Hackers drained about $6.36 billion from Binance wallets on Thursday 29 October, most of it within roughly 20 minutes, according to blockchain intelligence firm TRM Labs, as reported by the Associated Press. On Saturday 31 October the FBI attributed the theft to North Korea's TraderTraitor group, CoinDesk reported, and when withdrawals reopened on Sunday 1 November customers took out a net $3.64 billion in the first 9.5 hours, according to figures Binance published.
Financial analyst Ruslan Averin notes that the size of the theft matters less for ordinary holders than what followed it: Binance says it has already replaced about 95% of the stolen assets from its own funds, while bitcoin closed October with its worst October performance since 2014.
What happened on Thursday 29 October
TRM Labs said the funds left Binance across ten blockchains, AP reported. Binance put the loss at about $6.3 billion. Jonathan Levin, co-founder and chief executive of Chainalysis, put it slightly higher at $6.4 billion, CoinDesk reported. Either way it is the largest crypto theft on record, more than four times the roughly $1.5 billion taken from Bybit in February 2025, according to Nextgov/FCW.
By asset, TRM Labs' initial findings put about $3.79 billion of the stolen funds in Ethereum and $1.47 billion in bitcoin, ITPro reported. CoinDesk counted 18,270 BTC taken, citing on-chain records from mempool.space.
The mechanism, per Binance's preliminary investigation as summarised by Nextgov/FCW: the breach began with a compromised laptop belonging to an engineer working on Binance's software and operations. The attacker reached an internal service and submitted withdrawals without authorisation from wallets that handle assets across several networks. A later review found additional "points of breach", Binance said, according to AP. The exchange said it found no evidence that wallet private keys had leaked.
The FBI and North Korea
TRM Labs attributed the attack "with high confidence" to TraderTraitor, a North Korean state-backed unit, AP reported. Chainalysis' Levin said the hack was likely the same group's work.
On Friday 30 October the FBI said only that it was working with public and private partners and did not name a culprit, Nextgov/FCW reported. That changed on Saturday 31 October. The FBI, the US Secret Service and IRS Criminal Investigation attributed the theft to TraderTraitor and asked node operators, instant exchanges, DeFi services and other virtual asset providers to block transactions linked to the laundering addresses, according to CoinDesk. The list covered more than 600 Ethereum addresses, just under 20 bitcoin addresses and one Solana address.
TraderTraitor is the same unit the FBI blamed for the Bybit theft in 2025. US intelligence assessed in 2026 that Pyongyang nets at least $1 billion a year from crypto heists and other financial crimes, Nextgov/FCW reported.
Who covers the losses: SAFU and company money
Binance has said from the start that customers will not bear the loss. By Saturday 31 October it said it had set aside more than $6.34 billion, including $5 billion already held in the affected cryptocurrencies, CoinDesk reported. It said it had replaced 90% of the stolen assets on Saturday and about 95% on Sunday 1 November, using company funds including the Secure Asset Fund for Users (SAFU), its emergency reserve.
The remaining 5% is in less liquid tokens, which Binance said it was buying through market and over-the-counter channels, CoinDesk reported.
About $3 billion of the stolen assets has been frozen, Binance said, according to AP. Most of the frozen part is in stablecoins such as USDT and USDC, which issuers can block. CoinDesk put stablecoin freezes at more than $2.4 billion. Bitcoin and ether cannot be frozen in the same way.
Withdrawals reopen: $4.65 billion out, $1.01 billion in
Binance suspended withdrawals on Friday 30 October; deposits were not affected, AP reported. The pause lasted about 45 hours. Phase one reopened at 06:00 UTC on Sunday 1 November for bitcoin, ether, USDT, USDC, BNB and XRP, a Binance spokesperson told CoinDesk.
In the first 9.5 hours Binance processed $4.65 billion of withdrawals against $1.01 billion of deposits, a net outflow of $3.64 billion, according to the exchange's own figures reported by CoinDesk. DefiLlama data showed more than $6 billion leaving Binance-linked wallets over 24 hours. That figure can include transfers between wallets the exchange controls. Against the $171 billion in assets Binance reported before the attack, $6 billion is about 3.6%.
Binance also said its balances in ten assets, including BTC, ETH and USDT, are fully backed, and promised a full proof-of-reserves report, CoinDesk reported. No date was given.
Bitcoin's worst October since 2014
Bitcoin closed on Saturday 31 October at $77,434.75, down 7.3% from its 30 September close of $83,553.85, according to CoinMarketCap data published on Yahoo Finance. That is the weakest October since 2014, when the same data show a 12.7% loss, and the second losing October in a row after a 3.9% decline in 2025.
It is not the year's worst month. On the same data, bitcoin lost 20.4% in June 2026. But October is historically bitcoin's strongest month, which is why the second red October in a row stands out.
The hack day did most of the damage. Bitcoin closed at $81,267.59 on Wednesday 28 October and at $77,775.11 on Thursday 29 October, a 4.3% drop, per the same data. It closed on Sunday 1 November at $78,248.45.
US spot bitcoin ETFs lost a net $643.3 million on Friday 30 October, the biggest one-day outflow since 25 June, CoinDesk reported, citing SoSoValue. BlackRock's IBIT accounted for $233.7 million and Fidelity's FBTC for $201.4 million. For October as a whole, the funds posted $515 million of net outflows, ending a two-month inflow streak, according to SoSoValue data cited by CoinDesk.
What a holder on an exchange can check now
For readers in Ukraine and elsewhere who keep crypto on a centralised exchange, these are security settings, not trading advice.
- Two-factor authentication. Use an authenticator app or a hardware security key or passkey rather than SMS codes, which can be intercepted through a SIM swap.
- Withdrawal whitelist. Most large exchanges, Binance included, let users restrict withdrawals to pre-approved addresses.
- Anti-phishing code and API keys. Set an anti-phishing code so genuine exchange emails carry it. Delete unused API keys and never give a trading bot's key withdrawal rights.
- Ignore "compensation" messages. Binance says it is covering losses itself. Any message asking users to log in through a link, or "verify" a wallet to receive a refund, is a phishing attempt. Check only the exchange's official site and app.
- Self-custody basics. A hardware wallet keeps keys off the exchange. The recovery phrase belongs on paper or metal, offline, never in a photo or cloud note. A small test transaction before moving a large amount catches address mistakes.
- Records. Keep withdrawal and deposit histories. Ukraine still has no dedicated crypto tax regime, which is not the same as no tax; see the crypto tax guide for Ukraine.
Self-custody removes exchange risk but adds personal risk: a lost recovery phrase cannot be restored by anyone.
What to watch next
- Binance's next withdrawal phases. Remaining networks reopen only after each passes security checks, the exchange said. No timetable was given.
- The proof-of-reserves report. Binance has promised a full report; its numbers will show how much of the $6.34 billion came from SAFU and how much from company funds.
- Tuesday 3 November: US midterm elections. Control of Congress shapes crypto market-structure legislation; see the Clarity Act and bitcoin and what markets price into the vote.
- Friday 6 November: US October jobs report, the week's main macro release.
- Laundering and freezes. FBI address lists and stablecoin freezes decide how much of the roughly half of the loot that is not frozen can still be stopped.
- ETF flows. Daily spot bitcoin ETF data from SoSoValue and Farside show whether Friday's $643.3 million outflow was a one-off.
Related: Bitcoin before the Clarity Act vote, Bitcoin at $65,000 and the 2026 bear market and crypto tax in Ukraine.