Binance Puts Hack Losses at $6.3 Billion, Weighing on Crypto Market
Key Facts
Binance estimated losses from the breach of its hot wallets at about $6.3 billion, after unauthorized withdrawals began at around 20:05 UTC on October 29. The exchange said in a statement that it had allocated more than $6.34 billion in company funds to cover the affected assets. That amount included $5 billion in the stolen tokens themselves, including USDC, USDT, BTC, ETH and BNB. Binance estimated that its allocation was equivalent to about 80% of the affected amount. The gap between the estimated loss and the announced coverage is a key factor in assessing the incident’s impact on customer confidence.
Binance said it was working to buy the remaining tokenized assets through market channels and over-the-counter trading. It added that about $3 billion in affected assets had been frozen on-chain as of its statement on October 30. Those frozen assets are distinct from the funds the exchange said it had allocated for coverage, since a freeze does not in itself mean the assets have been recovered. In its report on the incident, Reuters said Binance had reported finding about $3 billion, and that the report did not clarify the fate of the remaining $3.3 billion. Binance said customer funds were safe and that it was working with industry partners to freeze some of the affected assets.
Binance temporarily suspended withdrawals to conduct security reviews, carry out remediation measures and verify the integrity of the affected systems. It said deposits and other unaffected services continued to operate during the suspension. The company aimed to begin resuming withdrawals within about 34 hours of its October 30 update, subject to completion of the security checks. It said the resumption would be gradual, and the statement did not confirm that withdrawals had already resumed. The exchange also plans to take an initial proof-of-reserves snapshot within 12 hours of the update, with results expected by Monday, November 2.
Binance said it expected to publish additional technical findings in about 48 hours, after verification and provided disclosure would not harm the ongoing investigation. It added that, up to that point, there was no evidence that private wallet keys had been leaked. In details reported by Reuters, Binance described the breach as a sophisticated attack involving a compromised laptop and malware designed to erase traces of its activity, making tracking and investigation more difficult. Its initial statement had pointed to the possible involvement of a compromised laptop, while the subsequent investigation revealed additional compromise points. The timelines set by the company indicate that proof-of-reserves results and technical updates will follow the withdrawal suspension and system checks.
TRM Labs estimated that the attacker moved about $6.36 billion from Binance wallets across 10 blockchain networks, with most of the transfers taking place over about 20 minutes starting at 20:05 UTC on October 29. The AP reported, citing TRM, that the North Korea-linked TraderTraitor group carried out the attack with a high degree of confidence. The company said: "We issue this assessment with a high degree of confidence." Binance, meanwhile, said its initial investigation pointed to the possible involvement of a compromised laptop, and that its subsequent investigation revealed additional compromise points. Reuters reported that the Federal Bureau of Investigation said it was aware of the incident and was working with public- and private-sector partners to understand the scope of the activity, assess its effects and coordinate investigative steps.
Cryptocurrency prices reacted to news of the incident on two consecutive days. The AP reported that Bitcoin fell 3.2% to below $79,000 on the evening of Thursday, October 29, after reports of the breach emerged. On October 30, Bitcoin hit a six-week low of $76,368, while Ether fell more than 3% to a two-month low of $2,178 before markets stabilized, Reuters reported. Declines also affected cryptocurrency-linked stocks, including Coinbase, Strategy and Robinhood. But EL7’s daily BTCUSD close on October 31 was $77,429.62, compared with $77,368.77 the previous day.
Tim Sun, a senior researcher at HashKey Group, told Reuters the incident "could further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized trading platforms." That assessment puts custody at exchanges at the center of the breach’s fallout, as Binance focuses on restoring withdrawals and providing proof of reserves. TRM Labs said attackers stole $2.9 billion in cryptocurrency across about 150 attacks in 2025. TRM’s estimate of $6.36 billion transferred from Binance wallets in this incident exceeds the total the company said was stolen during the previous year. Binance’s next announced milestones include proof-of-reserves results expected on November 2 and technical updates it said it would publish after about 48 hours of verification.