Binance $6.3 Billion Hack: The Largest Crypto Heist on Record and a $3 Billion Freeze
Binance, the world's largest cryptocurrency exchange, said on October 30 that a security breach had an estimated impact of around $6.3 billion, with about $3 billion in affected assets frozen so far. If the estimate holds, it would be the largest crypto heist on record, dwarfing every previous exchange theft and arriving in a single evening of outflows. The exchange has promised to cover all losses from its emergency SAFU fund and company funds, and says user funds are safe. The next few days will test whether that promise, and the freeze, are enough.
The outflows began on the evening of October 29, US time. According to on-chain trackers, a single transaction moved 167,464 ether, about $1.6 billion in USDT and dozens of other tokens out of the hot wallet labelled Binance 14, with transfers from further hot wallets following within minutes. Chainalysis later said it had confirmed at least $5.912 billion stolen, moving across Bitcoin, Ethereum, Tron, Ripple and several layer-2 networks. Binance itself has put the estimated total impact at around $6.3 billion, a figure that includes assets frozen before they could move further, not only money already gone. That distinction matters, and it is why early headlines ranged from $3.3 billion to nearly $6 billion: different trackers were counting different things.
Binance's initial investigation points to a compromised DevOps engineer's laptop, which it says may have allowed an attacker to reach a service container and submit unauthorised withdrawal transactions. The exchange says it has found no evidence of a wallet private key leak, and has revoked the affected address authorisation. That account should be treated as preliminary: the investigation is ongoing, and other security firms have offered a different technical reading, involving Ethereum's EIP-7702 delegation feature. Binance has not confirmed that mechanism, and no attacker has been officially identified. What is not in dispute is the operational response: deposits and withdrawals were temporarily suspended, law enforcement and blockchain intelligence partners were brought in, and stablecoin issuers moved fast.
The freeze is the most encouraging part of the story, and also the most easily misread. Tether froze more than $1.57 billion in USDT, Circle froze more than $800 million in USDC, and Binance said Ripple froze roughly $200 million. The Arbitrum Security Council separately moved 74.56 million ARB tokens linked to the incident into a frozen wallet. Frozen, however, does not mean recovered. A freeze stops tokens moving; returning them to the exchange, and then to users, runs through issuers, courts and law enforcement, and can take weeks. Binance's own verified frozen total rose from $2.54 billion to about $3 billion during the night, which suggests tracing is still catching up with the money rather than finished.
Markets reacted the way they usually do to an exchange breach, only at larger scale. Bitcoin fell about 3% to $76,469.82, a six-week low, and ether fell more than 3% to $2,185.83, according to Reuters. The scale is worth stating plainly: TRM Labs counted $2.9 billion stolen across nearly 150 crypto attacks in all of 2025. A single incident at Binance may have taken roughly twice that annual total in hours. That is not a normal bad day for crypto security; it is a new ceiling for what one breach can cost.
The same day brought a second, separate incident that should not be folded into this one. Polymarket's international exchange was put into cancel-only mode after malicious code loaded through a third-party provider drained user accounts, with on-chain trackers putting losses at roughly $2.6 to $2.7 million. Polymarket said the provider was compromised, referred the matter to law enforcement, promised to make affected users whole, and resumed trading. There is no evidence the two incidents are related, and their scales differ by three orders of magnitude. Conflating them would exaggerate one story and minimise the other.
What happens next is measurable, which is why it is worth watching rather than merely reacting to. Co-founder Yi He has said Binance aims to begin resuming withdrawals within 48 hours. Binance has promised a detailed technical post-mortem once the investigation is complete, and an updated proof of reserves once remediation is complete. Those three deliverables — withdrawals actually reopening, a post-mortem that explains the laptop-to-container path in checkable detail, and a proof of reserves that shows the gap closed — are the test. If they arrive on schedule, the story becomes a case study in how fast freezing can contain even a record-sized theft. If the withdrawal timetable slips, or the post-mortem stays vague, the $6.3 billion figure will matter less than the unanswered question behind it: how did unauthorised withdrawals of this size pass through the controls of the world's largest exchange in the first place?