Hackers Steal $6.3 Billion from Binance in Largest Crypto Theft in History

Hackers drained around $6.3 billion from Binance by the exchange's own estimate, in what blockchain analytics firm TRM Labs called the largest crypto theft ever recorded. That is roughly four times the $1.5 billion taken from Bybit in February 2025, the previous record.

TRM put the haul slightly higher. In a report published, it said approximately $6.36 billion left wallets controlled by Binance across ten blockchains, the bulk of it within about 20 minutes from 20:05 UTC. Chainalysis estimated the theft at $6.4 billion.

Binance has pledged to make good every loss and has temporarily suspended deposits and withdrawals while it investigates. Working with blockchain partners, it has so far frozen roughly $3 billion of the affected assets on-chain, according to a security incident update on its support site. On the remaining exposure, which falls to its Secure Asset Fund for Users (SAFU) and its own balance sheet, the company said: “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.”

Yi He, co-founder and co-CEO of Binance, repeated the commitment on X, writing that the exchange would absorb all hacking losses while staff ran security checks, froze funds and worked with law enforcement.

Early findings point to a laptop used by one of the company's DevOps engineers, Binance said. The exchange believes that compromised machine may have given the intruder a way into a service container, from which the unauthorized withdrawal requests were sent. It said it had found nothing to suggest that any wallet private key had leaked, and promised a detailed technical post-mortem when the inquiry ends and every fact has been checked.

The exchange listed three emergency steps. Deposits and withdrawals were paused pending security checks, authorization was revoked for the address involved, and law enforcement agencies and blockchain intelligence firms were called in to trace the money and help recover it. Binance said its teams were working around the clock and that it was cooperating with police partners to identify the criminals and bring them to justice. Users were told to rely on official Binance channels alone for news.

TRM's breakdown shows Ethereum made up about $3.79 billion of the outflows. A further 18,270 bitcoin, worth about $1.47 billion, came out of a Binance hot wallet, the kind of internet-connected wallet an exchange keeps to pay out customer withdrawals. Transfers on Tron and the XRP Ledger added about $628 million and $296 million.

TRM’s assessment focused on how the attacker obtained approval for the transfers. Wallets across blockchains using different types of cryptographic keys signed transactions to the attacker within roughly half an hour. TRM said this pattern pointed to a compromise of Binance’s hot wallet signing infrastructure, potentially allowing the intruder to authorize malicious transfers. The firm noted that Binance had not yet published a confirmed root cause.

Jeremy Allaire, CEO of Circle, said: “Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.”

By early on October 30, TRM tallied about $2.7 billion frozen on-chain, with Ripple, World Liberty Financial and Arbitrum's Security Council also acting. The attacker, it estimated, still holds more than 420,000 ETH and 18,270 BTC, together worth about $2.4 billion, which no issuer is able to freeze.

Changpeng Zhao, Binance's founder and former CEO, said: “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

The SAFU reserve that Binance plans to tap dates from July 2018 and is worth approximately $1 billion, kept entirely in bitcoin, according to the company.

With that reserve covering only a fraction of the estimated impact, most of the cost could land on Binance's corporate balance sheet, and the final bill may depend on how much of the frozen stablecoin balance is eventually returned.