Crypto markets reeled after Binance reported a suspected drain of its hot wallets, with the exchange estimating the total impact at about $6.3 billion. Binance said roughly $3 billion of the stolen funds has been frozen on-chain in coordination with blockchain partners, while withdrawals were temporarily suspended as its withdrawal service was rebuilt.
Binance’s account of the incident points to a compromised DevOps engineer’s laptop that allegedly allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. The exchange said it has found no evidence of a wallet private key leak and pledged to cover losses using its Secure Asset Fund for Users (SAFU) and company funds.
Key takeaways
- Price move: Bitcoin fell more than 4% on the initial reports, while Binance Coin (BNB) sold off sharply.
- Catalyst: Binance said hot-wallet withdrawal functionality was compromised via unauthorized transactions, not a private key leak.
- Recovery angle: About $3 billion was reportedly frozen on-chain, but recovering bitcoin and ether is expected to take longer than stopping stablecoin transfers.
- Customer impact: Binance said customer balances are safe and that it will make users whole, though withdrawals were paused temporarily.
- Implication: Operational security at exchanges—especially the systems that sign withdrawals—faces renewed scrutiny.
What Binance says happened
According to Binance, the attack enabled an unauthorized flow of assets by targeting an operational layer involved in withdrawals. Binance’s chief executive Richard Teng said the first formal account points to a compromised DevOps engineer’s laptop, which allegedly gave an attacker access to a service container capable of submitting withdrawal transactions.
Binance said the incident was more complex than a single permissions issue or a one-click action. It also stated there is no evidence so far that private keys were leaked from wallets. A more detailed technical post-mortem is expected once every fact is verified, alongside an updated proof of reserves after remediation.
Why stablecoins may be easier to freeze than bitcoin and ether
Binance’s report and earlier on-chain activity underline a key difference in how thefts are handled across crypto asset types. Stablecoin issuers can often block addresses associated with illicit flows, which can halt further movement quickly.
Binance said stablecoin-related funds were frozen by multiple issuers including Tether, Circle, Ripple and World Liberty Financial, with earlier tallies placing Tether and Circle-linked amounts at roughly $1.8 billion to $2.4 billion. In contrast, bitcoin and ether have no equivalent “off switch,” leaving recovery dependent on tracing and coordinating enforcement actions after funds move through successive transactions.
CoinDesk’s review of Binance’s 1 October proof of reserves suggested that one of the emptied addresses, Binance 14, was among wallets used to back customer assets. For ether specifically, Binance had been holding about a 100% reserve ratio at that time, implying the roughly 204,500 ETH taken could have reduced ETH backing to near 94% until any gap is filled.
How attackers typically turn stolen crypto into recoverable (or not) value
Analysts note that the early hours after a major exchange theft often follow a recognizable pattern. On-chain researchers cited by CoinDesk said in 2025, about 76% of hacks saw stolen coins in motion before the wider market became aware, with first transfers occurring in seconds.
CoinDesk’s review also highlighted a common playbook: attackers split large balances into smaller pieces, swap tokens on decentralized exchanges, and move across chains using bridges. The report said more than $2 billion of stolen crypto was routed through bridges in 2025, representing nearly half of total losses, and around three times the amount attributed to mixers. It noted that privacy tools such as Tornado Cash have remained central to routes designed to complicate tracing on Ethereum.
Recovery efforts become more difficult when funds are converted into other assets or moved into decentralized finance. CoinDesk reported that in this case the exploiter borrowed wrapped ether on Aave using stolen USDT. The end goal often involves off-ramps such as peer-to-peer platforms, over-the-counter desks, and informal “laundromat” networks that settle off-chain.
Binance’s response and the customer risk investors are watching
For customers, Binance framed the immediate threat as not a vanished balance. The exchange said it would cover losses from SAFU and company funds. It also said withdrawals were paused temporarily while its withdrawal service was rebuilt, and that it aims to resume withdrawals in an orderly manner.
Fundstrat’s Sean Farrell said the episode does not currently appear to be a solvency crisis, provided frozen stablecoins return and withdrawals resume smoothly. The scale of SAFU also remains a focal point: Binance said SAFU holds roughly $1 billion in bitcoin, which would only partly cover any remaining unfrozen gap, with the remainder expected to come from the exchange’s own reserves.
Two analytics firms have linked the attack to North Korea’s TraderTraitor unit, though Binance has not confirmed that attribution. In the broader market, this attribution uncertainty adds to investor caution around exchange operational controls, even if customer balances are ultimately made whole.
What market participants will look for next
Bitcoin and BNB’s early weakness reflects how quickly trust can be tested after a large exchange incident. The next checkpoints are practical: when withdrawals fully reopen, whether outflows remain orderly, and whether Binance’s next proof of reserves—expected by 1 November—shows the missing assets replaced.
More technical details on the compromised operational path, plus the pace at which funds can be traced and potentially recovered, will likely determine how investors assess the longer-term resilience of exchange custody and withdrawal infrastructure.
