On Oct 29 Binance hot wallets were drained of about $6.3-6.36B across 10 chains in about 20 minutes, the largest crypto theft on record, about 4x the $1.5B Bybit hack in 2025.

On Oct 29 Binance hot wallets were drained of about $6.3-6.36B across 10 chains in about 20 minutes, the largest crypto theft on record, about 4x the $1.5B Bybit hack in 2025.

Binance says entry was a compromised DevOps engineer's laptop reaching a service container to submit unauthorized withdrawals, with no private key leak found so far.

TRM Labs attributes the attack with "high confidence" to TraderTraitor, a North Korean unit linked to Lazarus, based on on- and off-chain intelligence and overlap with Bybit and other DPRK operations.

Chainalysis similarly points to North Korea, with CEO Jonathan Levin described as saying it was "likely" the same group due to links to the prior hack. Binance has not officially named culprits.

About $3B is frozen on-chain so far, including over 1.567B USDT by Tether and over 800M USDC by Circle plus Ripple, WLFI and Arbitrum freezes, leaving about $3.3B still movable in BTC, ETH and other assets.

Binance says user funds are safe and losses will be covered from SAFU and company funds, with deposits normal and withdrawals paused for a revamp expected within 48 hours, by about Nov 1.