$6.36 Billion Moved From Binance Wallets, Sending Bitcoin to Six-Week Low
Key Facts
An attacker moved about $6.36 billion from Binance wallets across 10 blockchain networks on October 29, with most of the funds transferred in about 20 minutes starting at 20:05 UTC, according to TRM Labs. Binance estimated the total impact at about $6.3 billion in an update issued on October 30 and said it had frozen about $3 billion on-chain. The company said user funds were safe and that it would cover losses from its SAFU fund and its own funds. The incident sent Bitcoin down to $76,368, its lowest level in six weeks, according to Reuters. The scale of the transfers puts the incident among the largest recorded cryptocurrency thefts, while the response focuses on tracing and freezing the assets.
Binance said its preliminary investigation suggested that an engineer’s laptop in the development operations department may have been compromised, allowing the attacker to access a service container and send unauthorized withdrawal transactions. The company added that it had found no evidence that wallet private keys had been exposed. Binance’s update did not announce a direct compromise of wallet keys; instead, it described a possible path that began with the engineer’s device and ended with the withdrawal transactions. TRM Labs attributed the attack with high confidence to North Korea’s TraderTraitor group, based on on-chain and off-chain information. The company said the funds were moved from Binance wallets across multiple networks, in an operation concentrated mostly within a short period.
Binance announced a temporary suspension of deposits and withdrawals to conduct security checks and work with law enforcement, before saying deposits were unaffected and it expected withdrawals to resume within 48 hours, according to Reuters. Stablecoin issuers also worked to freeze assets linked to the incident: Tether said it had frozen nearly $1.57 billion, while Circle announced that it had frozen more than $800 million. Binance said it was working with blockchain network partners to freeze affected assets. The company said about $3 billion had been frozen, out of a total impact estimated at about $6.3 billion. It said it would publish an updated proof of reserves after remediation was complete.
The sell-off extended to the cryptocurrency market and related stocks. During Asian trading on Friday, Bitcoin fell more than 3% to $76,368, while Ether dropped more than 3% to a two-month low of $2,178, according to Reuters. In U.S. extended trading on Thursday, Coinbase shares fell 4.8% and Strategy shares declined about 6%. The Block estimated that $1.55 billion in cryptocurrency positions were liquidated over 24 hours through the evening of October 29, involving 246,482 traders. Of the total liquidated positions, $1.34 billion were long positions, showing that the sell-off particularly pressured traders who had bet on prices rising.
The incident came as the cryptocurrency market was under pressure from rising U.S. interest rates and weak demand from exchange-traded fund buyers, according to Reuters. Tim Sun, a researcher at HashKey Group, said the incident could weaken risk appetite and prompt investors to reassess the safety of assets held on centralized platforms. That includes, Sun said, counterparty, liquidity and solvency risks. Geoffrey Kendrick of Standard Chartered said he expected further negative price movements in the near term. Kendrick linked the broader implications to the possibility of a larger share of trading shifting to decentralized platforms compared with centralized ones.
TRM Labs said the incident was the largest recorded cryptocurrency theft, at about four times the size of the Bybit hack, which was valued at $1.5 billion in February 2025. The company’s figures show the scale of the gap between this incident and previous cases reported by Reuters: attackers stole $2.9 billion across about 150 attacks during 2025. In September 2026, crypto platform Bitget said about $350 million in cryptocurrency had been stolen from its platform. Binance’s next steps are to resume withdrawal services within 48 hours, as it has said it expects to do, and publish proof of reserves after remediation is complete. The company also said it would share further technical details after the investigation is complete and the facts have been verified.