EXPLAINED | Binance’s $6.3-Billion Hack: What Went Wrong, and Who Pays?

Binance, the world’s largest cryptocurrency exchange by trading volume, has been hit by a hack involving unauthorised withdrawals from its digital wallets. The company estimates the impact at about $6.3 billion, making it the largest reported cryptocurrency theft on record.

The exchange paused withdrawals while investigating how attackers gained access. It says roughly $3 billion in affected assets has been frozen and has promised to cover all losses.

What happened, and when?

Blockchain intelligence firm TRM Labs traces approximately $6.36 billion leaving Binance wallets across ten blockchain networks. Most of the movement occurred in about 20 minutes on October 30. Its valuation reflects asset prices when the transfers occurred.

Binance subsequently confirmed a security incident, suspended deposits and withdrawals as a precaution and began working with law enforcement and industry partners.

What exactly is Binance?

It is the world’s largest cryptocurrency exchange by trading volume. It's a platform where customers buy, sell and hold cryptocurrencies. It also offers products such as futures, which allow traders to take positions on price movements.

When customers leave crypto with an exchange, they depend on its custody and withdrawal systems. The security of those systems becomes part of the risk of using the service.

Is this really the biggest hack in history?

By the value of assets taken, this is being described as the largest cryptocurrency theft on record. The incident reportedly eclipses Bybit’s record-setting theft.

The FBI put the February 2025 Bybit theft at approximately $1.5 billion. Binance’s estimated impact is more than four times that amount.

How could attackers get through?

Binance’s preliminary explanation points to a compromised laptop belonging to a DevOps engineer, someone working on software development and operations. It says the attacker gained access to a service container, an environment running software, and submitted unauthorised withdrawal transactions.

In comments reported by Sky News, co-chief executive Richard Teng said the attack involved a more complex process than one engineer’s permissions or a single click. He also said the investigation had not attributed responsibility to any individual.

TRM’s analysis points to compromised wallet-signing infrastructure. On Ethereum, it says attackers used signed authorisations to make a wallet run malicious code. On other networks, wallets sent funds through ordinary signed transfers.

Does that mean Bitcoin or Ethereum’s security was broken?

The published findings concern access to the exchange’s systems and transaction approvals.

A private key is secret information used to authorise transactions. Ethereum’s documentation explains how digital signatures allow a network to verify that an instruction was signed by the relevant key.

A compromised approval system can therefore be dangerous even if the secret key itself has not been extracted. The blockchain may accept an instruction carrying a valid signature while the exchange’s legitimate operators never intended that payment.

Binance says it has found no evidence of leaked wallet private keys. That does not establish that its withdrawal controls remained secure.

Who is suspected of carrying it out?

TRM attributes the attack with high confidence to TraderTraitor, a North Korean hacking group. It cites intelligence and similarities with earlier attacks.

BBC reports that Chainalysis also assesses a North Korean connection with high confidence. Binance says it is working with law enforcement to establish the perpetrators.

The FBI blamed North Korea for the earlier Bybit theft. Binance’s investigation into the perpetrators of this attack is continuing.

How can stolen crypto be frozen?

Some tokens have issuers with powers to block transfers.

Circle, which issues the dollar-linked stablecoin USDC, explains that it can block particular addresses from sending or receiving its tokens under defined circumstances. It also makes a crucial distinction: blocking an address does not reverse a completed transaction.

Tether and Circle were among the companies that froze assets linked to the Binance incident.

Other assets, including native bitcoin and ether, do not have an equivalent central issuer that can simply freeze them. Investigators can still trace movements, and exchanges may block identified funds when they reach their services.

That makes speed important. Converting a freezable token into another asset can complicate recovery.

Frozen money has been immobilised. Returning it to its rightful owner requires further action.

Who pays, and what does “user funds are safe” mean?

Binance says it will cover losses using company money and its Secure Asset Fund for Users, known as SAFU.

SAFU is an emergency protection reserve. Binance’s published terms retain discretion over eligible claims and the fund’s management. Its existence should not be confused with an unconditional reimbursement guarantee for every possible event.

For this incident, Binance has made an explicit commitment to absorb losses. Customers will also need access restored.

The company has promised an updated proof-of-reserves report. Such reports have limits: the US Public Company Accounting Oversight Board’s investor advocate explains that they are not equivalent to financial-statement audits and may not establish the full liabilities or effectiveness of internal controls.

Can customers withdraw now?

Binance’s later October 30 service update says deposits are operating normally, while withdrawals remain paused during a security overhaul. It expects withdrawal services to resume within 48 hours. That is a target, rather than confirmation of restoration.

A company can promise to absorb financial losses while temporarily restricting transfers to secure its systems. Customers’ ability to access funds and the funding of any shortfall are separate questions.

Binance.US said its platform was unaffected. It should not be treated as interchangeable with Binance.com.

Why does this matter in India?

There is an immediate operational connection.

CoinDesk reported on October 30 that CoinDCX placed futures trading in “reduce-only” mode following disruption to a global liquidity provider. A spokesperson identified that provider as Binance. Customers could not open or increase futures positions. CoinDCX said deposits, withdrawals and customer funds were unaffected.

The restriction shows how an incident at one venue can affect services offered elsewhere.

Separately, CoinDCX’s October 25 statement disclosed a 15.99-million-USDT loss involving retired wallet infrastructure and a failed automated transfer process. It said the company absorbed that loss. That separate incident occurred before the Binance breach.

What happens next?

The important developments are the technical findings, additional asset recovery, restoration of withdrawals and evidence showing how the loss is covered.

Crypto prices and related shares fell as news emerged, Reuters reported. The market reaction spread the financial impact beyond the wallets directly affected.

Customers should use official service updates and avoid messages offering refunds or recovery in exchange for passwords, private keys or seed phrases. Binance has warned users to rely on official channels.

The breach has already demonstrated the scale of the exposure. Recovery will determine how much of that exposure becomes a lasting loss.