Binance hit by $6.3B hack — reportedly the largest in crypto history
Hackers drained roughly $6.3 billion from Binance overnight on 30 October after compromising a DevOps engineer's laptop. The exchange paused withdrawals, says it has reserved $6.34B to cover user losses, and investigators are pointing to North Korea.
Overnight on 30 October, attackers breached Binance — the world’s largest crypto exchange — and moved billions of dollars in digital assets to addresses under their control. According to the exchange’s own early estimate, relayed by RBC, the damage may exceed $6 billion, with a working figure of around $6.3 billion. If those numbers hold, it would be the largest hack in the history of the industry.
How the attack happened
Per the preliminary investigation cited by RBC, the intrusion did not start with broken cryptography. Attackers are said to have compromised the personal laptop of one of Binance’s DevOps engineers, then used that foothold to reach an internal service container and initiate unauthorized withdrawal transactions.
Crucially, Binance reported no evidence that the private keys to its wallets were leaked. That distinction matters: this looks less like a cryptographic break and more like an operational-security failure — a single compromised endpoint escalating into access to systems that could sign and push transactions. For anyone evaluating where their coins live, it is a reminder that an exchange’s weakest link is often human and infrastructural, not mathematical. (If you’re weighing that trade-off, our primer on self-custody and our checklist for how to evaluate a crypto exchange are both relevant here.)
Binance’s response
The exchange said its teams were working around the clock to contain the incident. The immediate steps, according to the reporting:
- All deposits and withdrawals were temporarily suspended while the platform investigated.
- Binance said it revoked the authorization of the affected address.
- Users were urged to stay alert and ignore suspicious links, messages and requests for account details — the kind of phishing wave that typically follows a high-profile breach.
Binance later clarified that deposits remained unaffected and operational, while withdrawals stayed paused “while the team completes the security update of the withdrawal service and the associated addresses,” per a Binance News post cited by RBC. The exchange said it expected to resume withdrawals within roughly 48 hours, and promised a detailed technical report once the investigation concludes, followed by refreshed Proof-of-Reserves data.
CEO Richard Teng said on the evening of 30 October that the withdrawal service was being restored but would not go live until it passed “rigorous testing,” and that a full report on assets would be published by Monday.
Covering the losses
Binance said it had set aside more than $6.34 billion of its own funds to make users whole. Of that, around $5 billion was already in hand in the same tokens affected by the attack, with the exchange buying the remainder on the open market and through OTC deals to replenish the shortfall in the relevant assets.
The company also said that, working with partners across the blockchain industry, it had managed to freeze roughly $3 billion of the stolen assets on-chain. Stablecoin issuers moved too: Tether (USDT) and Circle (USDC) reported freezing $1.7 billion in stolen funds.
Market reaction
The news hit prices immediately. Bitcoin fell more than 4% over 24 hours, dropping below $77,000, according to trading data cited by RBC. Ether slid 3–4% to a two-month low near $2,178. The move extends an already fragile stretch for crypto — context we covered when Bitcoin plunged below $81K amid a $974M liquidation wave. For how leverage and forced selling amplify shocks like this, see our guide to crypto market structure.
Reactions and attribution
Binance founder Changpeng “CZ” Zhao said the event “looks like a hack,” noted he no longer runs the exchange, and voiced confidence the company would fully cover user losses. “This is the largest hack in history,” said Aravind Srinivasan, head of OTC at market-maker GSR. Tesla and SpaceX chief Elon Musk reacted with a jab about software flaws — “Every day is a zero-day” — prompting CZ to ask him publicly to hold off on the trolling.
On 30 October, the US Secret Service said its investigators were working with private-sector partners, including Circle, to identify, freeze, trace and recover US funds stolen from Binance.
As for who was behind it: blockchain-analytics firm TRM Labs and Singapore-based cybersecurity company Pangolin Intelligence both said North Korea may be involved. TRM said it links the attack to TraderTraitor, an elite DPRK hacking unit, based on on-chain and off-chain evidence it rated as high-confidence. That remains an assessment, not a confirmed finding.
The bottom line
A compromised engineer’s laptop appears to have cascaded into a multi-billion-dollar drain at the industry’s biggest exchange, pausing withdrawals, knocking Bitcoin below $77,000 and — if the ~$6.3B figure holds — setting an unwanted record. Binance says it has reserved enough of its own capital to cover user losses and expects withdrawals back within 48 hours. The full technical report, and the refreshed Proof-of-Reserves that follows it, will be the real test of whether the exchange’s balance sheet absorbs the hit as cleanly as it claims.
News summary based on the reporting cited above. Details are preliminary and may be revised as the investigation continues. Crypto is highly volatile; this is general information, not financial advice.