Binance, the world's largest crypto exchange, paused deposits and withdrawals on Thursday, October 29, after users reported funds draining from its wallets. The company estimates the total impact at about $6.3 billion. Independent estimates vary widely, and Binance has not confirmed a final number, so the size of the theft is still moving.
If the loss lands near the top of that range, it would be the largest crypto theft on record, ahead of the roughly $1.5 billion that Bybit lost in February 2025. Binance said it temporarily suspended withdrawals on multiple networks as a precaution. In a statement reported by Fox Business, a spokesperson said, "Binance has confirmed a security incident and our teams are working around the clock to resolve it."
Binance.US, the separate U.S. exchange, said it was not affected, according to Reuters via Yahoo Finance. For American readers, that is the first thing to know. The bigger U.S. exposure runs through stablecoin issuers, the market reaction and the many Americans who hold crypto on global platforms.
How the Binance hack reached withdrawal systems
Binance's initial investigation points to a compromised laptop belonging to one of its engineers. The attacker used that device to reach a system and submit unauthorized withdrawals. Specifically, a DevOps engineer's laptop provided access to a service container used to submit withdrawals.
Binance also said it found no sign that wallet private keys were exposed. That detail shapes the picture. If the keys stayed secure, the attacker went after the software that moves money rather than the keys that protect it, which points to internal access controls as the weak spot. Binance has not disclosed how the attacker compromised the laptop or whether other systems were touched.
Credential theft is a familiar route into a network. USA 24 has reported on a k0t access broker that stole 70,000 credentials from VPN and firewall devices, and one stolen foothold can open a path to far more valuable systems.
How much was stolen, and why the numbers keep changing
Binance put the total estimated impact at about $6.3 billion and said about $3 billion had been frozen with partners at that point. It later reported $2.54 billion in verified frozen assets, with tracing still underway, according to Tech Insider. Blockchain firm TRM Labs estimated that about $6.36 billion moved out of Binance wallets across 10 blockchains, with most transferred within about 20 minutes, as reported by CNBC.
The figures differ mainly in what they measure:
| Source | Figure | What it measures |
|---|---|---|
| Binance | About $6.3 billion | Total estimated impact |
| TRM Labs | About $6.36 billion | Moved out of Binance wallets |
| Chainalysis | About $5.9 billion | Value at the time of theft |
| Arkham | More than $5.7 billion | Held in the hacker's wallets at one point |
| Binance | $2.54 billion | Verified frozen assets |
Reported outflows were about $1.45 billion in Bitcoin and $875 million in Ether, according to Cyber Security News. Some reports also put the Binance Secure Asset Fund for Users (SAFU) at about $1 billion in Bitcoin, but Binance has not explained how customer losses will be covered.
Most of the spread comes from timing. Early tallies count coins as they leave wallets, while verified figures depend on what partners freeze and what tracing confirms. Reuters later reported about $3 billion in frozen assets, which is higher than Binance's $2.54 billion verified number, so the frozen total could still rise. One report also describes the 2025 Bybit theft as $1.4 billion rather than $1.5 billion, so the record comparison carries its own uncertainty.
Which stablecoin issuers froze funds, and why it matters
Stablecoin issuers moved faster than in past hacks. Tether froze about $1.57 billion, Circle froze more than $800 million, and Ripple reportedly froze about $200 million. Together, Tether and Circle account for more than $2 billion of the frozen total, and that is the number that matters most for recovery.
Freezes work because stablecoins are dollar-pegged tokens that the issuer can block. A frozen token cannot be spent, so the issuer's decision can keep money away from the attacker even when the exchange cannot reverse a transfer. Circle is a U.S. company, which puts an American firm at the center of the recovery effort.
The attacker reportedly moved assets through decentralized exchanges such as Uniswap, according to CoinDesk. Those venues have no central party that can freeze tokens, so the race is about timing. Every swap that clears before a freeze is money the issuers cannot reach.
Why North Korea is the suspected attacker
TRM Labs said the attack shared characteristics with earlier North Korea-linked incidents, including preparation well in advance and transaction signatures obtained beforehand. Another report, citing TRM and the blockchain investigator ZachXBT, said the Lazarus Group's TraderTraitor unit was likely responsible, according to BigGo Finance.
That attribution rests on blockchain analysis. Neither a government announcement nor a Binance confirmation has settled the question, so treat the North Korea link as a strong lead rather than a finding. Investigators look at the same clues in every large theft: the timing of preparation, the infrastructure used, and where the money goes next.
USA 24 has covered how state-linked operators work quietly for long periods, including Volt Typhoon's silent network of four zero-day campaigns. A long preparation window is itself a warning sign, and it is one reason the Binance case is drawing close scrutiny.
Is my Binance account safe? What US users should do
Binance said, "User funds remain safe," a statement Reuters reported. The company also said, "Binance will cover all losses," as reported by Fox Business. Those statements are commitments, not a payout schedule, and Binance has not said when withdrawals will resume.
If you hold funds on Binance's global platform, these steps reduce your risk now:
- Check withdrawal status only through official Binance channels, not replies on social media or third-party posts.
- Ignore unsolicited messages offering refunds, recovery services or priority withdrawals. Scams often follow large exchange hacks.
- Never share seed phrases, passwords or 2FA codes with anyone who says they work for support.
- Confirm which company holds your coins. Binance.US is a separate exchange, and it said it was not affected.
If your crypto sits in a wallet you control, this outage does not touch it directly. Prices can still move, as the market reaction showed.
What to watch as withdrawals and tracing continue
Withdrawal resumption is the first signal to watch. According to CNBC, one analyst sees no major solvency risk for Binance, and the key indicators are how quickly withdrawals resume and whether outflows stay orderly.
The market has already reacted. Bitcoin fell about 4% and Ether about 4.5%, according to Coinpedia. Some outlets place the episode within a wave of high-profile breaches and AI-discovered bugs they call "Black October," as described by Yahoo Finance.
Reporting also disagrees on timing. Most outlets put the outflows on Thursday, October 29, but one dates the event to October 30. That looks like a reporting gap rather than a second incident.
The next updates will likely include a final loss figure from Binance, revised frozen-asset totals as tracing proceeds, and any official statement on attribution. For U.S. users, the sharper test is whether Binance restores withdrawals and pays out the losses it has promised to cover.
