Binance Halts Withdrawals After Hackers Take a Record $6.3 Billion

Binance says it has set aside $6.34 billion of its own money to cover every loss, and about $3 billion is already frozen.

In a single transaction on Thursday, a Binance hot wallet sent its entire balance to an address the attacker controlled, according to a TRM Labs analysis cited by The Hacker News. That one transfer carried off 167,464 ether and 1.615 billion USDT, a stablecoin pegged to the dollar.

Binance, the world's largest crypto exchange, put the total damage at about $6.3 billion and suspended withdrawals, the Financial Times reported in a story Ars Technica republished. It says roughly $3 billion of the affected assets has been frozen. TRM called it the largest crypto theft on record. The old mark was the roughly $1.5 billion North Korean hackers took from the exchange Bybit last year.

Binance's first account started with a laptop. The company said a DevOps engineer's machine was compromised, letting an intruder reach a service container and push through withdrawals nobody had authorized, The Verge reported. By Friday, Binance said its investigation had turned up more points of breach.

Co-CEO Richard Teng pushed back on the simple version. The attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," he wrote on X.

TRM's reconstruction shows why. Each wallet numbers its outgoing transactions in order, and a signed instruction is valid only at the number it was written for. Binance's hot wallet pays out customer withdrawals all day, so that number keeps climbing. At 20:20 UTC Thursday, the attacker submitted 50 pre-signed authorizations covering 50 numbers in a row, betting that one would line up. One did.

Three minutes and 24 seconds later, TRM said, the operator told the wallet to empty itself. The firm said preparation had started at least 36 hours earlier, and The Verge, citing TRM, reported that most of the theft happened within about 20 minutes.

Binance said it found no evidence that its wallets' private keys had leaked. Elliptic, another blockchain analytics firm, said the attacker appears to have gotten Binance's own systems to sign transactions for it. In the Bybit case, Elliptic said, the way in was a developer's computer at a wallet-software provider. In both cases, the firm said, the cryptography held up, and the people and infrastructure around it didn't.

TRM and Chainalysis both tie the theft to TraderTraitor, a North Korean hacking unit. Chainalysis said it saw the stolen funds mixing with money from last month's Bitget exploit, which the FT put at nearly $390 million. Binance hasn't said who did it, The Verge noted. Elliptic sees similar tradecraft but urged caution, saying the thief held the stolen USDT for 37 minutes on Ethereum, slower than North Korean crews usually move.

That delay mattered because stablecoin issuers can lock their tokens in place. Tether's chief executive, Paolo Ardoino, said about $1.5 billion of its USDT was locked, and Circle's Jeremy Allaire put his company's USDC freeze at $800 million, the Financial Times reported. But Elliptic said the attacker had already moved roughly $3.3 billion into assets that can't be frozen, such as ether and bitcoin, and was working to cash them out.

Binance says customers won't pay for any of it. It has set aside more than $6.34 billion of company funds, $5 billion of it already held in the exact tokens that were taken, and it's buying the rest. As of a mid-October update, its emergency fund for users held about $1 billion in bitcoin, the FT reported; The Verge put the fund at about $1.3 billion.

Founder Changpeng Zhao stepped down as CEO after pleading guilty to charges over weak anti-money-laundering controls and was pardoned by President Donald Trump last year. He did the math in public. He put the remaining hole at about $2 billion and pointed out that Binance owns more than $1 billion in SpaceX shares. "Remaining gap is (still painful, but) manageable," he wrote on X.

Meanwhile, customers are waiting for withdrawals to reopen. Co-CEO Yi He wrote on X early Friday that Binance expected to start allowing them again "in the next 48 hours." Fully restocking the stolen tokens could take longer, the company said, because some of them trade too thinly to buy in a hurry.

Source: arstechnica.com, retrieved October 30, 2026. Other sources: thehackernews.com, The Verge.