Blockchain analysis firm TRM Labs calls the Binance hack the largest crypto theft on record. About $6.36 billion left the exchange’s wallets on 29 October. Binance’s own estimate is $6.3 billion. It says customers’ funds are safe, and it has promised to cover every loss.
Close to $3 billion has been frozen, Binance said. Deposits still work, but withdrawals are paused. Bitcoin, ether and BNB all fell while the Binance hack was under way, and CoinGlass counted $1.67 billion of futures positions closed by force in a single day.
How much the Binance hack took, and from which chains
TRM traced every transfer from Binance wallets to the attacker across ten blockchains and valued each one at the price on the minute it moved. The total came to about $6.36 billion. At prices on 30 October the same coins are worth about $6.23 billion. That sits close to Binance’s own estimate.
Ethereum took the biggest share at roughly $3.79 billion. Next came bitcoin: 18,270 BTC, roughly $1.47 billion. Tron lost about $628 million. On the XRP Ledger it was 233.46 million XRP, about $296 million, and Solana gave up 970,500 SOL. Smaller amounts left Arbitrum, Optimism, Base, Avalanche and Polygon.
The first transfers TRM logged in the Binance hack were on the XRP Ledger, between 20:05 and 20:09 UTC. Most of the money was gone within about 20 minutes. TRM says the Binance hack is about four times the size of the $1.5 billion Bybit theft in February 2025.
How the Binance hack happened
Binance’s own explanation changed during the day. Its first account, posted early on 30 October, pointed to a compromised laptop belonging to a DevOps engineer, which gave an attacker access to a service container where withdrawals could be submitted. Co-CEO Richard Teng wrote that it was “not a single ‘one-click’ action” and that Binance had found no evidence of a wallet private key leak. At 08:47 UTC Binance said further work had “uncovered additional points of breach”.
TRM’s report fills in the Ethereum side. The attacker used a feature called EIP-7702, added to Ethereum in May 2025, which lets an ordinary wallet hand control of itself to a smart contract by signing a permission slip. Fifty of these slips were ready before anything moved. Each one only works at one exact transaction count, and a busy wallet’s count keeps rising, so fifty slips covered fifty counts and one of them hit. At 20:20 UTC a single transaction carried all of them.
Three minutes and 24 seconds later the contract emptied Binance’s Ethereum hot wallet, the internet-connected wallet an exchange uses to pay customer withdrawals. The transfer was 167,464 ETH and 63 other tokens, including 1.615 billion USDT.
On the other nine chains there was no such trick. Binance wallets simply sent coins to the attacker with ordinary signed transfers, and the signatures came from wallets that use different key types. TRM reads that as a break-in at the system that signs Binance’s withdrawals, not a flaw in any one blockchain. Binance has not published a root cause. Teng said a detailed post-mortem would come after the investigation.
TRM attributes the Binance hack, “with high confidence”, to TraderTraitor, the North Korean unit the FBI named for the Bybit theft. Teng said Binance’s investigation “has not attributed responsibility to any individual”.
What Binance says about customer money
Teng’s post at 07:37 UTC said “your money is safe, and we’re covering every loss”. Binance said deposits are unaffected and that its withdrawal service is being rebuilt, along with the addresses it uses. For customers that means deposits work and withdrawals do not, until the service returns. A service update at 04:36 UTC gave a 48-hour restart target. The 08:47 post said Binance was still on track to resume in 45 hours.
At 10:55 UTC the exchange said it had reserved more than $6.34 billion of company funds for the losses. About $5 billion of that is already held in the same tokens that were taken. Binance is buying the rest on the open market and over the counter, and warned that thin trading in some tokens could slow it down. The frozen money is not counted in that reserve.
Binance also said all user funds will be checked publicly through its Proof of Reserves, an audit-style report of what the exchange holds, and that an updated one will follow once the repairs are finished. It postponed the listing of Predict (PREDICT) “until further notice” on 30 October, according to its own post.
What is frozen after the Binance hack, and what the thieves still hold
Tether’s chief executive, Paolo Ardoino, said at 21:25 UTC on 29 October that Tether had frozen more than 1.567 billion USDT. Circle froze about 825 million USDC, Ripple 40.5 million of its RLUSD coin and World Liberty Financial 27.8 million of its USD1 coin, per TRM’s tally. Arbitrum’s Security Council forced out 8,426 ETH and 74.6 million ARB, about $30 million, at 00:08 UTC.
TRM counted about $2.7 billion frozen as of 00:30 UTC on 30 October. Binance’s later figure is around $3 billion. Stablecoin issuers can freeze their own coins. Ether and bitcoin have no issuer that can do that, which is why TRM counts the attacker’s ETH and BTC as out of reach.
During the first hours the attacker sold about 325 million USDT to market makers, the firms that stand ready to trade, for roughly 122,300 ETH, a price more than 10% under the market, according to TRM. A second wallet put 60 million USDT into the lending protocol Aave and borrowed about 19,760 ETH, after which Aave froze the affected markets. That leaves the attacker with more than 420,000 ETH and 18,270 BTC, TRM says, roughly $2.4 billion that cannot be frozen.
Bridges, swap services and over-the-counter brokers are where TRM expects the coins to go next. It is watching them, and it told exchanges to check incoming deposits against the addresses it has labelled.
Bitcoin, ether and BNB during the Binance hack
Bitcoin was trading near $80,850 when the 20:00 UTC hour began on 29 October, the same range the site covered in its piece on Fed rate-hike odds. It had lost less than 1% by 20:30. The sharper fall started at about 20:32. By 20:46 the hour’s opening prices looked far away. Bitcoin was down 2.6%, ether 3.7%, and BNB, Binance’s own token, had slid from about $741 at 20:20 to $686 before it bounced.
Not until 21:29 UTC did Binance’s main X account mention it. That post said the exchange knew of reports of a potential security issue and that user funds were safe. That was 57 minutes after bitcoin’s sharper fall began. Tether’s freeze post had come four minutes earlier.
Bitcoin’s low came overnight. It touched $76,500 on 30 October, about 5.4% under the 20:00 UTC price, and ether reached $2,174, down 7%. BNB’s low, $680.00, came in that same first hour. That is nearly 9% under $744.90. By about 14:00 UTC on 30 October bitcoin was near $76,800 and ether near $2,220, with BNB at about $694.
Traders who borrow to bet on price moves took the damage from the Binance hack. A forced closure, called a liquidation, happens when an exchange shuts a leveraged position because losses have used up the trader’s deposit. CoinGlass shows 255,473 traders liquidated in 24 hours, $1.67 billion in all. Longs, the bets on rising prices, took $1.42 billion of it. The bitcoin share was $559 million, ether’s $369 million, and BNB’s about $24 million.
In the 24 hours that include the Binance hack, futures volume rose 79.6% to $355 billion. Open interest, the value of positions still open, fell 4.4% to $136.6 billion, CoinGlass shows. Coinbase was also blocking sends to compromised wallets, its chief executive, Brian Armstrong, said on X.
Did customers move money to rival exchanges?
Not in the first day after the Binance hack, according to DefiLlama’s exchange tracker. It shows Binance’s tracked wallets holding $134.4 billion after the theft, with net outflows of $6.10 billion over 24 hours and $6.23 billion over seven days. Nearly all of the weekly drop is therefore the theft itself.
The other large exchanges moved by modest amounts. OKX shows net outflows of $105 million over 24 hours, Bybit $16 million, Gate $146 million and Bitstamp $94 million, while Bitfinex took in $59 million. On DefiLlama’s figures the stolen sum is about 4.5% of what Binance held before it.
One limit applies. Binance withdrawals were closed for most of that time, so customers who wanted to leave could not. The flows for the days after withdrawals restart will say more than this first reading.
What the last record hack did to prices, and what to watch after the Binance hack
Bybit was the previous record before the Binance hack. Bitcoin opened 21 February 2025 at $98,305 on Binance spot. It touched $78,259 a week later, on 28 February, then climbed back to $90,606 by 5 March. Ether began that day at $2,738 and hit bottom at $1,993 on 4 March. Other news also moved markets in those weeks, so those numbers show the path after Bybit, not the price of that hack.
Standard Chartered’s head of digital assets research, Geoffrey Kendrick, wrote in a note quoted by CoinDesk that “the negative price action still has some way to go”. He wrote that a new base “will likely form” only after assets are unfrozen and more details of the hack emerge, and he expects a shift toward decentralised exchanges. That is his forecast, not a measured shift.
The dated items are few. Binance promised withdrawals back about 45 hours after its 08:47 UTC update on 30 October, which is the early hours of 31 October. A post-mortem and an updated Proof of Reserves have no date yet. TRM, for its part, says teams should alert on any EIP-7702 permission appearing on a treasury wallet and reject such slips unless expected. The site has followed earlier North Korea-linked cases, among them the Lazarus attack on LayerZero and reports of hackers inside crypto firms.
Two price paths for bitcoin and BNB
For BNB, a one-hour close above $705.86, the low of 18 October, would point to $718.27, the low of 24 October. That path ends if a one-hour candle closes back under $702.33. A one-hour close under $682.16, the low of 30 October, would point to $674.60, the September low, and a close back over $685.57 cancels it.
Bitcoin works the same way. A one-hour close above $77,910, the 29 October low, would point to $78,804 and then $79,221, and it stops working on a close back under $77,520. The other way, a close under $76,500 points to $74,968, the September low, and a one-hour close back above $76,883 would cancel the move lower.
