Binance hack: why $3 billion is frozen and $2.4 billion is not

Binance says an attacker drained about $6.3 billion from its wallets on Oct. 29 and that roughly $3 billion of it is already frozen on-chain. Whether the rest can be stopped depends less on Binance than on which coins the attacker took.

The exchange's preliminary account, published in a binance.com security update, points to a compromised DevOps engineer's laptop that gave the attacker access to a service container and let it submit unauthorized withdrawals. Binance says it found no evidence of a private key leak and will cover all losses from its SAFU fund and company money. Deposits work. Withdrawals stay paused, and in an X post at 04:36 UTC on Oct. 30 the exchange said it expects to resume them within 48 hours.

Stablecoins came with an off switch

Blockchain analytics firm TRM Labs traced on trmlabs.com about $6.36 billion leaving Binance wallets on ten blockchains, most of it within about 20 minutes starting at 20:05 UTC. More than $3 billion of the haul was USDT, USDC and Ripple's RLUSD. Their issuers control the token contracts and can block an address, which bitcoin and ether do not allow.

They moved fast. Circle froze 823 million USDC at 21:04 UTC, according to TRM's timeline. Tether froze 971.1 million USDT in the main receiving wallet 37 minutes after the largest sweep and kept adding addresses through the night. By 00:30 UTC, TRM counted about $2.7 billion frozen across Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council. Binance's later figure is around $3 billion.

The attacker tried to outrun the freezes. TRM says it sold about 325 million USDT to market makers for roughly 122,300 ETH, accepting a discount of more than 10%, and borrowed about 19,760 ETH on Aave against 60 million USDT.

Bitcoin and ether have no issuer to call

That leaves more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion in TRM's estimate, outside any issuer's reach. The bitcoin is already moving through a peel chain, split into round 1,000 BTC and 100 BTC pieces. Investigators can follow it and wait for it to reach an exchange or OTC desk that cooperates.

A freeze is also not a refund. "A freeze stops the money from moving, and recovery follows through legal process," Ari Redbord of TRM Labs told cnbc.com. Chainalysis research head Eric Jardine told the outlet that returning funds can take months or years.

TRM attributes the attack with high confidence to TraderTraitor, the North Korean unit the FBI blamed for the $1.5 billion Bybit hack in February 2025, and Chainalysis CEO Jonathan Levin gave the same assessment. No government has formally named the attacker. One night at Binance now exceeds the $4.67 billion the crypto industry lost to hacks in two years, and it follows the Keystone breach earlier this week, another attack on wallet infrastructure.

For customers, the near-term question is solvency. Sean Farrell of Fundstrat Global Advisors told CNBC the breach does not currently appear to create meaningful solvency risk, and that the tell will be how quickly withdrawals resume and whether outflows stay orderly. Binance has promised an updated Proof of Reserves once remediation is complete. It has not given a date.