Twenty minutes, ten blockchains
Binance has pledged to cover customer losses after an attacker drained roughly $6.36 billion from its wallets on 29 October. Most of the funds moved in about 20 minutes starting at 20:05 UTC, across ten networks including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
The exchange confirmed a security incident and suspended withdrawals on several networks while it investigated. By the weekend it said around $3 billion of the stolen assets had potentially been located and frozen across other exchanges, though it was not clear how much of that would be recoverable. Tether and Circle together froze about $2.38 billion in stablecoin balances tied to the flows.
The largest crypto theft on record
Analytics firm Chainalysis and other industry researchers called it the biggest crypto heist ever, about four times the $1.5 billion taken from Bybit in February 2025. TRM Labs and several news organisations have attributed the attack to TraderTraitor, a group linked to North Korea, though Binance has not confirmed attribution.
Binance co-CEO Richard Teng said the company's investigation had not yet identified the attackers. The exchange said user balances would be restored in full and that it would publish a fuller account of what happened once forensics were complete.
What it means for the industry
The breach lands on a market already under pressure. Crypto prices had been sliding through October as investors questioned the returns on heavy spending on artificial intelligence, and the hack gave sceptics another argument. Custody arrangements, insurance cover and the concentration of assets on a single exchange are back at the centre of the debate.
Regulators in several jurisdictions are expected to ask how the attacker moved funds across ten chains without triggering circuit breakers. For ordinary users, the practical question is withdrawal access. Binance has restored service on some networks and says the rest will follow in stages as checks are completed.