At 20:05 UTC on Oct. 29, five Binance wallets on the XRP Ledger began sending their balances to a single address. Within about 20 minutes, Binance wallets on ten blockchains had been drained. TRM Labs puts the total at about $6.36 billion, the largest crypto theft on record and about four times the $1.5 billion Bybit hack in February 2025.
Most coverage will focus on North Korea and the record. I’m more interested in the millions of people who don’t trade on Binance but use it as their on- and off-ramp, which includes a large share of crypto casino players. If you moved money from Binance to a casino this week, or planned to withdraw winnings back to it, the hack affects you directly.
Key Takeaways
- Size: About $6.36B taken across ten blockchains, most of it in about 20 minutes (TRM Labs).
- Who: TRM attributes the attack “with high confidence” to TraderTraitor, North Korea’s top hacking unit. Chainalysis agrees. Authorities haven’t confirmed it.
- How: Binance’s first findings point to a compromised employee laptop. TRM’s assessment is that the attacker gained control of Binance’s hot-wallet signing system.
- Frozen: About $2.7B was frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum. Binance puts the figure at $3B.
- Still held by the attacker: About $2.4B in ETH and BTC that no issuer can freeze.
- Binance’s response: It has reserved $6.34B to cover user losses and paused withdrawals, with no timeline yet for resuming.
The Binance Hack in Numbers
| Metric | Figure | Source |
|---|---|---|
| Total taken | ~$6.36B | TRM Labs |
| Blockchains hit | 10 | TRM Labs |
| Time for most of the theft | ~20 minutes | TRM Labs |
| Compared with Bybit (Feb. 2025) | ~4x | TRM Labs |
| Ethereum losses | ~$3.79B (incl. 1.875B USDT, 823M USDC) | TRM Labs |
| Bitcoin losses | 18,270 BTC (~$1.47B) | TRM Labs |
| Stablecoins and assets frozen | ~$2.7B (TRM) / $3B (Binance) | TRM / Binance |
| Still held by the attacker | ~$2.4B (420,000+ ETH, 18,270 BTC) | TRM Labs |
| Funds Binance reserved for users | $6.34B ($5B already in matching tokens) | Binance |
| Market liquidations | ~$1.5B | Bitcoin.com News |
| Bitcoin price | Down ~4.6%, below $77K | Market data |
How the Attack Worked
TRM’s breakdown shows the attack was planned well in advance. Preparation started at least 36 hours earlier, when the attacker’s operator wallet received small withdrawals from the Tornado Cash mixer. The attacker tested the code on two wallets, rehearsed on a third, and installed it on a Binance hot wallet four hours later.
On Ethereum, the attacker used EIP-7702, a feature added in May 2025 that lets a wallet hand control to a smart contract by signing an authorization. The attacker submitted one transaction containing 50 pre-signed authorizations, each matched to a different point in the wallet’s transaction count, so that one would be valid when the transaction ran. One was. Three minutes and 24 seconds later, the wallet sent out 167,464 ETH and 1.615 billion USDT. The attacker kept control and swept new deposits six more times that night.
On the other nine chains, Binance’s own wallets signed ordinary transfers to the attacker. “In TRM’s assessment, the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains,” the firm wrote. Binance has not yet published a root cause.
The Freeze Race
Stablecoin issuers moved quickly. Tether froze 971.1 million USDT 37 minutes after the main sweep. Circle froze 823 million USDC “in coordination with law enforcement.” Ripple and World Liberty Financial froze their own tokens, and Arbitrum’s Security Council forced about $30 million out of the attacker’s wallet.
The attacker responded by converting freezable stablecoins into ETH as fast as possible. About 325 million USDT was sold to market makers at a discount of more than 10%. Another wallet put 60 million USDT into Aave and borrowed ETH against it before Aave froze the affected markets.
Binance’s Response
Binance says it has reserved more than $6.34 billion in company funds, and that “$5B of these funds are already held in the exact token assets that were impacted.” It is buying the rest through over-the-counter and market channels.
“This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can,” the exchange said. It gave no date for resuming withdrawals. “We will weather this storm.”
One analyst told CNBC the breach doesn’t currently appear to pose a significant solvency risk.
What Crypto Casino Players Should Do This Week
This is the practical part. None of it is financial advice, just basic precautions after a major exchange hack.
1. Expect delays if your money goes through Binance. If you fund casino play from Binance or withdraw winnings to it, those transfers are stuck until it reopens. Don’t rush to use an unfamiliar bridge or swap service to get around the pause. Those are exactly the services the attacker’s laundering will flow through.
2. Watch for phishing. Every major hack is followed by fake “Binance support” messages, fake refund portals and fake compensation claims. Binance won’t ask for your seed phrase or ask you to connect your wallet to a site to claim a refund.
3. Don’t sign wallet prompts you don’t understand. The Ethereum part of this hack relied on EIP-7702 authorizations. The same technique is now used by wallet-drainer scams aimed at ordinary users. If a dApp, airdrop or “casino bonus” asks you to sign a delegation or authorization you didn’t expect, reject it.
4. Be careful with crypto from unknown sources. Stolen funds will move through peel chains and OTC desks in the coming days, and TRM is telling exchanges to screen deposits against the attacker’s addresses. If you accept peer-to-peer crypto from someone you don’t know, it could be traced back to the hack and get your account flagged or frozen.
5. Keep only what you need on any platform. This applies to exchanges and casinos alike. The money most at risk in any hack is in hot wallets, the internet-connected wallets used to process withdrawals. Holding what you’re actively playing with and withdrawing the rest to self-custody limits your exposure to any single company’s security.
6. Ask your casino how it stores funds. Does it keep most player balances in cold storage? Does it publish proof of reserves? How does it handle withdrawals when the market is volatile? A trustworthy operator will answer clearly.
7. Remember that crypto balances move with the market. Bitcoin fell about 4.6% in a day. Balances held in BTC or ETH lost value with it. Stablecoins hold their value better, but this hack showed their issuers can freeze them within minutes.
The Bigger Picture
What I keep coming back to is that the largest crypto hack in history hit the largest, best-funded exchange, and the weak point was operational security, not cryptography. If Binance’s signing system can be made to sign transactions for an attacker on ten chains in half an hour, every smaller platform holding player funds in hot wallets should be reviewing its own setup this week.
Bybit made users whole in 2025 and recovered. Binance looks likely to do the same. But “your funds are safe” depends on the exchange having $6.34 billion available. Most platforms that hold crypto for players don’t.
FAQ: Binance Hack
How much was stolen from Binance?
About $6.36 billion across ten blockchains on Oct. 29, 2026, according to TRM Labs. That makes it the largest crypto theft on record.
Who hacked Binance?
TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean state-sponsored group that the FBI also linked to the 2025 Bybit hack. Authorities haven’t formally confirmed it.
Are Binance users’ funds safe?
Binance says user funds are safe and has reserved $6.34 billion to cover losses. Withdrawals are paused while it buys back the affected tokens.
Should crypto casino players be worried?
Players who use Binance to deposit or withdraw should expect delays. Everyone should watch for phishing, avoid signing unfamiliar wallet authorizations, and keep only active balances on any platform.
