binancehack

The biggest exchange hack crypto has ever seen happened last night, and the timeline is wild. Here is the verified picture so far, without the memes and the panic.
How it happened
Binance says its initial investigation points to a compromised DevOps engineer's laptop. That gave the attacker access to a service container, which was used to submit unauthorized withdrawal transactions. Binance says it found no evidence that any wallet private key leaked.
Arkham's reconstruction shows how fast it went. About $4.9B of the roughly $6B left in under 15 minutes on October 29 (UTC):
→ 20:10: 965,455 SOL out on Solana
→ 20:20: 18,270.2 BTC in 11 transactions, all in one block
→ 20:24: a single Ethereum transaction pulled 64 tokens worth about $2.53B
The sending address was funded through Tornado Cash two hours earlier.
The fightback
This is the part that matters for anyone holding funds. Tether blacklisted the stolen USDT 37 minutes after the sweep. Circle froze the USDC three minutes later. Arkham counts about $2.8B frozen, including $1.77B USDT and $824.56M USDC. Binance's own figure is around $3B frozen on-chain.
Binance says it will cover all losses from the SAFU fund and company money, and will publish an updated Proof of Reserves after remediation. Deposits are working again. Withdrawals stay paused for a security revamp and are expected back within 48 hours.
CZ's message: "It hurts, but we will survive."
What the attacker still holds
Not everything could be frozen. Arkham tracks about $2.9B still movable:
→ 495,724 ETH
→ 18,270.2 BTC, split into 1,000 BTC lots across 19 addresses
→ 682.9M TRX and 970,545 SOL
Some ETH is already moving. Onchain Lens flagged 17.26K ETH sent to a fresh wallet, likely heading to mixers.
Who is behind it
ZachXBT says funds from this exploit and the $388M Bitget exploit were mixed at the same address after passing through THORChain. Bitget was attributed to the North Korea-linked group TraderTraitor, so the same actor is the main suspect here too. Not officially confirmed yet.
The market hit
$BTC slid from about $80.3K to $76,418 overnight, and more than $1.1B in positions were liquidated in 24 hours, mostly longs.
$BNB took the hardest hit among majors, down about 5% on the day.
My take
The scary number is $6.3B. The number I care about is $3B frozen within an hour. A few years ago an exchange hack this size would have meant a bank run and a dead platform. Now the stablecoin issuers act in minutes and the exchange says it will eat the loss. The real risk is the 18K BTC and 495K ETH that can still hit the market.
Next 48 hours, three things to watch: withdrawals reopening on time, the post-mortem, and whether those 1,000 BTC lots start moving to exchanges.
What worries you more right now: the hacker's unfrozen BTC, or the trust hit to CEXs?
#BinanceHack #BTC #BNB #CryptoNews #SAFU

Binance Hit by Biggest Crypto Hack in History: What We Know
Binance, the world’s largest crypto exchange, has been hit by a theft estimated at $6.3 billion, and investigators are already pointing at North Korea.
What happened
On October 29, Binance began investigating suspicious outflows from its hot wallets, the online wallets that process customer withdrawals. Withdrawals were suspended while the incident unfolded. Tether and Circle froze more than $2.38 billion in stablecoins tied to the incident. Binance said about $3 billion in assets had been frozen, with more freezes possible as investigators trace the funds.
The final loss is estimated far higher than what was frozen. Binance’s estimated impact is $6.3 billion, and Chainalysis put the theft at $6.4 billion. If confirmed, it would surpass the $3.5 billion LuBian hack of 2020 and the $1.5 billion Bybit hack of 2025.
How the attackers may have done it
Binance hasn’t confirmed the method. Blockaid’s CEO said the preliminary evidence points to compromised signing infrastructure rather than a leaked private key, meaning attackers got a legitimate signing system to approve malicious transactions. Blockaid’s onchain analysis found 50 EIP-7702 authorizations bundled into one transaction, delegating an account to an unverified contract that could drain its funds. One headline reports Binance itself pointing to an engineer’s hacked laptop, though details are thin.
Who’s suspected
TRM Labs attributed the attack to North Korea’s TraderTraitor group with “high confidence,” and Chainalysis’ CEO reached the same assessment. ZachXBT found that funds from Binance and the earlier Bitget exploit ended up at the same address after passing through THORChain, suggesting one actor behind both. These attributions come from private analysts, not a government finding.
The playbook fits TraderTraitor’s history. The FBI says the group targets employees through social engineering, and in a 2024 case an attacker posing as a recruiter sent a malicious coding test to an employee of a wallet provider.
Market impact
BNB fell about 8% and Bitcoin slid toward $77,000 as the news spread.
What it means for you
Funds on exchanges are never fully safe. Even the biggest platforms can fail, so keep only what you’re actively trading on an exchange.
Watch for follow-on scams. Fake “Binance recovery” or “compensation” messages typically spread after an incident like this.
Wait for official statements. The loss figures, the method and the attribution are all still being worked out.
#binancehack #Hack #userfundsafe #TRMLabs #NorthKoreaHackers