Binance back online after biggest crypto theft on record
Binance, the world’s largest cryptocurrency exchange, resumed bitcoin and ether withdrawals on Sunday, November 1, after a hacking incident that analysts describe as the biggest crypto heist on record and possibly the largest financial robbery ever. The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit.
The breach occurred late on Thursday, October 29, with most of the theft unfolding in roughly 20 minutes. Blockchain analysts said the attackers compromised Binance’s transaction-signing infrastructure, enabling them to issue unauthorised instructions that emptied internet-connected wallets. The speed and scale of the operation have unsettled the market and raised fresh questions about the security of customer assets held on centralised platforms.
Binance co-CEO Richard Teng called it a “complex attack” and said it may have involved a compromised software engineer’s laptop and malware designed to erase evidence. The suggestion that the intrusion began with an insider’s device, rather than a direct breach of the exchange’s core systems, points to the kind of supply-chain and personnel-level threat that has become increasingly difficult for even the best-resourced platforms to defend against.
How the theft unfolded and how it was contained
According to blockchain analysts, the attackers did not need to break the exchange’s cryptography. Instead, they appear to have gained the ability to issue signing instructions themselves, which allowed them to drain internet-connected wallets at extraordinary speed. Roughly 20 minutes was enough for the bulk of an estimated $6.3 billion in assets to leave the platform.
The response, however, was notably fast. Binance halted withdrawals, which unsettled markets but bought time. Several stablecoin issuers played a decisive role in containing the damage: Tether froze nearly $1.57 billion, while Circle froze more than $800 million linked to the attack. The ability of issuers to blacklist addresses at the token level is one of the few effective brakes on stolen funds once they are on the move, and in this case it appears to have prevented a substantial portion of the haul from being readily liquidated.
Binance said it used corporate funds, part of its $1 billion Secure Asset Fund for Users (SAFU) and its Futures Insurance Fund, to purchase replacement tokens for affected customers. By Sunday, the exchange said it had covered 95%, or about $6 billion, of the stolen assets. The remaining 5% comprised less-liquid tokens that could take longer to replace, a reminder that the long tail of an exchange’s listed inventory is often the hardest part to make whole.
The episode is a rare instance of an exchange absorbing a nine-figure, indeed ten-figure, loss without an immediate collapse. Whether that resilience holds as the remaining tokens are replaced, and as legal and regulatory scrutiny follows, will shape how the industry judges the incident in the months ahead.
Market reaction: bitcoin stabilises, BNB slides, outflows mount
The immediate market damage was sharp. Bitcoin fell to a six-week low of $77,646, while ether reached a two-month low of $2,238.76. Binance’s own BNB token dropped more than 8% in 24 hours, reflecting both the direct reputational hit to the exchange and fears about what a prolonged withdrawal freeze would mean for liquidity.
The price action also coincided with a dip in the dollar ahead of the US midterm elections, adding a macroeconomic overlay to an already nervous trading environment. Bitcoin’s stabilisation by Sunday, as withdrawals resumed and the exchange communicated progress on replacing stolen assets, suggested that the market’s worst-case scenarios, an insolvency event at the largest exchange by volume, were not materialising.
Customer behaviour told a more complicated story. Clients withdrew $3.64 billion from the platform, equivalent to 2.1% of Binance’s assets, although the exchange said outflows were stabilising and deposits remained “substantial.” DefiLlama, which tracks on-chain flows, estimated higher outflows of $5.81 billion. The gap between the two figures reflects different measurement methodologies, but either way the direction is clear: a meaningful slice of customers voted with their wallets.
For a fuller picture of how the leading cryptocurrency is trading through the turbulence, see our Bitcoin coverage.
The pattern is familiar from previous exchange crises. After the collapse of FTX in 2022, self-custody spiked and hardware wallet makers reported record sales. This incident, though different in nature, an external attack rather than alleged internal fraud, is likely to renew the same debate: whether the operational risks of leaving assets on an exchange are worth the convenience. That Binance could absorb the loss and reopen withdrawals within days is a genuine improvement on the industry’s past. That the attack succeeded at all is a warning that size and reserves are not the same as invulnerability.
North Korea’s crypto theft machine and the regulatory reckoning
The FBI’s attribution to TraderTraitor places the incident squarely within a well-documented pattern of North Korean state-sponsored cybercrime. The regime has for years used cryptocurrency theft as a source of foreign currency, targeting exchanges, bridges and decentralised finance protocols. An operation of this magnitude, if the $6.3 billion estimate holds, would represent a dramatic escalation in both ambition and capability.
The tradecraft described by Binance’s co-CEO fits the profile. A compromised engineer’s laptop, malware designed to erase evidence, and a compressed execution window all suggest a patient, well-resourced adversary that studied the target’s internal processes before striking. This was not a smash-and-grab against a weak perimeter; it was an operation against the human and software supply chain that surrounds the signing infrastructure itself.
For regulators, the implications are uncomfortable. The incident exposes the operational and cybersecurity risks facing crypto platforms precisely as digital assets become more integrated into mainstream finance. It intensifies pressure on exchanges to improve wallet controls, share threat intelligence across the industry, and demonstrate that customer balances are adequately protected. The speed with which Tether and Circle froze funds shows what is possible when issuers and exchanges coordinate, but it also shows how much the system depends on a handful of centralised actors acting quickly and in concert.
Policymakers are likely to ask harder questions in the aftermath. Should exchanges be required to hold signing keys in hardware isolation that cannot be reached from any employee laptop? Should threat-intelligence sharing between major platforms be mandatory rather than voluntary? And should proof-of-reserves regimes be extended to cover not just whether assets exist, but whether the processes that control them are hardened against state-level adversaries? The Binance heist will be cited in those debates for years.
What it means going forward
The immediate crisis has passed, but the consequences are still unfolding. Binance has covered the vast majority of losses from its own resources, which will reassure customers in the short term and may even strengthen the argument that large, well-capitalised exchanges can survive shocks that would have destroyed smaller operators. Yet the incident also demonstrates that even the largest exchange in the world, with a billion-dollar insurance fund and sophisticated security teams, could be penetrated through a single compromised endpoint.
Three watch-points stand out. First, whether Binance completes the replacement of the remaining 5% of stolen assets without friction, particularly the less-liquid tokens. Second, whether customer outflows accelerate again once confidence in the exchange’s security posture is tested by further disclosures about how the attackers gained access. Third, whether the attribution to TraderTraitor prompts coordinated action from US authorities and allied governments, including sanctions against laundering infrastructure, which could determine how much of the stolen $6.3 billion is ever recovered.
The broader lesson cuts both ways. The crypto industry’s ability to freeze stolen stablecoins, backstop losses and reopen withdrawals within days is a genuine mark of maturity compared with previous cycles. But the fact that a state-sponsored group could empty the wallets of the world’s largest exchange in 20 minutes is a reminder that as the sums involved grow, so does the incentive and the capability of those who target them. Security, not price, may be the defining issue of this market cycle.
