Binance says $6.3 billion was taken from the exchange, the largest cryptocurrency theft on record, and that roughly $3 billion of the stolen assets have already been frozen.

The company disclosed the number in a series of posts on X on 30 October and committed to covering every loss. It holds an emergency reserve fund of about $1.3 billion at last valuation, and said it has reserved more than $6.34 billion of company funds for this incident, $5 billion of which is "already held in the exact token assets that were impacted." Deposits and withdrawals are suspended.

As for how it happened, Binance's first account pointed at a compromised laptop belonging to one of its DevOps engineers, which let an attacker reach a service container and submit unauthorised withdrawal transactions. Later updates mentioned "additional points of breach." Co-CEO Richard Teng pushed back on the tidy version of that story: "The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he wrote. "It involved a more complex attack process." The company says its investigation has not attributed responsibility to any individual and has found no evidence of a leaked wallet private key. The affected address has had its authorisation revoked.

Two blockchain-analysis firms, TRM Labs and Chainalysis, attribute the theft to TraderTraitor, a North Korean unit with a long record of hitting crypto exchanges. TRM says most of the money moved in about 20 minutes.

The scale is difficult to place. The previous record was $1.46 billion taken from Bybit last year; this is more than four times that. Binance's own 2019 breach cost $40 million at the time. "This is an extraordinary hack, for its size and for the response," TRM chief policy officer Ari Redbord told Sky News. "Few financial systems have ever shown a theft of this scale. The theft shows how exposed the system is to sophisticated attackers moving at a speed we have never seen."

What a freeze proves, and what it does not: $3 billion frozen means the attacker's route to cash is partly blocked, not that the assets are back in customer accounts. Binance has not said how much of the roughly $3.3 billion not yet frozen it expects to absorb, what the freeze actually covers, or whether the reserve is enough if law enforcement recovery stalls. Its promise to make users whole is a balance-sheet commitment, and the balance sheet is the company's own.

The disclosure also lands in a bad season for the industry: several large heists were disclosed by crypto companies in September, and the record it breaks is barely a year old.

The open questions are technical as much as financial. Binance has not explained how a laptop reached a container with withdrawal authority, whether the intrusion came through a supplier or an insider, or why withdrawal signing could be triggered by a single service's credentials. Until it does, the number that matters is not the $6.3 billion stolen but the 20 minutes in which the exchange's controls did not stop it.

Binance says it is working with law enforcement and that user funds are safe.

Sources