Most of the money left in about twenty minutes. Starting at 20:05 UTC on October 29, an attacker drained roughly $6.36 billion from Binance wallets spread across ten blockchains, according to TRM Labs’ technical analysis. TRM calls it the largest crypto theft on record, about four times the size of the $1.5 billion Bybit hack in February 2025.

Binance, which AP describes as the world’s largest crypto exchange, put the damage at about $6.3 billion and froze all deposits and withdrawals while it worked with law enforcement. Four days later, the exchange is reopening in phases, the FBI has named a culprit, and the harder questions about how this happened are still open.

What Binance Says Happened

Binance’s early account pointed to a compromised laptop belonging to a DevOps engineer. That machine, the company said, gave an attacker a way into a service container that could submit unauthorized withdrawals. It reported no evidence that any wallet private key had leaked.

That explanation has already grown. Binance later said investigators had found additional points of breach beyond the laptop, without saying what they were. Co-CEO Richard Teng said the attacker did not simply borrow one engineer’s permissions. No root cause has been published, and Binance has said its investigation has not attributed responsibility to any individual.

What the Blockchain Shows

TRM’s analysis suggests this was patient work. The attacker’s wallet received three small withdrawals from Tornado Cash on the morning of October 28, at least 36 hours before the main theft. That staging pattern is a signature TRM says it has seen before.

On Ethereum, the attacker used an EIP-7702 delegation, backed by 50 pre-signed authorizations, to turn a Binance hot wallet into a sweeper under the attacker’s control. On the other nine chains, Binance wallets simply sent funds through ordinary signed transfers. TRM reads that as evidence that Binance’s hot-wallet signing infrastructure itself was compromised, rather than individual keys being stolen.

Blockchain analytics firm Elliptic reached a similar conclusion: the attacker appears to have gotten Binance’s own systems to sign the transactions. Elliptic’s framing is worth underlining. As with Bybit, it was the infrastructure and the people around the wallets that failed, not the cryptography.

The North Korea Question

TRM attributed the attack to North Korea’s TraderTraitor group and said it made that judgment with high confidence. Chainalysis CEO Jonathan Levin said the group likely carried it out. On October 31, the FBI made it official, stating that North Korea stole more than $6 billion on or about October 29. The FBI, Secret Service and IRS-CI asked crypto services to block transactions tied to a published list of addresses. BleepingComputer counts 628 of them: 608 on Ethereum, 19 on Bitcoin and one on Solana.

Elliptic also assessed that North Korea-linked actors were involved, but urged caution. The speed and method of the laundering differ from past cases, it noted, and without a confirmed root cause, certainty is premature. Binance itself has not named an attacker.

For Cynthia Kaiser, a former deputy director of the FBI’s Cyber Division, the attribution changes how the theft should be understood. She called it a national security issue, not just a financial crime.

There is also a possible link to an earlier incident. Chainalysis and Elliptic both say funds from a Bitget exploit in October, reported at about $387 million or $388 million depending on the source, were sent to the same Ethereum address as Binance funds.

Freezes, Recovery and Reopening

The scale of the theft was matched by an unusually fast response from stablecoin issuers. TRM counts about $2.7 billion frozen, including roughly 1.77 billion USDT from Tether, about 825 million USDC from Circle, and smaller amounts of RLUSD and USD1. Arbitrum’s Security Council froze about $30 million in ETH and ARB. Elliptic counts $2.84 billion frozen, while Binance says about $3 billion.

Not everything could be reached. TRM estimates around $2.4 billion sits beyond any issuer’s power to freeze, including more than 420,000 ETH and 18,270 BTC. Elliptic puts the figure at about $3.33 billion across roughly 43 addresses. These totals differ because tracing is ongoing and prices keep moving.

Meanwhile, Binance moved to make users whole. It said it had replenished 80% of affected assets by Friday, 90% by Saturday and about 95% by November 1. Teng said, “Our users will not bear the financial impact of this incident.” Founder Changpeng Zhao said, “As a shareholder, I expect all user funds will be fully covered.” The remaining 5% covers less-liquid tokens that are harder to buy.

Withdrawals restarted in phases at 06:00 UTC on November 1, and all 15 networks and assets in the first phase were live by 12:36 UTC. The first day tested confidence. Between 06:00 and 15:30 UTC, Binance processed $4.649 billion in withdrawals against $1.01 billion in deposits, a net outflow of about $3.64 billion. That is 2.1% of the $171 billion in assets shown in its latest proof-of-reserves data as of October 28.

Markets, Regulators and an Uncomfortable Debate

Bitcoin fell to about $77,000, and shares of Coinbase and Robinhood slid on Friday. Fundstrat’s Sean Farrell said the hack does not currently appear to create meaningful solvency risk for Binance.

The policy fallout has begun. CFTC Chair Michael Selig said the hack “proves our exact point” about offshore exchanges, arguing it supports the agency’s push for a federal registration option. The CFTC proposed a framework for exchange registration and leveraged retail crypto trading on October 5.

A quieter argument concerns freezing power itself. Experts are asking why issuers acted so quickly here, when Circle was criticized for not freezing USDC during April’s roughly $290 million Drift hack. Tether CEO Paolo Ardoino said protecting the industry and its partners was his company’s main priority, which sidesteps the question of consistency. How much power stablecoin issuers should wield, and when, is now a live issue.

What to Watch Next

Binance has promised a post-incident report once its investigation concludes, and it says details of the next withdrawal phase are coming soon. That report matters more than any single dollar figure. It will say whether the “DevOps laptop” was the entry point or only the first thread, and whether the weakness was one engineer’s machine or the way the exchange approves transactions.

On the money, TRM expects the attacker’s next stage to rely on cross-bridges, swap services and OTC brokers, while the FBI expects conversion through DeFi and instant-swap services. Roughly $2.4 billion or more is still in the attacker’s hands, and how much of it can be traced, blocked or recovered will define whether this theft ends as a record loss or as a record success for a state-backed hacking program.