Binance says a compromised engineer's laptop led to $6.3 billion in unauthorised withdrawals, the largest crypto theft on record. Tether and Circle froze $2.8 billion within an hour. $2.9 billion is still moving.
It took 40 minutes to pull off one of the largest thefts in crypto's history and 37 minutes for the first $1.4 billion of it to be frozen. Binance, the world's largest exchange, confirmed on Thursday that an attacker gained access to a service container through a compromised DevOps engineer's laptop and submitted unauthorised withdrawals worth about $6.3 billion. That is four times the $1.5 billion taken from Bybit in February 2025, the previous record.
The market took it badly but not catastrophically. Bitcoin traded at $77,951 at 08:30 UTC on 30 October, according to recent data from CoinGecko, down 2.3% in 24 hours, with Ether at $2,224, down 3.4%, and BNB down 6% at $705.84. Total crypto market cap stood at $2.73 trillion. CoinGecko's market summary put liquidations at about $1.5 billion in the hours after the breach.
Arkham's on-chain reconstruction puts the theft at $6.01 billion from Binance hot wallets on nine chains, with $4.9 billion of it gone in under 15 minutes. The first outflow was 965,455 SOL at 20:10 UTC. Ten minutes later, 18,270 BTC left in 11 transactions inside a single block. Four minutes after that, one Ethereum transaction pulled 64 different tokens worth $2.53 billion from the wallet labelled Binance 14.
By chain, according to Arkham: $3.74 billion on Ethereum, of which $1.88 billion was USDT and $823 million USDC; $1.47 billion in Bitcoin; $628 million on Tron, almost all USDT; $96 million in SOL; and $78 million across Arbitrum, Avalanche, Polygon, Optimism and Base.
The attacker funded the address through Tornado Cash hours earlier and sent an EIP-7702 transaction with 50 authorisations to Binance 14 at 20:20 UTC. AMLBot, which tracked the flows live, said the attack "was prepared in advance" and tested on smaller wallets first, but that "the exit was not and showed signs of panic."
What makes this hack different from Bybit's is how much of it the issuers caught. Tether blacklisted the attacker's USDT at 21:01 UTC, 37 minutes after the sweep, according to Arkham. Circle froze the USDC at 21:04. Together with smaller freezes of wBETH, XAUt, RLUSD, USD1 and PAXG, the frozen total reached $2.8 billion, or roughly 47% of what was taken.
AMLBot described Tether blacklisting new wallets "within 2 to 3 minutes of detection" as the attacker tried to split USDT across fresh addresses to outrun it. The stablecoins, it noted, "were only moved between new addresses, not swapped, not bridged," which is not how Lazarus Group has historically laundered.
The $2.9 billion that got away is in assets no issuer can freeze: 495,724 ETH across 10 addresses, 18,270 BTC parked in 1,000-BTC lots across 19 addresses and unmoved since 20:48 UTC, 683 million TRX and 970,000 SOL. Arkham also counted $911 million swapped before the freezes landed, including $435 million of USDT sold for ETH at about $2,711 per coin, 15 to 20% above market, which is the price of needing to move fast.
A claim circulating on X that the attacker deposited stolen USDT into Aave as collateral and borrowed ETH against it before the freeze, leaving the protocol holding blacklisted tokens, does not appear in either Arkham's or AMLBot's breakdown. Block Insider could not verify it, and Aave had not commented as of publication.
CEO Richard Teng's statement was unusually direct. "Bottom line, your money is safe, and we're covering every loss," he wrote on X. The initial investigation "suggests this security incident may have started with a compromised DevOps engineer's laptop," giving an attacker access to a service container to submit withdrawals.
He added:
"The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action. It involved a more complex attack process."
Binance says it has found no evidence of a private key leak, has revoked the affected address authorisations, suspended withdrawals while it rebuilds the withdrawal service, and engaged law enforcement. Deposits are operating. A technical post-mortem and an updated Proof of Reserves will follow once remediation is complete. Co-founder Changpeng Zhao said earlier that "it does look like a hack on Binance" and that user funds were safe.
Reports attributing the attack to North Korea's TraderTraitor unit circulated within hours, including one from CNN. Binance has not attributed it to anyone, and AMLBot said North Korean involvement "is being discussed but is not confirmed," pointing to a laundering pattern that differs from Lazarus's usual playbook.
Two numbers decide the next few days. The first is $2.9 billion: whether the ETH and BTC start moving through mixers and bridges, which would confirm a state-level laundering operation, or stay parked, which would suggest the attacker has fewer options than the headline figure implies. The 18,270 BTC has not moved since 20:48 UTC on Wednesday.
The second is the SAFU fund. Binance has said it will cover all losses from SAFU and company funds, and the updated Proof of Reserves will show what that cost. Until withdrawals reopen, which Binance has said should be within 48 hours of the fix, the open question for users is operational rather than financial.
For the market, the precedent that matters is Bybit. Bitcoin fell about 20% in the month after February 2025's hack, though macro conditions did most of that work. At $77,951, Bitcoin sits just above the $77,500 level prediction markets flagged two weeks ago as the next support. If the parked BTC starts to move, that level gets tested.
No comments yet
