$6.3 billion across 10 blockchains, with $4.9 billion stolen in the first 14 minutes.
But no private keys were leaked.
I’ll explain how it happened, where the money went, and who may be behind it.
On October 29, at 4:05 PM (New York time), funds began flowing out of Binance’s hot wallets, starting on the XRP Ledger.
Over the next three hours, funds were drained across 10 networks. Withdrawals were only paused at 6:15 PM, 2 hours and 10 minutes later.
That’s more than 4 times the size of the 2025 Bybit hack ($1.40 billion).
How did the attacker get in?
According to Binance, the breach began through an engineer’s laptop, among other intrusion points. From there, the attacker gained access to the system responsible for signing the exchange’s withdrawals.
No one broke the encryption. The attacker turned Binance’s own signing machine against it.
On Ethereum, the attack was more sophisticated.
A recent upgrade, EIP-7702, allows a regular wallet to execute smart contract code. All it takes is a signature.
At 10:59 AM (New York time), hours earlier, the attacker deployed a contract designed for one purpose: draining wallets.
At 4:20 PM (New York time), the attacker used Binance 14, one of the exchange’s largest hot wallets, to sign the connection to this contract.
He sent 50 authorizations at once. Each one targeted a position in the wallet’s transaction queue (the nonce). Only one needed to hit. One did.
Three minutes later came the sweep.
A single transaction drained Binance 14: 167,000 ETH and 63 different tokens.
Approximately $2.5 billion in a single block — the batch of transactions the network finalizes every 12 seconds. It was the largest single movement of the entire attack.
And the wallet remained connected to the attacker’s contract.
Everything sent to it was swept again. A 200 million USDT deposit disappeared in 72 seconds. Another Binance account lost 780 million USDC.
Binance only severed that connection at 8:10 PM, almost four hours later.
Then the race to freeze the funds began.
At 5:01 PM, Tether froze 971 million USDT. At 5:04 PM, Circle froze 823 million USDC. Ripple, WLFI, and Arbitrum followed afterward.
That’s the difference with stablecoins: they have a centralized issuer that can freeze tokens instantly.
The attacker knew this.
In less than 20 minutes, he converted $325 million in stablecoins into ETH. He was willing to take a loss of approximately $40 million just to escape the freezing mechanisms.
On Tron, another $300 million in USDT was converted into TRX.
ETH and TRX have no centralized issuer. No one can freeze these assets.
There was even a ripple effect on Aave.
The attacker deposited $60 million in USDT there and borrowed ETH against it. At 5:47 PM, Aave froze new deposits and borrowing as a precaution.
Many users rushed to withdraw. USDT utilization hit 100%: those who remained could only withdraw once someone repaid their debt.
And where did the Bitcoin go?
18,270 BTC went through a peel chain: a series of transactions in which each step splits off a portion and forwards the remainder.
In this case, each step split off 1,000 BTC. This left 19 addresses, 17 of which hold 1,000 BTC each.
So far, not a single satoshi has moved out.
Breaking down the numbers.
Of the $6.36 billion tracked by TRM Labs, approximately $2.70 billion (42%) has been frozen.
The remaining ~$3.66 billion is still freely movable, mostly in ETH and BTC.
On Ethereum alone, 214,720 ETH are sitting in two newly created wallets. I checked at 8:33 AM today.
And what about Binance’s reserves?
On October 29, a net 22,158 BTC left Binance’s wallets, the second-largest daily outflow since 2017, according to CryptoQuant.
The largest occurred on December 13, 2022, in the aftermath of FTX’s collapse.
But 82% of that outflow was the hack itself: withdrawals remained paused for much of the night.
Why TraderTraitor, a Lazarus Group subsidiary?
ZachXBT tracked the money. Part of the stolen funds passed through THORChain, a bridge that enables cross-chain cryptocurrency swaps.
The funds then landed at an address that had previously received money from the Bitget hack, which was attributed to the same group.
According to ZachXBT, the same actor was behind both incidents. TRM Labs and Chainalysis identify TraderTraitor with "high confidence."
And the pattern keeps repeating. Bybit, Bitget, Binance: they don't break encryption; they target people and processes.
This time, no government has officially confirmed attribution.
Binance said today that it has already begun recovering assets and has allocated more than $6.34 billion from its own reserves, including $5 billion already held in the same tokens that were stolen.
The remainder will be purchased on the open market and through OTC deals, which could take time.
The approximately $3 billion in frozen funds is excluded from this calculation.
So, is everything resolved?
No. The response was swift: billions were frozen within an hour, and the coverage was announced the same night.
But there are still unanswered questions about how 50 authorizations got through. It's also unclear whether the frozen funds will be recovered.
And billions of dollars in ETH and BTC remain in the hacker's hands.
The lesson is the same as always.
The world's largest exchange lost $6.3 billion through an employee's laptop. Your balance there is safe because the company has reserves, not because its system was foolproof.
For trading, use more than one exchange. For long-term storage, self-custody.