TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Blockchain investigators say about $6.36 billion in cryptocurrency moved from wallets associated with Binance across 10 blockchains on Thursday, Oct. 29. Binance says the assets came from company-controlled holdings, that customer funds remain safe and that it can cover the losses; withdrawals were suspended while the incident was investigated. The amount, attribution and recovery status remain subject to investigation.
Blockchain investigators reported that about $6.36 billion in cryptocurrency moved from wallets associated with Binance on Thursday night, Oct. 29, prompting the exchange to suspend deposits and withdrawals while it investigates a possible breach. Binance said the funds came from company-controlled holdings and that customer assets remain safe, but the scale and circumstances of the reported movement are not yet settled.
Blockchain intelligence firm TRM Labs said the transfers spanned 10 blockchains, with much of the activity occurring within roughly 20 minutes. That figure describes cryptocurrency moved from wallets associated with the exchange; the source account does not provide a final, independently confirmed accounting of losses. If the reported amount is verified, it would exceed the approximately $1.5 billion Bybit theft in February 2025, which the source identifies as the previous record.
Binance’s preliminary investigation pointed to a possible compromise of a DevOps engineer’s laptop. The account says attackers may then have reached internal services that could submit withdrawal transactions the system treated as legitimate. Binance has reportedly identified other possible points of compromise, and the full sequence remains under investigation. The exchange suspended deposits and withdrawals during its response.
Binance said customer funds remain safe and that corporate reserves and other resources are sufficient to cover the loss. The source account also says cryptocurrency issuers and investigators froze approximately $3 billion of the assets, while billions remained unrecovered at the time of its report. The figures and recovery status should be treated as reported, not as a final audit. Separate from Binance’s incident, Polymarket temporarily restricted international trading after a third-party software provider was reportedly compromised; investigators estimated about $2.7 million was taken from more than 700 accounts.
Hackers Take $6.3 Billion in Crypto in What May Be the Biggest Heist Yet
Investigators reported roughly $6.36 billion moving from wallets associated with Binance across 10 blockchains. The exchange suspended deposits and withdrawals as it investigates. The amount, attribution and recovery status remain unsettled.
Separate the reported facts from the claims
Public blockchain activity can show transfers, but it does not by itself establish who controlled destination wallets or how much was ultimately lost.
Large transfers across networks
TRM Labs reported approximately $6.36 billion moved from wallets associated with Binance, with much of the activity occurring in about 20 minutes.
Customer assets remain safe
Binance said the assets came from company-controlled holdings and that it can cover the loss. These claims have not been independently substantiated in the material provided.
Final loss and recovery
The source describes about $3 billion in assets frozen and billions unrecovered at report time. Those figures and the recovery status are not a final audit.
How the reported transfers may have unfolded
Binance’s preliminary investigation pointed to a possible compromise of an employee’s DevOps laptop and access to internal services. The full route has not been confirmed.
An engineer’s laptop may have been compromised.
Attackers may have reached services that submit transactions.
Transactions were reportedly accepted as legitimate across 10 chains.
Binance suspended deposits and withdrawals during its investigation.
Reported amount compared with the previous record
The source identifies the approximately $1.5 billion Bybit theft in February 2025 as the previous record. Comparisons may not use identical accounting methods.
TRM Labs and Chainalysis reportedly linked the activity to the North Korea-associated hacking operation. Binance had not formally confirmed responsibility in the account provided.
A reported third-party provider compromise affected more than 700 accounts. It is a distinct incident and should not be conflated with Binance’s reported transfers.
Access, operations and customer confidence
Service disruption is immediate
Even if customer balances remain intact, a pause on deposits and withdrawals prevents users from moving funds through the platform while the investigation continues.
Internal tools face scrutiny
If the preliminary account is borne out, employee devices and transaction services will be central to the review. It does not prove other exchanges share the same weakness.
Key questions still need answers
How were transfers authorized?
A completed technical account should clarify the access path, timeline and any additional affected systems.
What is the final asset status?
Updates should distinguish assets moved, frozen, recovered and still missing, with a clear accounting.
When will services resume?
The source gives no timetable for restoring ordinary deposits and withdrawals or for further customer updates.
Exchange Controls Face a Major Test
The reported movement matters because it could test how an exchange can safeguard assets and maintain customer access during a major security incident. Even if Binance’s statement that customer funds are safe holds, a suspension of withdrawals and deposits leaves users unable to move funds through the platform while the company investigates. That is a practical disruption distinct from whether individual account balances have been lost.
The preliminary account points to a possible compromise of internal access, rather than a failure in the underlying blockchain networks. If that account is borne out, it would highlight the security risks around employee devices and internal services that manage transactions. It does not establish that the same weakness exists at other exchanges, nor does it prove the precise route attackers used.
The concurrent Polymarket incident involved a different reported weakness: a compromised outside provider and unauthorized activity affecting logged-in users. The two events should not be conflated, and the reported losses differ sharply. Together, they show why users and investigators will be watching not only whether assets can be recovered, but also how platforms handle third-party dependencies, account access and service interruptions.
Products Worth Considering
Apple MacBook Pro 14-inch Laptop with M5 Pro chip, 18-core CPU, 20-core GPU, 24GB Unified Memory, 2TB SSD, Wi‑Fi 7 – Space Black
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple MacBook Pro 16.2-inch with M5 Pro Chip (18-Core CPU, 20-Core GPU), 48GB RAM, 1TB SSD, Nano-Texture Display, Space Black
As an affiliate, we earn on qualifying purchases.
How the Reported Transfers Unfolded
According to the source account, blockchain investigators detected large transfers from Binance-associated wallets late on Thursday, Oct. 29. TRM Labs put the total at approximately $6.36 billion across 10 blockchains, with much of the activity concentrated in about 20 minutes. A blockchain transfer can be observed publicly, but the reported movement alone does not resolve who controlled the destination wallets, the attackers’ access method or the final amount of any loss.
Binance’s preliminary explanation was that a compromised laptop belonging to an employee may have given attackers a foothold. They reportedly used access to internal services to submit transactions accepted as legitimate. The company was said to be examining additional possible compromise points. That explanation remains preliminary; the source provides no completed technical report or confirmed account of the attack’s full timeline.
TRM Labs and Chainalysis reportedly attributed the activity to TraderTraitor, a hacking operation associated with North Korea. The source says Binance had not formally confirmed responsibility. This distinction matters: attribution by outside investigators is a claim about the suspected perpetrators, not a confirmed finding by the exchange or a public law-enforcement conclusion. The source compares the reported amount with the February 2025 Bybit incident, but does not establish that all details or accounting methods are directly comparable.
Losses and Attribution Still Unsettled
The source account does not establish a final, independently verified figure for the amount stolen, the amount frozen or the amount still missing. It describes approximately $6.36 billion moved from Binance-associated wallets, but does not provide a completed accounting showing how much was recovered or whether every transfer represented a loss. Binance’s claims about customer funds and its ability to cover the loss have not been independently substantiated in the material provided.
The proposed laptop compromise and access to internal services remain part of a preliminary investigation. Binance has reportedly identified other possible points of compromise, but the source does not explain what they are or whether attackers accessed additional systems. The reported TraderTraitor attribution is likewise unconfirmed by Binance in the account provided.
It is also unclear when Binance would restore ordinary deposits and withdrawals, whether all customers experienced the same restrictions, and what compensation or operational measures may follow. For Polymarket, the source says the company addressed the reported vulnerability and planned reimbursements, but gives no final accounting of affected users or confirmation that every claim was paid.
Investigation and Withdrawals Ahead
Binance’s immediate next steps are to complete its investigation, determine how the reported transfers were authorized and establish the status of the assets. Customers will be watching for the exchange to announce when deposits and withdrawals can resume and to provide clearer information about the reported recovery effort. The source account gives no timetable for those announcements.
Further updates would need to clarify the final loss figure, how much of the cryptocurrency remains frozen or recoverable, and whether customer balances or services were affected beyond the restrictions already reported. A technical account from Binance could also confirm or revise the preliminary explanation involving an employee device and internal services. Until then, outside attribution and early estimates should remain distinct from confirmed findings.
Polymarket’s follow-up is separate: the company reportedly restricted international trading while addressing a third-party software issue and said affected customers would be reimbursed. The source provides no schedule for all services to return or a final reimbursement total. Both incidents remain developing security stories, with key details dependent on company disclosures and investigators’ findings.
Key Questions
How much cryptocurrency was reportedly moved from Binance-associated wallets?
TRM Labs estimated about $6.36 billion moved across 10 blockchains, with much of the activity occurring within roughly 20 minutes. The source account does not provide a final independent accounting of losses.
Did Binance say customer funds were stolen?
No. Binance said customer funds remain safe and that the reported assets came from company-controlled holdings. Those are the company’s statements; the source does not include an independent audit confirming them.
How did the attackers reportedly gain access?
Binance’s preliminary investigation reportedly pointed to a compromised employee laptop and possible access to internal services. The full attack route remains under investigation and has not been confirmed in the material provided.
Who is suspected of carrying out the Binance attack?
TRM Labs and Chainalysis reportedly attributed the incident to TraderTraitor, a hacking operation associated with North Korea. Binance had not formally confirmed responsibility in the source account.
Was Polymarket affected by the same incident?
No shared cause is reported. Polymarket faced a separate security incident involving a compromised third-party provider, with investigators estimating about $2.7 million taken from more than 700 accounts.
Source: Off Grid Survival
