Binance Lost $6.3 Billion in Twenty Minutes, and the Ledger Has Not Stopped Moving

Twenty Minutes, Six Billion Dollars

For most of the past decade, the size of a crypto theft was measured against one exchange’s balance sheet, and the numbers rose slowly enough to be absorbed. The record stood at $1.5 billion, set in February 2025 when attackers drained the exchange Bybit. Across the whole of 2025, hackers took $2.87 billion in nearly 150 separate attacks, a tally compiled by TRM Labs, a firm that analyses the blockchain — a shared digital ledger copied across many computers — for its 2026 Crypto Crime Report. Each of those figures was large enough to make headlines and small enough to be booked as a cost of doing business. That equilibrium broke late on Thursday, October 29, 2026. Binance, the largest cryptocurrency exchange in the world, suspended deposits and withdrawals and confirmed that attackers had moved roughly $6.3 billion out of its own wallets. The sum is more than four times the previous record. Two firms that trace stolen coins for a living describe it as the biggest crypto heist ever recorded. The bulk of the money left in about twenty minutes.

Binance’s first response was financial as much as technical. The company said it would cover all losses itself and told Al Jazeera that user funds were safe. The size of the constituency behind that promise deserves a moment: Binance reports more than 335 million users globally and trades $95 billion of digital assets and derivatives — contracts whose value is derived from an underlying asset — every day. A withdrawal freeze at an institution of that scale is not a glitch. It is a queue of customers told to wait, paired with a corporate pledge that the wait will be paid for by the company rather than by them. In crypto’s short history, that is exactly the pledge that has most often failed. The exchange said it was coordinating with law enforcement and expected to restore withdrawals within 45 hours.

The attribution — the act of identifying who carried out an attack — arrived quickly and from two directions at once. TRM Labs and Chainalysis, both based in the United States, traced the flows to TraderTraitor, a North Korean hacking unit tied to the Lazarus Group. TRM put its confidence in that assessment at “high confidence.” The Lazarus Group is not a loose network of freelancers: the United States Department of the Treasury sanctioned it in 2019, identifying it as controlled by North Korea’s primary intelligence bureau. The Council on Foreign Relations describes the group as compromising South Korean entities for espionage, disruption and destruction while also running cyberoperations for financial gain, crypto exchanges included. The FBI blamed the same unit for the Bybit theft in 2025.

Binance has been notably more cautious than the analysts, and that gap is one of the more instructive details in the case. “Our investigation has not attributed responsibility to any individual,” co-CEO Richard Teng wrote on X. [1] North Korea routinely denies involvement in hacking, a denial that settles nothing but belongs in the record. The distinction matters because naming a criminal gang and naming a state carry different consequences. A private theft can be worked out through insurers, lawyers and frozen addresses. A state theft becomes foreign policy, with all the bargaining and retaliation that implies.

Some of the money has already been stopped. About $3 billion has been frozen, including more than $2.3 billion by the stablecoin issuers Tether and Circle. Those firms issue tokens designed to hold a fixed value, and funds at flagged addresses were frozen. Binance has not said what has become of the remaining $3.3 billion. The company has warned that the $6.3 billion figure “may continue to increase” as tracing proceeds, which is a polite way of saying the final bill is not yet known. For a reader trying to hold the scale in mind, Ari Redbord, TRM’s global head of policy, offered a comparison: “What happened last night is the largest bank robbery in human history.” [1] He then supplied the sentence that turns a crime story into a security story: “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity.” His conclusion was blunt: “That makes this a global security issue, not just a crypto theft.”

A Sweeper Contract And A Hacked Laptop

The mechanics are documented in more detail than the politics. TRM Labs puts the total moved at approximately $6.36 billion, drained from Binance wallets spread across 10 separate blockchains, with most of it gone in roughly 20 minutes starting at about 4:05 p.m. Eastern Time on Thursday, after United States equity markets had closed. What matters more than the decimal is where the failure sat. The blockchains themselves were not broken. The attack targeted Binance’s own infrastructure: the servers, permissions and signing tools that stand between a customer’s instruction and a coin actually moving.

The first account Binance gave pointed at a laptop. The company said the breach may have begun with a compromised laptop belonging to one of its engineers — a DevOps engineer, in the more specific telling, an engineer who builds and runs the systems that keep software deployed — whose access may have let an attacker reach a service container, an isolated, packaged unit of software running on a server, and submit withdrawals the exchange never intended to authorise. By Friday that account had widened. Binance said further investigation had uncovered “additional points of breach,” and co-CEO Richard Teng described “a more complex attack process” that “did not simply use one engineer’s permissions.” The company also said it had found no evidence that any wallet’s private key — the digital password that controls a crypto wallet — had leaked. Attackers, meanwhile, used a self-destruct mechanism — code built to delete itself and its traces after use — to wipe their tooling and traces along the way.

The most technical stretch of the operation ran on Ethereum, the second-largest blockchain. In 2025, Ethereum introduced a feature known as EIP-7702, which lets an ordinary wallet temporarily execute smart-contract code — in plain terms, it allows a simple account to behave, for a while, like a small program. The attacker used 50 pre-signed authorisations — cryptographic permissions signed in advance, to be used later — to convert a Binance hot wallet into what TRM Labs called a “sweeper” contract, a piece of code whose only job is to move whatever arrives into an address someone else controls. A hot wallet, in this context, is a wallet kept connected to the internet so an exchange can process customer withdrawals quickly; the trade-off is precisely that it is reachable. Teng said that delegation “did not pass through our normal approval controls. TRM’s reading is that Ethereum itself was not at fault. What failed was the exchange’s signing infrastructure — the machinery that authorises a transfer in the first place.

Not everyone agrees on how deep the key compromise ran. Mark Karpeles, former head of the collapsed Tokyo exchange Mt Gox, told Reuters the attackers had probably accessed keys for at least two Binance wallets. That sits awkwardly beside the company’s statement that no private key leaked, and the contradiction has not been resolved in public. What is clear is that the entry point was human and organisational before it was cryptographic. A laptop, a container, a set of permissions that should not have added up to a withdrawal — no flaw in the underlying chains, no break in the maths that secures them.

Binance Lost $6.3 Billion in Twenty Minutes, and the Ledger Has Not Stopped Moving (Image 1)

Sean Foley, an expert in crypto markets at Macquarie University in Sydney, drew the structural lesson: “Any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange’s holdings, the larger a target it becomes.” [1] Insurance does little to soften it. Most crime- and cyber-insurance policies do not cover stolen cryptocurrency, and cover written specifically for crypto remains a niche product sold largely by specialist insurers. The loss therefore lands where the custody sits: on Binance’s own balance sheet and on the reserve it built for exactly this day.

What The Price Said Back

The market’s first verdict came within hours, severe but not panicked, and it steadied after the initial shock. Bitcoin fell to a six-week low of $76,368. Ether dropped more than 3 % to a two-month low of $2,178. Shares in the exchange Coinbase, which said it was unaffected by the breach, fell 4.8 %. Those three numbers together describe a market that repriced the sector rather than a single firm: if the largest and best-capitalised venue could be drained in twenty minutes, then every listed business whose revenue depends on trading volumes carries a discount it did not carry on Wednesday. The recovery afterwards was partial, which is how markets usually treat a shock whose full cost is still unknown.

The backdrop made the shock worse. Crypto had already been under pressure from higher United States interest rates and weaker demand from buyers of exchange-traded funds — the listed vehicles that let ordinary brokerage accounts hold Bitcoin without owning it directly. Both pressures predated the theft, which is why the sell-off read less as a verdict on Binance than as a market with no cushion left. Neither factor has anything to do with North Korea. Both were already in the price before the theft, which is why the fall looked less like a verdict on Binance and more like a market that had no cushion left.

The customer response was the part that could have turned a hack into a run. Investors pulled $3.64 billion from Binance over a nine-hour stretch on November 1. Volumes then fell back. “Our top priority right now is to ensure the environment is secure, after which users can withdraw their funds, and Binance can resume operations,” co-CEO Yi He wrote on X. Tim Sun, a senior researcher at HashKey Group in Hong Kong, judged the episode contained: “It has not yet triggered widespread panic or a massive, concentrated withdrawal.” He added that the damage to confidence would probably reach further than the stolen assets themselves, because questions about security change how market makers, institutions and ordinary investors size their positions. A run, in other words, can happen slowly, through allocation decisions rather than queue lengths.

On the other side of the ledger, Binance has been assembling the money to make its users whole. The company said it set aside more than $6.34 billion, about $5 billion of it already held in the exact tokens that were taken — Bitcoin, Ether, BNB, USDC and USDT — with the remainder being bought on the open market and over the counter, meaning through privately negotiated trades rather than on a public order book. Teng said roughly 95 percent of the affected assets had been replenished: “We’ve now replenished approximately 95 percent of the impacted assets, and our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users.” The comparison that stings is the company’s own safety net. The Secure Asset Fund for Users, created in 2018 and held entirely in Bitcoin, stood at $1 billion. The theft was more than six times that.

The operational promises are the ones customers can check. Binance said it would publish a complete proof of reserves by Monday — that is, a public attestation of what the exchange actually holds, address by address, so that outsiders can test the claim instead of trusting it. The company’s statements on deposits have not been perfectly consistent: an initial suspension of both deposits and withdrawals was later described as a pause on withdrawals, with deposits running normally. None of this is proof of bad faith. It is the ordinary fog of a firm handling a crisis in public, and it is the reason a published reserve report carries more weight than a press statement.

The motive behind the theft, if the attribution holds, is financial. North Korea denies involvement in crypto theft, but stolen coins have become a source of foreign currency for Pyongyang, helping to sustain an economy under United Nations sanctions and to fund a nuclear programme those sanctions were written to constrain. In December 2022, South Korea’s spy agency estimated that North Korean hackers had taken about 1.5 trillion won — roughly $1.1 billion — in crypto and other virtual assets over five years. The pattern is older than the coins: in 2016, members of the Lazarus Group tried to steal $1 billion from Bangladesh Bank by breaking into the international bank messaging network known as SWIFT. What changed is the speed. A transfer that once required a compromised terminal inside a bank now takes twenty minutes and crosses ten chains.

Binance’s own history is part of why this lands as a governance story, not only a crime story. Founder Changpeng Zhao, the Chinese-born Canadian billionaire who co-founded the company, pleaded guilty in 2023 to a felony linked to failing to prevent money laundering on the platform. President Donald Trump pardoned him in 2025. Asked about the heist by reporters on October 31, Trump was brief: “I’m not concerned.” He added: “We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to North Korea about it.” On October 12, he had said he might meet Kim Jong Un during a planned trip to Asia.

Sources

Binance Lost $6.3 Billion in Twenty Minutes, and the Ledger Has Not Stopped Moving (Image 2)

Aljazeera — Quote source (original article)