NewsCompaniesFlawsGuides
Get the app

Binance robbed of US$6.3 billion in 20 minutes, the biggest crypto theft on record

From the HARD Situation Room · First reported
For everything else happening in security now, see the Situation Room.

On 29 October, attackers moved about US$6.3 billion out of Binance across ten blockchains in about 20 minutes. TRM Labs and Chainalysis blame North Korea's TraderTraitor group, which the FBI linked to the US$1.5 billion Bybit theft. Binance paused deposits and withdrawals, says it froze about US$3 billion, and says it will cover every loss.

The biggest crypto theft on record took about twenty minutes. Binance says customers won't lose a cent. The scams that follow a hack like this are the bigger risk to families.

Current event. First reported . Details may change as more becomes known; updates will be added to the timeline.

What happened

On Thursday 29 October, someone moved about US$6.3 billion of cryptocurrency out of Binance, the world's largest crypto exchange. It went out across ten blockchains, and most of it was gone in about twenty minutes[1]. It is the biggest crypto theft on record, more than four times the US$1.5 billion taken from Bybit in February 2025.

Two blockchain investigators, TRM Labs and Chainalysis, both point to North Korea. TRM Labs names TraderTraitor, a state-backed group the FBI has already blamed for the Bybit theft, and says the attackers spent at least 36 hours getting ready.[2] Binance's first account was that the way in was an engineer's laptop.[3]

Timeline

  1. US$1.5 billion is taken from Bybit, a theft the FBI blames on TraderTraitor. Until Binance, the biggest crypto theft on record.[2]

  2. About US$6.3 billion of cryptocurrency goes out of Binance across ten blockchains, most of it in about twenty minutes. Binance pauses deposits and withdrawals.[1][2]

  3. Tether and Circle freeze coins linked to the theft.[4]

  4. HARD publishes its article, at High.

  5. Binance is due to publish proof of its reserves.[3]

Who is affected

Is the money in your account safe?

Binance says yes. It says it will cover all losses, that customer funds are safe, and that it will publish proof of its reserves on 2 November.[3] The coins were taken from the exchange's own hot wallet, the one it uses to pay out withdrawals, not by breaking into customers' accounts. Nothing reported so far suggests anyone's password was taken.

What customers lost, for now, is access. Deposits and withdrawals were paused while Binance investigated, and the price of bitcoin fell about five percent on the news. If someone in the family holds crypto on Binance, their balance should still be there. They just may not be able to move it for a few days.

The scams that follow

The theft is Binance's problem. The phone calls that follow it are yours.

A hack this size is the perfect cover story. Expect calls, texts and emails from "Binance security" saying your account was affected and your funds need moving to a "safe wallet". Expect fake recovery firms promising to get stolen crypto back for a fee. And expect fake Binance pages in search ads. It's the usual pattern after a big, public loss.

The tell is always the same. Binance won't ring you, won't ask you to move funds, and won't ask for a code. Nobody can recover crypto for an upfront fee. Anyone who asks for either, however official they sound, is the scam.

How this reaches a family

  1. The news breaksEveryone has heard Binance was robbed. That’s what makes the next call believable.
  2. “This is Binance security”Your account was affected, they say. Your coins need moving to a safe wallet today, and they’ll walk you through it.
  3. HARDCall check and payment pauseWhile they talk, HARD asks a few questions, and what the caller wants gives them away. If you still go to send it, HARD pauses big crypto withdrawals and new payees and asks whether someone on the phone told you to.See how it works
  4. The coins moveYou send them to the “safe wallet”. It’s theirs, and crypto doesn’t come back.
Where HARD comes in.With HARD, the greyed-out steps don’t happen.

What to do

  1. Check balances yourself, in the app.Open the Binance app or type binance.com yourself. Don't follow a link in a message, even one that looks right.
  2. Don't move anything because someone asked.Not to a "safe wallet", not to "verify" your account. Hang up and check in the app.
  3. Tell the family's older crypto holders first.Recovery scams target the people most worried about losing money. A two-minute call now beats a long one later.
  4. When withdrawals reopen, keep less on exchanges.An exchange is a place to trade, not to store savings. Keep on it only what you're actively trading, and the rest somewhere you control, with the recovery words written down and kept safe.

Or have someone keep an eye on it for you. Knowing where the family's money sits, and warning everyone before the scam calls start, is part of what private cybersecurity is for.

References

  1. ^ WIRED (). “The $6.3 billion Binance hack was pulled off in just 20 minutes”. How quickly the money moved: about twenty minutes.
  2. ^ CNBC (). “Binance hack: what we know and what comes next”. TRM Labs' figure of about US$6.36 billion across ten blockchains, at least 36 hours of preparation, attribution to TraderTraitor, about US$3 billion frozen, and deposits and withdrawals paused.
  3. ^ Wikipedia (). “2026 Binance hack”. A summary of the reporting so far: Binance's first account of an engineer's compromised laptop, its promise to cover losses, the US$6 billion set aside, and proof of reserves due on 2 November.
  4. ^ CNBC (). “$6.3 billion Binance hack is largest crypto theft on record”. Tether and Circle freezing coins linked to the theft.

Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.