BINANCE HACK: RECORD THEFT PUSHES BITCOIN TO SIX-WEEK LOW

Summary:

• Hackers moved about $6.3 billion (€5.6 billion) out of Binance hot wallets on October 29, most of it within about 20 minutes.
• Binance says the exchange will cover every loss and has set aside more than $6.34 billion (€5.6 billion) in company funds. Withdrawals remain suspended.
• Bitcoin fell to a six-week low near $76,400 (about €68,000). Blockchain analysts link the attack to North Korea’s TraderTraitor group, and Binance has not confirmed this.

Hackers took about $6.3 billion (€5.6 billion) from Binance hot wallets on the evening of October 29, according to the exchange. TRM Labs measured the outflow at $6.36 billion (€5.7 billion) across ten blockchains, most of it moved in about 20 minutes. Both estimates make the attack the largest crypto theft on record. The previous record was the Bybit theft of February 2025, worth $1.5 billion (€1.3 billion).

The stolen assets include Bitcoin, Ether, and stablecoins such as USDT and USDC. Binance reports 335 million registered users. Its 2025 annual report listed about $162.8 billion (€145 billion) in assets under custody, according to Reuters.

How the attack happened

Binance’s first findings pointed to the compromised laptop of a DevOps engineer. The laptop gave the attacker access to a service container, and the attacker used the container to submit unauthorized withdrawal transactions. Binance later said its investigation found additional points of breach. Co-CEO Richard Teng wrote on X the attack was not a single “one-click” action.

Binance says it found no evidence of a wallet private key leak. Mark Karpeles, former head of the Mt. Gox exchange, told Reuters he suspects the attackers reached the keys of at least two Binance wallets.

Blockaid, a blockchain security firm, traced the attack to 50 EIP-7702 authorizations. One of them succeeded against Binance 14, a heavily used Ethereum hot wallet. According to CoinDesk, Etherscan data shows 167,464 ETH leaving Binance 14 at 20:24 UTC, followed by 28,005.6 ETH from a second wallet, Binance 16.

What Binance promises customers

Teng told customers “Your assets are safe”. Binance says company funds and its Secure Asset Fund for Users, known as SAFU, will cover every loss. Binance created SAFU in 2018. The fund holds about $1 billion (€890 million) in Bitcoin, which covers only part of the loss.

If you hold funds on the platform, Binance says your balance will be restored one-for-one without use of customer funds. The exchange has set aside more than $6.34 billion (€5.6 billion) in company funds. Of this amount, $5 billion (€4.5 billion) sits in the same tokens as the stolen assets, held in Binance custody. Binance is buying the rest on public markets and over the counter.

About $3 billion (€2.7 billion) is frozen, with help from Tether, Circle, Ripple, and World Liberty Financial. Binance excludes this sum from the reserved funds.

Withdrawals are suspended while Binance rebuilds the security of its withdrawal service. Deposits and unaffected services keep running. Teng said Binance aims to restore withdrawals by Sunday, November 1.

Questions over reserves

CoinDesk reviewed Binance’s proof of reserves from October 1. The review found Binance 14 among the wallets listed as backing customer balances. About 204,500 ETH left the exchange, roughly 5.6% of its ETH reserves. On October 1, the ETH reserve ratio stood at exactly 100%. CoinDesk estimates Ether backing fell to about 94% until Binance replaces the funds.

CertiK told Cointelegraph the firm needs more information from Binance to verify on-chain the $5 billion (€4.5 billion) in matching tokens. Binance says all user funds will be verified publicly through its proof of reserves. If you want to check the figures yourself, the next snapshot is due November 1 and will show whether Binance replaced the missing assets.

Bitcoin and market reaction

Bitcoin fell more than 3% to $76,368 (about €68,000), a six-week low. Ether dropped more than 3% to $2,178 (about €1,940), a two-month low. BNB, the token linked to Binance, lost about 5% over 24 hours and traded near $709.70 (about €632). Coinbase shares fell 4.8% and Strategy shares fell nearly 6% in extended US trading. Coinbase said the attack did not affect the company, and Binance.US reported no impact.

The market was already under pressure before the attack. Analysts told Reuters higher US interest rates and weaker demand from exchange-traded fund buyers had pressured crypto prices. Geoffrey Kendrick of Standard Chartered told Reuters he suspects further declines.

Who is behind the attack

TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean hacking unit. Elliptic and Chainalysis also point to North Korea. The FBI used the name TraderTraitor in February 2025 when the agency attributed the Bybit theft to North Korea. Binance has not confirmed the identity of the attacker, so the attribution remains the assessment of the investigators.

China’s position

No statement from the Chinese government on the attack has been reported. Beijing’s stance on crypto is documented, though. On February 6, 2026, the People’s Bank of China and seven other agencies, including the China Securities Regulatory Commission, issued a notice on virtual currencies. The notice states virtual currencies do not have the same legal status as fiat currencies and calls related business activity illegal financial activity. The notice also treats overseas platforms serving mainland residents over the internet as illegal, and bans unauthorized offshore issuance of yuan-pegged stablecoins.

Euro figures in this article are approximate conversions at about €0.89 per dollar.