Six-point-three billion dollars drained from a single exchange in roughly 20 minutes. Binance now says every customer who lost assets in that October 29 attack has been made whole, but “replaced” refers to new tokens Binance acquired, not to any recovery of the funds attackers took.
The exchange said it committed more than $6.34 billion in company resources to cover customer balances. Binance drew on SAFU (its Secure Asset Fund for Users, an emergency reserve built for this purpose) and corporate treasury holdings, according to reporting on the company’s disclosure. Replacement tokens were acquired through ordinary market purchases and over-the-counter transactions spread across approximately two weeks.
The critical distinction bears repeating. Binance bought new tokens to restore customer balances. The original stolen assets have not been recovered and remain in circulation.
What Actually Happened on October 29
Blockchain intelligence firm TRM Labs documented the scale and speed of an attack now recorded as the largest crypto theft in history.
According to TRM Labs, attackers moved approximately $6.36 billion out of Binance wallets across 10 separate blockchains, with most of the transfer completed in about 20 minutes. TRM Labs attributed the attack with high confidence to TraderTraitor, a state-linked hacking unit, based on blockchain transaction analysis, off-chain intelligence, and operational similarities to previous attacks tied to the same group.
An attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes.
TRM Labs
That is an intelligence assessment, not a confirmed legal finding. The incident is roughly four times larger than the $1.5 billion Bybit theft in February 2025, which U.S. authorities also attributed to TraderTraitor.
How They Got In
Binance’s preliminary investigation identified a compromised employee device as a suspected entry point, though the full picture remains unclear.
Binance’s preliminary investigation pointed to a compromised laptop belonging to a DevOps engineer as a suspected breach point. The company later indicated it had identified additional potential entry points, and the investigation remains active.
Details on how privileges escalated from that device to exchange wallets across 10 blockchains have not been publicly confirmed.
Frozen Funds and the FBI
Nearly $3 billion in stolen assets were frozen or intercepted shortly after the attack, though estimates from different sources vary.
Binance said nearly $3 billion in stolen assets were frozen or intercepted shortly after the attack; a later TRM Labs figure placed that amount at approximately $2.7 billion. The exchange said it is working with the FBI on recovery efforts.
Attackers routed remaining funds through thousands of wallets and transactions to obscure their origin. Blockchain researchers also reported that the attackers reportedly created memecoins as part of an effort to launder approximately $430,000 in stolen cryptocurrency.
Recovery of the original stolen assets remains a separate law-enforcement and blockchain-tracing effort with no confirmed timeline.
Verification Is Still Pending
Until Binance’s proof-of-reserves process is complete and independently confirmed, the fully-backed claim rests substantially on the exchange’s own disclosure.
Binance published a proof-of-reserves snapshot and said holdings are intended to back customer assets on a one-to-one basis. That complete proof has not yet been published or confirmed on-chain. Until it is, the fully-backed claim rests substantially on Binance’s own disclosure.
Less-liquid tokens in the any such snapshot may also present additional verification challenges, given the difficulty of sourcing them in sufficient quantity on short notice. The exchange said it would restore withdrawals in phases while the verification and broader recovery process continues.
