Binance Covers Losses After Record $6.36 Billion Crypto Theft

How attackers gained signing authority

The theft was roughly four times the size of the $1.5 billion Bybit hack in February 2025, the previous record. Elliptic gives a different estimate of the Binance loss: $6.43 billion across 11 blockchains.

Binance initially traced the intrusion to a compromised DevOps engineer's laptop that allegedly provided access to a service container. Investigators later identified other entry points, Decrypt reported. CEO Richard Teng said the attackers had not relied solely on one engineer's permissions and described the breach as more than a "one-click" action. Binance said it had found no evidence that private wallet keys had leaked.

TRM Labs' assessment instead points to compromised hot wallet signing infrastructure. On Ethereum, the attacker used EIP-7702 and 50 pre-signed authorizations to make a Binance hot wallet operate as an attacker-controlled sweeper contract. Preparations started at least 36 hours earlier with small Tornado Cash withdrawals, followed by tests of the attack code on other wallets.

The malicious delegation remained active for nearly four hours, according to TRM. One transaction transferred 167,464 ETH and 63 tokens, including 1.615 billion USDT. As more funds arrived, the attacker swept the wallet again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC on October 29. Because the wallet also acted as executor for a separate Binance smart account, the attacker could withdraw another 823 million USDC. Circle froze those funds shortly afterward.

The distinction between stolen keys and compromised signing authority matters: protecting a key does not necessarily prevent an attacker from making infrastructure authorize transfers. EIP-7702 expands what a signature can enable for convenience. The breach puts scrutiny on whether organizations have automatic controls that can interrupt outflows before people can respond, particularly when transaction approvals and management decisions normally take far longer than 20 minutes.

FBI attributes the breach to TraderTraitor

On October 31, two days after the theft, the FBI formally attributed it to TraderTraitor, a North Korean state-sponsored group also known as Lazarus Group, Jade Sleet and APT38. The agency said North Korea had stolen more than $6 billion in virtual assets from Binance on or about October 29.

The FBI, U.S. Secret Service and IRS Criminal Investigation also released 628 addresses associated with the theft: 608 on Ethereum, 19 on Bitcoin and one on Solana. They asked exchanges, blockchain operators and other virtual-asset service providers to block related transactions, BleepingComputer and SecurityWeek reported.

BleepingComputer identifies several earlier thefts linked to TraderTraitor: $387.5 million from Bitget in September 2026, $280 million from Drift in April 2026, $1.5 billion from Bybit in February 2025 and $308 million from DMM Bitcoin in May 2024.

The group's recurring tactics include Operation DreamJob, which uses fake recruiters and job offers to persuade software developers and crypto employees to install malware. Both the DMM and Bybit breaches involved compromised employee or developer computers with access to crypto infrastructure. That history does not establish that the same recruitment tactic was used against Binance.

Replacing customer backing with company funds

CoinDesk reported on October 31 that Binance had allocated more than $6.34 billion to cover the losses, drawing on corporate cash, futures insurance funds and its Secure Asset Fund for Users, or SAFU. Binance said the SAFU contribution came only from the amount above its mandatory size and pledged to restore the fund to around $1 billion. By November 1, the exchange said approximately 95% of the affected value had been covered.

SAFU is an emergency reserve financed through a share of trading fees. Binance's SAFU FAQ says it held approximately $1 billion in crypto assets as of February 2026. Nest Clearing and Custody Limited, a Recognized Clearing House regulated by the Abu Dhabi Global Market Financial Services Regulatory Authority, holds and manages the fund. Some of it serves as capital reserves for Binance's ADGM obligations. Binance also has a standing commitment to rebalance SAFU to about $1 billion if its market value drops below $800 million.

The replacement funds are especially significant because the stolen wallets included assets used to back customer balances. CoinDesk found that the "Binance 14" wallet appeared in Binance's October 1 proof of reserves. The approximately 204,500 ETH stolen represented roughly 5.6% of the exchange's ETH reserves.

A subsequent reserve snapshot showed backing of at least 100% for ten major assets, with full proof scheduled by November 3. But a snapshot after assets have been replaced cannot show liabilities elsewhere on the company's balance sheet. A fully backed customer balance and the financial cost of restoring that backing are separate questions.

Binance's ability to commit billions of dollars provided a cushion that a smaller exchange might not have. Replacing the assets protects against the shortfall, but it does not erase the loss; the company must bear it.

Customers begin withdrawing again

Binance reopened withdrawals in stages on November 1. In the first nine and a half hours, customers withdrew $4.65 billion and deposited $1.01 billion, according to exchange figures reported by The Block.

Binance put the resulting net outflow at approximately $3.64 billion, or 2.1% of its $171 billion in assets under management. DefiLlama reported a separate net-outflow figure of $4.05 billion.

The assets-under-management figure should not be confused with Binance's own financial resources: most of that $171 billion belongs to customers. Most customers kept their assets on the platform during the first day, but that initial response does not establish how withdrawals will develop over the following weeks.

Frozen funds and the limits of recovery

Issuers were able to block substantial amounts of stolen stablecoins. CoinDesk reported that Tether froze more than $1.56 billion in USDT, while Circle froze about $823 million in USDC. TRM also recorded freezes of 40.5 million RLUSD by Ripple and 27.8 million USD1 by World Liberty Financial.

Arbitrum's Security Council invoked emergency powers to move 8,426 ETH and 74.6 million ARB, worth about $30 million, out of the attacker's wallet. TRM estimated total on-chain freezes at roughly $2.7 billion. Binance cited approximately $3 billion, while Elliptic confirmed about $2.85 billion frozen or seized on-chain. Those figures describe funds blocked or seized, not necessarily funds returned to Binance.

Other holdings remain outside an issuer's ability to freeze them. TRM estimates that the attacker still holds more than 420,000 ETH and 18,270 BTC, together worth about $2.4 billion. Elliptic's separate estimate puts such holdings at roughly $3.25 billion across more than 800 addresses, including about 584,000 ETH, 18,327 BTC and 233 million XRP.

The stolen bitcoin was divided into smaller amounts, complicating tracing. Assets subject to centralized controls offered more immediate opportunities for intervention, while those controls also raised questions about who may freeze another party's funds and how fairly recovery powers are applied.

Elliptic described the laundering as automated. The main Tron wallet made hourly payments for more than a day, and the operation redirected funds through newly created wallets when a bridge rejected deposits. "In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep," Elliptic said. It cautioned that blockchain records cannot establish whether AI agents or conventional scripts are responsible.

Custody and access risks for Indonesian users

For investors in Indonesia, the incident highlights a risk distinct from changing crypto prices: whether assets are safely held and accessible. Self-custody reduces dependence on an exchange, but places responsibility for security on the owner. It is an alternative only when the owner can manage that responsibility.

Businesses holding operational funds need dependable access as well as returns. Customer-asset segregation should be open to audit, and withdrawal arrangements should be tested under adverse conditions. Rebuilding confidence requires more than a reserve snapshot; customers also need withdrawals to work reliably.