Someone hacked a Binance engineer’s laptop and walked away with at least $6.3 billion in crypto. It is the largest known theft of crypto in history, and the FBI has now blamed North Korea’s TraderTraitor group for it. On Sunday, November 1, Binance began switching withdrawals back on and said it has covered 95% of the stolen assets. Here is what happened, who did it, and what crypto holders should do about it.
How the Binance Hack Happened
Binance shared its initial findings on X after the breach. The attackers broke into the company’s network by targeting a compromised Binance engineer’s laptop, which “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
That detail matters. This was not a smart contract exploit or a broken blockchain. It was a device compromise that turned into withdrawal access. Binance said it has seen no evidence that its private keys leaked, which would have been far worse and given the attackers near-unfettered control over the exchange’s stores of crypto.
The theft itself was huge even by crypto standards. Security researchers estimated that at least $6.3 billion in crypto left Binance’s wallets, though about half of that was frozen as the stolen coins travelled across various blockchains. The Hacker News reports that the FBI put the figure at $6.43 billion as it attributed the attack to TraderTraitor, the North Korean hacking collective behind several earlier crypto heists. Either way, the breach dwarfs every previous crypto theft on record.
What Binance Did Next
Binance froze all deposits and withdrawals while it investigated, a move that left millions of users unable to move funds for days. The company said “user funds are safe” and promised to publish an updated proof of reserves once remediation is complete.
On Sunday morning, the exchange started resuming withdrawals in phases, depending on the network and asset type. Its network status page showed a mix of states: Bitcoin withdrawals and deposits were listed as partially suspended, Ethereum deposits were normal and Ethereum withdrawals partially suspended. Binance warned users to expect “temporary delays or longer processing times due to traffic volume.”
On the money side, Binance said it has now covered 95% of the stolen assets and is still buying the “remaining affected assets,” which are “less liquid in the market and take longer time to source at the required scale.” The company was blunt about who pays: “Our commitment remains unchanged: Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users.”
The first day back was busy. Binance said that between 6am and 3:30pm Coordinated Universal Time it processed $4.6 billion in withdrawals and $1.0 billion in deposits, a net outflow of $3.6 billion, or about 2.1% of its total assets under management. The company says a full incident report will follow when its investigation is complete.
Timeline of the Binance Breach
How the incident unfolded over four days:
- October 29: TechCrunch reported that Binance had paused withdrawals across some of its blockchains as hackers were suspected of stealing billions in crypto.
- October 30: Binance confirmed the breach in a post on X, disclosing the compromised engineer laptop and freezing all deposits and withdrawals. Researchers estimated at least $6.3 billion stolen, with about half frozen as the coins moved across chains.
- October 30 to November 1: The FBI attributed the heist to North Korea’s TraderTraitor group, in what reports describe as a record crypto theft.
- November 1: Binance resumed withdrawals in phases, said it had covered 95% of the stolen assets, and confirmed it will absorb the losses rather than pass them to users.
Why North Korea Keeps Targeting Crypto
The FBI’s attribution to TraderTraitor fits a pattern security teams have watched for years. North Korean hacking crews have repeatedly targeted crypto exchanges and blockchain firms, and the stolen funds are widely reported to support the country’s weapons programmes. Chainalysis and other researchers have tracked billions of dollars in such thefts over the past decade.
The common thread in these attacks is rarely the blockchain itself. It is people and devices: phishing a developer, compromising a laptop, hijacking a session, or abusing an internal tool that was trusted a little too much. In Binance’s case, one laptop gave the attackers a bridge into a service container that could authorise withdrawals.
For the industry, the lesson from our earlier coverage of crypto breaches is the same each time: the weakest link is rarely the smart contract and almost always the human or device with privileged access.
What Crypto Holders Should Do Now
Whether you use Binance or any other exchange, an incident like this is a good moment to tighten your own setup.
- Move long-term holdings off exchanges. Hardware wallets keep your coins under your own keys, so an exchange breach cannot touch them.
- Turn on the strongest account protection available: an authenticator app or hardware security key for two-factor authentication, not SMS.
- Allowlist withdrawal addresses so funds can only go to addresses you have pre-approved.
- Expect phishing surges after big breaches. Fake “Binance support”, fake refund links and fake airdrop claims follow incidents like this. Never click a recovery link sent to you; go to the official site yourself.
- Check the exchange network status page before large transfers while services are stabilising, and keep transaction sizes modest until normal service is confirmed.
- Spread risk. Keeping everything on one exchange concentrates exactly the kind of risk this breach shows.
Binance says it will keep strengthening safeguards and completing the recovery process. Users do not need to do anything beyond normal account hygiene, but the incident is a reminder that “not your keys, not your coins” is not just a slogan.
Frequently Asked Questions
Who hacked Binance?
The FBI has attributed the heist to North Korea’s TraderTraitor hacking group. The attackers got in through a compromised Binance engineer’s laptop, which gave them access to a service container that could submit unauthorised withdrawal transactions.
How much was stolen in the Binance hack?
Security researchers and TechCrunch put the figure at least $6.3 billion in crypto, with about half frozen on-chain. The FBI’s figure, reported by The Hacker News, is $6.43 billion, making it the largest known crypto theft in history.
Are Binance withdrawals working now?
Withdrawals resumed in phases on Sunday, November 1. Binance warned of temporary delays, and its network status page still showed some assets partially suspended. Check the status page before transferring.
Did Binance users lose money?
Binance says no. The company stated it will bear the financial impact of the stolen funds and that the losses will not be passed on to users, and it has covered 95% of the stolen assets so far. A full incident report is promised after the investigation.
The recovery work continues, but the direction of travel is clear: exchanges are high-value targets, and your safest move is to hold what you cannot afford to lose under your own keys.
