Cryptocurrency exchange Binance is working with the U.S. Federal Bureau of Investigation (FBI) to recover approximately $3 billion in assets frozen in the largest crypto heist in history. A source familiar with the matter told the media that Binance has set aside more than $6.34 billion in company funds to cover the losses, with $5 billion already held in assets that exactly match the stolen tokens. The remaining amount is being made up through market and over-the-counter (OTC) channels.
The attack, which took place at 20:05 UTC on October 29, transferred approximately $6.36 billion from Binance-controlled addresses in about 20 minutes, spanning 10 blockchains. Blockchain analytics firm TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean hacking group previously identified by the FBI as behind the $1.5 billion Bybit theft in February 2025. In an official statement on October 30, Binance confirmed that industry partners had frozen approximately $3 billion so far, said it was working with law enforcement to recover the funds, and pledged that all user funds would ultimately be publicly verifiable through Proof of Reserves (PoR).
20 Minutes, 10 Chains: How the Hot-Wallet Signing System Was Breached
According to TRM Labs, attackers transferred approximately $6.36 billion from Binance-controlled addresses to a single attacker address across 10 blockchains in a roughly 20-minute window beginning at 20:05 UTC on October 29. This is the largest cryptocurrency theft on record, surpassing the $1.5 billion lost by Bybit in February 2025 and far exceeding the $625 million stolen from Axie Infinity’s Ronin sidechain in February 2022.
In an official post on X, Binance said its preliminary investigation "indicates that the security incident may have involved a DevOps engineer’s laptop being compromised." The attackers used it to gain access to a service container and submit unauthorized withdrawal transactions. The exchange also stressed that there was no indication that wallet private keys had been compromised. This points to an access-control vulnerability in the hot-wallet signing process, rather than a collapse of the underlying key custody system—the attackers obtained "permission to submit transactions," not "the keys used to generate signatures."
TRM Labs’ analysis offers a fuller picture of the attack: preparations began at least 36 hours in advance, with the attackers testing code on two wallets, rehearsing on a third, and then waiting about four hours before launching the main attack. The attacker address’s initial funding can be traced to a deposit through Tornado Cash on the morning of the previous day. These traces suggest a coordinated attack, carefully rehearsed against a multichain hot-wallet signing system—not an isolated incident caused by a single employee’s mistake. For exchanges, the real lesson is not "who clicked a malicious link," but why multisig approvals, withdrawal limits, and abnormal-activity monitoring all failed within the same window.
Behind the $3 Billion Freeze: Stablecoin Issuers’ “Emergency Brake”
Of the $6.36 billion in funds transferred, approximately $3 billion has been frozen. According to a TRM Labs snapshot taken at 00:30 UTC on October 31, about $2.7 billion was frozen primarily by stablecoin issuers, including Tether, Circle, Ripple, and World Liberty Financial. These issuers can freeze stablecoins linked to specific addresses on-chain, effectively pressing an "emergency brake" on the movement of funds. Binance later updated the amount frozen to approximately $3 billion.
Binance stated explicitly: "At this time, $3 billion has been frozen. We are grateful to our industry partners. We are working with partners and law enforcement to recover the frozen assets." These funds have not yet been counted toward the $6.34 billion corporate fund pool Binance set aside. The exchange stressed that the reserve figure "does not include frozen or protected assets, which remain subject to ongoing recovery and verification efforts." In other words, if the $3 billion in frozen assets is ultimately recovered and returned to users, the amount of corporate funds Binance actually needs to use could be significantly less than $6.34 billion.
The remaining approximately $2.4 billion is still held by the attackers in the form of Ethereum (ETH) and Bitcoin (BTC), including more than 420,000 ETH and 18,270 BTC. Because these two assets have no issuer that can intervene to freeze them, recovering them is significantly more difficult than recovering stablecoins. It often depends on law enforcement’s on-chain tracing, cooperation from exchanges, and judicial seizures. This also explains why Binance needs to involve law enforcement agencies such as the FBI: stablecoins can be frozen by their issuers, but native assets can only be intercepted by law enforcement.
North Korea Suspicions: The Attribution Trail to TraderTraitor and the Bybit Case
TRM Labs attributed the attack with high confidence to TraderTraitor, a hacking group linked to North Korea. In February 2025, the FBI publicly said the group was responsible for the $1.5 billion Bybit theft. If law enforcement ultimately confirms this attribution, it would mark the second consecutive year that a North Korean hacking group has carried out a billion-dollar crypto heist, and signal that attacks targeting centralized exchanges’ hot wallets are evolving rapidly.
On-chain investigator ZachXBT offered another possible link: funds stolen from Binance and funds from September’s $388 million Bitget theft appeared at the same address after moving through the THORChain cross-chain protocol. "It is highly likely that the same actor was behind both incidents." Cross-chain mixing and address aggregation are typical money-laundering techniques used by North Korean hacking groups to obscure the flow of funds and make them harder to trace. THORChain, a permissionless cross-chain liquidity protocol, has consequently found itself at the center of public scrutiny. Reports indicate that its RUNE token briefly rose 13% after news of the Binance theft.
Caution is warranted: Binance has not officially named any attackers and has only said it is working with law enforcement to identify those responsible. TRM Labs’ attribution is the assessment of a third-party analytics firm; final confirmation would require backing from law enforcement or court documents. In crypto security incidents, mistaken attribution can create diplomatic and legal risks, which is why exchanges and regulators typically exercise restraint.
Binance’s Reimbursement Pledge and the PoR Test
In response to the record-breaking loss, Binance has pledged to cover it in full. The exchange announced that it had set aside more than $6.34 billion in corporate funds to cover the loss. Of that, $5 billion is already held in assets that exactly match the stolen tokens, while the remaining approximately $1.34 billion is being acquired through market and OTC channels. Binance explained that this process takes time because some tokens have low liquidity and OTC settlements take time. The exchange also said it would continue to use corporate resources to cover any confirmed shortfall and provide further updates as recovery progresses and additional verification is completed.
According to reserve rankings, Binance is the largest cryptocurrency exchange by reserves, with total assets of $134 billion. Even so, deploying $6.34 billion in corporate funds at once is a major test. DeFiLlama data shows that Binance processed approximately $6 billion in net outflows in the 24 hours after the incident, reflecting the pressure of user withdrawals during an extreme event. Some on-chain withdrawals, such as those on Solana and XRP, were briefly paused early in the incident, while BTC withdrawals remained open. The exchange subsequently resumed services in stages.
Binance pledged in its statement: "Ultimately, all user funds will be publicly verifiable through our Proof of Reserves." PoR will be a key measure of whether the exchange has truly covered any shortfall in user assets—especially before verification of the ownership of the $3 billion in frozen assets is complete. Any claims that "funds are safe" need to be backed by on-chain evidence. For the industry, the real stress test is not whether Binance can reimburse users, but whether PoR can provide verifiable transparency under extreme conditions.
Industry Impact: Hot-Wallet Architecture, Cross-Chain Tracing, and Regulatory Cooperation
The incident has once again exposed the systemic risks centralized exchanges face in managing hot wallets. Whether the issue was an access-control vulnerability caused by a DevOps engineer’s laptop being compromised or a coordinated failure of a multichain signing system, it shows that a failure in a single layer of defense can trigger a chain reaction across multiple blockchains. For exchanges, cold-hot wallet separation, multisig approvals, withdrawal limits, and abnormal-activity monitoring are no longer optional—they are essential to survival. The attackers’ ability to move funds across 10 chains in 20 minutes also underscores the complexity of exchange risk management in a multichain era: an alert on one chain may not arrive in time to stop withdrawals on the other nine.
The effectiveness of law enforcement cooperation is especially important in this case. In February 2022, the U.S. Department of Justice announced that law enforcement agencies including the FBI had helped seize 94,000 BTC, worth $3.6 billion at the time, linked to the 2016 Bitfinex exchange hack. The Bitfinex case, eight years after the theft, showed that law enforcement can still recover large sums through on-chain tracing and judicial action, even after funds have been moved for years. Whether Binance’s cooperation with the FBI can replicate this outcome will depend on progress verifying the frozen assets and the effectiveness of international judicial cooperation.
Markets also saw ripple effects from the incident. In addition to RUNE’s short-term rise, the Bitcoin market saw approximately $1.6 billion in liquidations after the incident. These fluctuations are a reminder that exchange security incidents affect more than just the platform involved: their impact can spread throughout the crypto ecosystem via cross-chain protocols, liquidation cascades, and market sentiment.
Points to watch include the results of the ownership verification for the $3 billion in frozen assets; the timing and scope of Binance’s PoR report; official confirmation from law enforcement of the attackers’ identities; and whether the exchange will publish a more detailed plan to improve its hot-wallet signing system. For users, following an exchange’s proof of reserves and progress recovering funds is more useful than chasing short-term price swings after an extreme security incident.