Binance lost $6.3 billion in twenty minutes. Users pulled another $3.6 billion the day it reopened

On the evening of October 29, starting at about 20:05 UTC, someone began emptying Binance’s hot wallets. Most of it was over in twenty minutes. By the time a second wave hit the exchange’s Avalanche and Polygon wallets three hours later, roughly $6.3 billion in crypto had walked out of the world’s largest exchange. The FBI says North Korea did it.

Binance froze all withdrawals and deposits. It reopened on Sunday, November 1, in phases. Between 06:00 and 15:30 GMT that day it processed about $4.65 billion in withdrawals against $1.01 billion in deposits, a net outflow of $3.64 billion. Binance pointed out that this is a little over 2% of the $171 billion it holds for customers, and that the spike faded through the afternoon. Both things are true. It is also the biggest single-day bank run a crypto exchange has survived.

What was taken

TRM Labs, one of the forensics firms tracing the funds, tallied the theft at about $6.36 billion across ten chains. The bulk was on Ethereum: around 200,000 ETH plus 185 other tokens, including nearly $1.9 billion in USDT and over $800 million in USDC. Then 18,270 BTC, worth about $1.47 billion. Then roughly $630 million on Tron, mostly USDT, and about $300 million in XRP.

Solana is a footnote in the breakdown: 970,500 SOL, about $96 million, and only SOL, no SPL tokens. That is worth saying plainly because the first thing a lot of people in the memecoin crowd wanted to know was whether their chain had been touched. It was, but as a rounding error on a theft that was mostly ETH, BTC and dollar stablecoins.

How it happened, as far as anyone knows

Binance hasn’t published a root cause. Its first statement pointed at a compromised laptop belonging to a DevOps engineer. A few days later co-CEO Richard Teng said the attack was more complex than one engineer’s permissions being abused, and that the company had found no evidence of stolen private keys.

TRM’s read of the on-chain evidence is that the attacker got control of Binance’s hot wallet signing infrastructure. On Ethereum they used an EIP-7702 delegation with fifty pre-signed authorizations to turn a Binance wallet into a sweeper, which is a technique that didn’t exist before the Pectra upgrade in 2025. On the other nine chains the wallets simply sent ordinary signed transfers. Whatever the entry point was, the attacker ended up able to sign as Binance on ten networks at once.

Where the money is going

The laundering started within the hour and is still going. According to TRM, about 325 million USDT was dumped to market makers through UniswapX for roughly 122,300 ETH, at a discount of more than 10%, which tells you how motivated the seller was. Another wallet deposited 60 million USDT into Aave and borrowed ETH against it. On Tron, 300 million USDT went into JustLend. The Bitcoin is being chopped into 1,000 and 100 BTC pieces in a classic peel chain.

The attackers are layering these funds across many thousands of addresses.

Alec Zebrick, Chainalysis, to the BBC

The stablecoin issuers moved fast and that is the one piece of good news. Tether froze about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD, and World Liberty Financial 27.8 million USD1. Arbitrum’s security council froze another $30 million or so. TRM puts total freezes near $2.7 billion. The attacker is still sitting on more than 420,000 ETH and the full 18,270 BTC, about $2.4 billion that no issuer can freeze, because nobody controls ETH or BTC.

The FBI published a list of wallet addresses tied to the group and asked exchanges and issuers to block anything touching them. The US Secret Service says it is working on recovery. In practice, recovery from North Korea has historically meant single-digit percentages at best.

Who pays

Binance, it says. The company’s line is that it will absorb the full financial impact and that users lose nothing. As of its reopening it had restored backing for about 90% of the stolen assets, with BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC fully covered. The remaining 10% is in less liquid tokens outside its top ten that it says it is still buying. The BBC reported the figure as 95% a day later. The money came from the SAFU emergency fund, part of the futures insurance fund, and the corporate treasury. Binance said it had set aside more than $6.3 billion for the job.

Worth a moment of perspective: an exchange that can write a $6 billion check out of its own reserves and keep operating is, in a strange way, the strongest possible argument that Binance is solvent. It is also an argument that nobody should have to find out that way.

What this means if you trade memecoins

Most people reading this site don’t keep much on Binance. You buy SOL there, move it to a wallet, and the rest happens on-chain. But a lot of traders keep a float on a centralized exchange for the on-ramp, for stablecoins, or just out of habit. This week is the reason the old advice exists.

• An exchange balance is an IOU. Binance honored its IOU, at a cost of $6 billion. Not every exchange could. FTX couldn’t, and that was a $477 million hole, not a $6 billion one.
• Withdrawals can stop without warning. Binance was closed for three days. If your trading plan needs SOL on a Tuesday and the exchange is frozen, you don’t have a trading plan.
• Freezes cut both ways. The $2.7 billion the issuers froze was stolen money, and freezing it was the right call. It is also a reminder that USDT and USDC balances can be frozen by a company, anywhere, including yours.
• Keep the float small. Enough on the exchange to buy what you’ll move today. Everything else in a wallet you control, with the seed written down offline.
• Watch for the second wave of theft. Every big hack is followed by phishing campaigns pretending to be the exchange’s “compensation portal”. Binance has said it will cover users automatically. There is no form to fill in, no wallet to connect, no claim link. Anyone sending you one is the attacker’s little cousin.

None of this means Solana users were safer because the chain lost only $96 million. The attackers took what Binance held, in proportion to what Binance held. Had it been a Solana-heavy exchange, the number would have been Solana-heavy. The lesson isn’t about chains. It is about who holds the keys.

We’ll update this piece when Binance publishes a root cause, or if any meaningful recovery happens.