How the Binance hack unfolded
Binance's estimate of its security breach has climbed to $6.3 billion, and nearly $3 billion of that has been frozen on-chain. If the figure holds, the Binance hack would be a potential record for crypto theft, and it has pulled US agencies and two stablecoin issuers into the response. This update covers the new numbers, the early investigation and the attribution that emerged after USA 24's earlier report on the withdrawal halt.
The exchange described the event as a "security incident" affecting about $6.3 billion in assets. Binance is the world's largest crypto exchange by daily trading volume, so any disruption there ripples across the market. According to blockchain analysts TRM Labs and Chainalysis, the bulk of the theft happened in about 20 minutes, beginning late Thursday, October 29, as France 24 reported.
Binance said it had temporarily suspended deposits and withdrawals while security checks ran, according to ABC News. Its initial investigation points to a compromised laptop belonging to a DevOps engineer. That device gave the attacker access to withdrawal functions.
Binance later said its investigation had found additional points of breach, but it did not say where they were. A single compromised laptop explains one way in. It does not explain the full path of the attack, and that gap is the biggest unanswered question in the technical story.
Which Binance customers are affected
Binance is telling customers their money is safe. In its company announcement, the exchange said "User funds are safe," according to NBC News. The company also says it has covered 80% of the impacted amount so far and will cover losses. That promise carries weight, but the total is not settled. Binance has said the figure could rise or fall as assets are traced and frozen.
US customers have a more specific answer. Binance.US, the US-compliant exchange, said it was not affected. People who hold accounts on the global Binance platform rather than Binance.US should check official Binance notices instead of relying on social media summaries.
Crypto prices fell, but only modestly. According to Fortune, that drop suggests markets expect Binance to cover its losses.
One figure needs a caution flag. The Hacker News cited a $6.43 billion figure attributed to an unnamed source, as reported in its coverage of the breach. USA 24 could not confirm that number against an official source, so treat it as unverified and rely on the $6.3 billion estimate Binance has announced.
Who froze the stolen funds
Stablecoin issuers froze a large share of the stolen funds quickly, which sets this theft apart from past heists. Tether CEO Paolo Ardoino posted on X that Tether "froze more than 1.567B" of USDT tied to the hack. Circle, the US-based issuer of USDC, said it froze more than $800 million. Together those freezes account for more than $2.3 billion of the roughly $3 billion frozen so far, according to Yahoo Finance.
| Figure | Amount | Who reported it |
|---|---|---|
| Estimated total impact | $6.3 billion | Binance |
| Frozen or recovered so far | About $3 billion | Binance |
| USDT frozen | More than $1.567 billion | Tether |
| USDC frozen | More than $800 million | Circle |
| Share of impacted amount covered | 80% | Binance |
The US Secret Service said its investigators are "working around the clock with our private-sector partners, including Circle" to identify, freeze, trace and recover the stolen funds, according to CNN. That pairs a federal agency with a private company in the recovery effort.
If you hold USDT or USDC, the lesson is practical. Users should expect possible freezes if their wallets interacted with flagged addresses.
Why analysts point to North Korea
TRM Labs attributed the theft "with high confidence" to a group it calls TraderTraitor, which it says was behind last year's Bybit hack, according to a Yahoo Finance report. Chainalysis told CNN it had "high confidence" that North Korea was behind the hack. Both firms trace blockchain flows for a living, so their read carries weight, but it is not an official finding.
The Bybit comparison matters. The FBI attributed the 2025 Bybit heist to North Korea, and reporting on the Binance theft notes that the method resembles it. North Korea denies involvement.
Formal attribution is still missing. No group has claimed responsibility, and Binance has not named a culprit. The US government has not confirmed North Korean involvement. President Trump said on Friday that he did not know who was responsible, but that the administration was looking into it.
Cashing out is the next hurdle. One analyst quoted by CNN expects North Korea to use money-laundering networks to convert the stolen funds. Chainalysis, whose analysis is cited above, disclosed earlier that hackers had breached its own systems and accessed customer data. USA 24 reported that separately in its story on the Chainalysis breach.
Is my Binance account safe? What to do now
Binance says user funds are safe, but scammers tend to move quickly after breaches like this one. These steps reduce your exposure:
- Reach Binance only through its official website and app. Type the address yourself or open a saved bookmark, and do not click links in direct messages or emails.
- Ignore anyone offering "recovery" help. Scammers often send these offers after large breaches.
- Turn on hardware-key two-factor authentication if the platform supports it, and move away from SMS codes where you can.
- Check your recent logins and withdrawal history for activity you do not recognize, and report anything suspicious through official support channels.
- Do not move funds because of unverified social posts or rumors about a particular withdrawal route.
What happens next
Several questions remain open. Binance has not finalized its loss total, and it has not identified any entry point beyond the compromised laptop. The company has not said when withdrawals will fully resume, and it has not yet published the post-mortem it promised. Federal attribution is also pending.
Vendor and access risks keep resurfacing across crypto. USA 24 reported earlier that Polymarket halted international trading after a vendor breach drained wallets.
The next signals to watch are a formal US attribution, any movement of the frozen funds, and whether Binance's post-mortem names the additional breach points. If the freezes hold, the recovered total could climb above the current $3 billion. If the stolen money moves through laundering networks, the story shifts from recovery to enforcement.
