can build a vault with mathematical firewalls, but if the individual holding the keys can be duped, the vault is opened.” Teng also said the attackers used sophisticated methods to hide their tracks, including a “self-destruct mechanism”.

The second channel is where this episode differs from a plain theft. Stablecoin issuers Tether, Circle and Arbitrum, together with four smaller issuers, froze 2.7 billion dollars (2.4 billion euros) to stop the funds leaving, according to Bitquery — roughly 43 percent of the total by our division. Binance separately put the total frozen at 3 billion dollars. The attacker swapped another 729 million dollars of stablecoins before those freezes bit, and still held about 3.1 billion dollars, mostly in Ether and Bitcoin, spread across new addresses on nine blockchains, with Ethereum, Bitcoin and TRON hardest hit. Private issuers, not regulators and not courts, acted as the circuit breaker. That is a mechanism worth watching in its own right: in our reading, the ability to freeze balances at the token level has become a lever that can be pulled without a court order, and it sits with a handful of companies.

The third channel is balance sheet. Binance says it will absorb the loss from company funds, with the 6.34 billion dollars reserved, an updated Proof of Reserves promised after remediation and a detailed technical post-mortem to follow verification. Reporting also notes a SAFU fund worth more than 1 billion dollars and holdings of more than 1 billion dollars in SpaceX shares, cited by founder Changpeng Zhao (Mashable). Loss coverage of that order is why the flat bitcoin print is not obviously irrational.

Who wins, who loses, who decides

Customers are the nominal losers and, on the company’s stated terms, the covered party. Binance’s shareholders carry the actual hit. The security and analytics firms gain standing: TRM Labs attributed the attack to the North Korean group TraderTraitor, stating “Based on robust on- and off-chain intelligence, we make this judgment with high confidence”, and noted that the FBI named the same cluster for the 1.5 billion dollar Bybit hack in February 2025.

That attribution is a vendor judgement, and the gap matters. Binance co-chief executive Richard Teng said the company’s investigation “has not attributed responsibility to any individual”, and the company has not directly responded to BBC queries about potential North Korean involvement. North Korea has consistently denied involvement in such attacks. Edward Howell of the University of Oxford told the BBC that Pyongyang “has a long history of using cyber warfare to extract cash” and that “about 40 - 50% of North Korea’s weapons of mass destruction programmes are funded by cyber and crypto-currency warfare”. The motive model is plausible; the attribution remains a vendor judgement, not a legal finding.

What we watch next

Four items. First, the technical post-mortem and the updated Proof of Reserves, because the disclosed figure moved from 2.54 to 3 billion dollars within ninety minutes and to 6.3 billion dollars by 03:25 CET, and totals of that kind move again before they settle. Second, whether withdrawals actually resume inside the stated 45 hours. Third, whether the roughly 3.1 billion dollars still held by the attacker moves across those nine blockchains or gets traced and frozen, which is where law enforcement and blockchain intelligence partners are pointed. Fourth, whether any regulator treats privileged third-party access to withdrawal infrastructure as a supervisory issue rather than a company incident.

Our own data carry one caveat: the snapshot we quote is a single timestamp, taken while the incident was still unfolding. It shows a market that shrugged at a 6.3 billion dollar theft, and a shrug is information, not proof. If the remaining funds are laundered cleanly or if a second exchange reports a similar breach, the same tape could read very differently within days.

Sources

1. Euronews — Quote source (original article)

Mentioned organisations (context, not sources)

• Nvidia — Organisation (homepage)
• Binance — Organisation (homepage)
• Bitquery — Organisation (homepage)
• Euronews — Organisation (homepage)
• Bybit — Organisation (homepage)
• Poly Network — Organisation (homepage)
• Ronin Network — Organisation (homepage)
• BBC — Organisation (homepage)
• Binance.US — Organisation (homepage)
• Illumio — Organisation (homepage)