Binance hack: $3bn of $6.3bn frozen, North Korea group blamed

Key takeaways

• About $6.36 billion in crypto left Binance wallets on Oct 29, most of it in roughly 20 minutes starting at 20:05 UTC, according to blockchain analytics firm TRM Labs; Binance put the impact at about $6.3 billion.
• Binance says it has started recovering assets, that about $3 billion has been frozen, and that it will cover losses through its Secure Asset Fund for Users (SAFU) and company funds, according to CNBC and CBS News.
• TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean state-backed hacking group. Binance has not confirmed who was responsible.
• About $2.4 billion, held mainly as ether and bitcoin, is "beyond any issuer's reach," TRM Labs said, because those coins cannot be frozen by a stablecoin issuer.
• In Thailand, Binance TH operator Gulf Binance said Thai customers' assets were safe but paused deposits and withdrawals, and the Thai SEC said it had found no significant impact on assets held by operators in Thailand.

Binance hack: what happened

Binance is trying to claw back crypto worth about $6.3 billion taken in a hack that began at 20:05 UTC on Thursday, Oct 29. The exchange says roughly $3 billion is frozen so far, and blockchain analysts link the attack to North Korea.

TRM Labs, which tracks funds on public blockchains, said the first transfers came from five Binance wallets on the XRP Ledger between 20:05 and 20:09 UTC. At 20:20 UTC, Binance's bitcoin hot wallet, an online wallet used for daily transfers, sent 18,270 BTC to the attacker. Its Ethereum hot wallet sent a transaction at the same minute, and about 3 minutes 24 seconds later the wallet's entire balance was swept, according to TRM. A second wave hit Binance wallets on Avalanche and Polygon at about 23:05 UTC.

By TRM's count, the theft was worth about $6.36 billion at the time it happened, roughly four times the $1.5 billion taken from the Bybit exchange in February 2025. CBS News called it the largest crypto theft on record, and TRM's Ari Redbord described it to CBS as the "largest bank robbery in human history."

How the recovery effort works

The fastest recoveries came from stablecoin issuers, which can freeze tokens on their own networks. TRM said Tether froze the attacker's main USDT wallet at 21:01 UTC and Circle froze the main USDC wallet at 21:04 UTC, both within about an hour of the first transfers. Ripple froze 40.5 million RLUSD at 22:01 UTC, and World Liberty Financial froze 27.8 million USD1 at 22:10 UTC.

Binance's own figure is higher: a company spokesperson told CBS News that about $3 billion in crypto assets had been frozen in total. TRM noted that Binance had reported a verified frozen total of $2.54 billion at 23:35 UTC on Oct 29, so the two counts reflect different cut-off times.

Freezing is not the same as getting the money back. CBS News reported that law enforcement would need a seizure warrant to move frozen funds into a US government account, followed by a civil forfeiture case in court. CNBC reported that issuers could also burn the frozen stablecoins and reissue them to return value to Binance.

Why about $2.4 billion may be hard to recover

Before the freezes landed, the hackers sold about 325 million USDT to market makers for roughly 122,300 ETH, accepting a discount of more than 10%, TRM said. That left the attacker holding more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion and outside the control of any issuer.

Investigators now expect the funds to move through cross-chain bridges, swap services and over-the-counter brokers. "That becomes the challenge, that's sort of this race against time," Redbord told CNBC. Chainalysis CEO Jonathan Levin told CNBC that the firm saw "laundering patterns we have not seen before," and that seizure chances shrink as funds move further from the original theft.

What we know and what we don't know yet

• Known: the size and timing of the outflows, the main frozen amounts, and Binance's pledge to cover user losses through SAFU and company funds.
• Known: Binance temporarily suspended withdrawals and said deposits were unaffected; co-founder Yi He said withdrawals should resume within 48 hours, according to CNBC.
• Not confirmed: who carried out the attack. TRM said it attributes the hack to TraderTraitor "with high confidence," and Chainalysis reached a similar view, but Binance has not confirmed the attribution.
• Not confirmed: the root cause. Binance first pointed to a compromised engineer's laptop, CNBC reported, while co-CEO Richard Teng later said the attack was more complex. TRM said the evidence points to a compromise of Binance's hot wallet signing infrastructure. Binance has not published a full post-mortem.

The Thailand angle: Binance TH and the Thai SEC

Binance TH, the licensed Thai exchange run by Gulf Binance Co., Ltd., said Thai customers' digital assets remained safe because its offline cold wallets are kept separate from Binance's wallets, The Nation reported on Oct 30. The Thai platform runs as a separate legal entity with its own custody system. It still paused crypto deposits and withdrawals as a precaution while specialists ran security checks, and said other services continued.

Thailand's Securities and Exchange Commission said it had found "no significant impact on customer assets held by operators in Thailand," based on reports from operators, according to The Nation. The regulator stressed that the hack hit Binance's overseas platform, which it does not supervise. It told licensed operators to keep assessing risks, check the security of customer assets, report any incident immediately and give customers timely information. It also warned investors about rumours and scams exploiting the incident.

No statement from regulators in Indonesia, Singapore, Malaysia, the Philippines or Vietnam had been found by 00:00 UTC on Oct 31.

Background

The FBI attributed the 2025 Bybit hack to the same TraderTraitor group, CBS News reported. CNBC said the FBI was aware of the Binance incident and was coordinating with public and private partners. The hack also hit crypto-linked shares on Wall Street on Oct 30, as covered in our US stocks brief for Oct 30. Our crypto brief for Oct 29 tracked the first reports of Binance withdrawal pauses. More coverage is on the Binance and Bitcoin topic pages.

What it means

For investors in Southeast Asia, the Thai case shows why the legal structure behind a local exchange matters. A licensed domestic platform with segregated custody, such as Binance TH, can say its customers' assets are separate from the global exchange's wallets, while users of the offshore Binance platform depend on Binance's pledge to make them whole. The next things to watch are when withdrawals fully reopen, how much of the frozen $2.7 billion to $3 billion actually returns to Binance, and whether the $2.4 billion in unfrozen ether and bitcoin can be traced as it is laundered.

Related on Bullquill

• Bitcoin Rises 0.56% on Oct 28, 2026 as Fed Holds Rates Steady
• Bitcoin Rises 0.99% on Oct 27, 2026 as Traders Eye Fed Decision
• Why bitcoin is falling: five-day slide to $80,000 amid ETF outflows
• Bitcoin Slips 0.06% on Oct 26, 2026 as Traders Await Fed Decision
• Electrum vulnerability: 4.8.3 fixes rogue-server bitcoin theft

This article is for information only and is not investment advice.