Hackers drained about $6.3 billion in cryptocurrency from Binance-controlled wallets across at least ten blockchains on October 29, according to analysis reported by WIRED. Most of the transfers occurred within roughly 20 minutes, making the incident what investigators described as the largest digital-asset theft recorded to date.
Binance suspended deposits and withdrawals while investigating and said it would cover losses. The exchange initially pointed to a compromised employee laptop, then said its inquiry had identified additional breach points. It did not attribute the intrusion to a particular country or group and said it was coordinating with law enforcement.
TRM Labs traced the preparation back at least 36 hours before the main theft. Its account describes small test withdrawals, code deployed against two wallets, a rehearsal involving a third wallet and installation of the final code on a Binance hot wallet about four hours later. Hot wallets remain connected to online systems so exchanges can process customer withdrawals, making their keys and internal controls especially sensitive.
The stolen assets moved from wallets on networks including Bitcoin, Ethereum, Tron and Solana into addresses controlled by one attacker, TRM reported. Multiple blockchain-analysis companies then began following the transfers and coordinating attempts to prevent the funds from reaching services where they could be exchanged.
Attribution remains provisional. TRM Labs and Chainalysis said the activity may be the work of TraderTraitor, a North Korean operation known for targeting cryptocurrency companies. Elliptic also assessed North Korean responsibility as likely, while stopping short of assigning the attack to that specific group. Chainalysis said investigators observed stolen Binance funds mixing with assets from a recent Bitget exploit attributed to North Korean actors. Researchers also noted advance rehearsals and the targeting of an employee device as tactics seen in earlier operations. Neither Binance nor law enforcement had publicly confirmed that assessment.
Crypto companies initially froze around $3 billion. Elliptic later estimated that approximately $2.8 billion, or 44 percent of the total, had been immobilized, mostly in stablecoins whose issuers or platforms can block transfers. The remaining assets were largely Bitcoin, Ether and XRP, which cannot be frozen at the protocol level. Investigators may still intercept some funds when they reach centralized exchanges or other cooperating services.
The speed and breadth of the operation complicate recovery. Chainalysis reported thousands of automated transactions and laundering patterns it had not previously observed. Even with public blockchains preserving a visible trail, an attacker can split holdings across networks and addresses faster than compliance teams can coordinate freezes.
The incident underlines the distinction between tracing stolen cryptocurrency and controlling it. Analysts can follow many movements in real time, but recovery depends on whether the assets encounter an issuer, exchange or intermediary able and willing to stop them. Binance's reimbursement commitment may protect customers from direct losses, while the investigation must still determine how access was obtained and which controls failed.
