Picture this. You wake up on Friday, and the biggest crypto exchange in the world has lost $6.3 billion overnight. By Sunday, you can withdraw your coins again. That is what just happened at Binance, and the speed of it is almost as wild as the theft itself.
Quick take: On October 29, about $6.36 billion left Binance hot wallets in roughly 20 minutes. The FBI now blames North Korea. Three days later, Binance reopened withdrawals in phases and says it has replaced about 95% of what was taken.
What happened on Thursday night
The theft moved fast. Blockchain analysts at TRM Labs tracked about $6.36 billion leaving Binance wallets across ten blockchains, starting at 20:05 UTC on October 29, with most of it gone in about 20 minutes. Bitcoin alone accounted for 18,270 BTC, worth about $1.47 billion. That makes it the largest crypto theft on record, about four times the $1.5 billion Bybit theft of February 2025.
Binance paused withdrawals, said it was checking a security problem, and later said user funds were safe. Stablecoin issuers and partners froze about $2.7 billion of the stolen assets, which left a large part of the haul stuck before it could be cashed out.
- October 29: about $6.36 billion drained from hot wallets, withdrawals paused.
- October 31: the FBI names North Korea as responsible.
- November 1: phased withdrawals reopen, starting with Bitcoin.
Who the FBI named
On October 31, the FBI said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance. Working with the Secret Service and the criminal division of the IRS, the bureau said it had watched TraderTraitor actors turn the stolen assets mostly into Ethereum, and it expects more laundering through DeFi platforms and instant swap services.
TraderTraitor is the name US agencies use for a North Korean hacking unit tracked as part of the Lazarus Group. The FBI blamed the same group for the Bybit theft last year, and for smaller exchange thefts before that. Binance itself has not confirmed who was behind this attack, and said it found no sign of a wallet private key leak.
What came back on Sunday
Phase one opened on November 1 between 06:00 and 09:00 UTC, with Bitcoin first. Founder Changpeng Zhao confirmed it in a short post: BTC withdrawal is live. The first phase covers selected coins across 15 networks, including Ethereum, BNB Smart Chain, Tron, Solana, XRP Ledger, Zcash and Dogecoin. On Ethereum and BNB Smart Chain, stablecoin withdrawals for USDC and USDT came back along with ETH and BNB.
Binance says it has now replaced about 95% of the affected assets, up from 80% in its first update and 90% on October 31, using company funds including its emergency SAFU reserve. Balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, and a new proof-of-reserves snapshot from October 31 is out, with full cryptographic proof expected by November 3. The remaining 5% is less liquid tokens that take longer to buy back at scale. There is no date yet for phase two, and Binance warned of delays while traffic stays high.
For all the chaos, the market stayed oddly calm. Bitcoin traded near $78,000 over the weekend, after dipping to about $77,300 on Thursday, and the fear and greed gauge moved back to neutral.
Why I am watching this one closely
Two things stick with me. First, the cover. Binance paid from its own pocket and says users will not bear the loss. That is the difference between a bad week and a dead exchange. Plenty of exchanges in past hacks could not say the same.
Second, the lesson that never changes. Coins sitting on an exchange are coins trusting someone else's security team. Hot wallets are the online wallets an exchange uses for everyday payouts, so they are the first target when attackers get in. A lot of people only learn that after a hack, not before.
I am not saying everyone should pull everything off every exchange tomorrow. I am saying this week is a good reminder to check how much of your own crypto lives somewhere you do not control, and whether you are comfortable with that number.
So here is my question for you. If an exchange covered every cent after the biggest theft in crypto history, would you keep your coins there? Or would the first open withdrawal window be your exit? Tell me what you would do in the comments.
Cover image: AI-generated.
