Hackers hit Binance for $6.3B, but $3B of the loot is stuck in the system

Binance confirmed on Thursday that hackers accessed its accounts and stole approximately $6.3 billion in digital assets. The exchange, the largest cryptocurrency platform globally, suspended all withdrawals on October 29 while it reinforced its security infrastructure. Co-CEO Richard Teng stated that the company is actively working to recover the missing funds.

The frozen amount rose from an initial estimate of $2.54 billion to $3 billion. This increase occurred when stablecoin issuers paused transactions on specific addresses. Paolo Ardoino, CEO of Tether, said his firm froze about $1.6 billion linked to the incident. Jeremy Allaire, CEO of Circle, reported that his company froze more than $800 million in USDC. Binance noted that the total frozen figure may continue to rise as it coordinates with blockchain intelligence firms.

Teng described the intrusion as a complex process rather than a single action. He explained that the attack likely began with the laptop of a DevOps engineer, which granted access to a service container. From there, unauthorized withdrawals were executed. The company later acknowledged additional breach points but found no evidence that private wallet keys were leaked.

Reuters reported that nearly half of the stolen funds consisted of frozen stablecoins. This freeze limits the attackers' ability to convert the assets into cash but does not guarantee their return. Binance maintains a $1 billion emergency reserve called SAFU, which CryptoQuant values at approximately $1.18 billion in Bitcoin. If the $3 billion in frozen assets is recovered, the exchange would still need to cover $3.3 billion from its own resources and the SAFU fund, according to CCN.

The incident affects the main Binance.com platform. Binance.US, which serves United States residents, stated that it was not impacted. For users holding accounts on Binance.com, the company advised checking balances and enabling two-factor authentication. Teng assured customers that deposits are operating normally and that withdrawals will resume after a security renewal.

TRM Labs claimed high confidence that the attack was carried out by TraderTraitor, a North Korean unit linked to the Lazarus Group. However, Binance stated that its investigation has not yet attributed responsibility to any specific party. The attribution remains a hypothesis from external analysts rather than a confirmed conclusion by the exchange.

This theft surpasses the previous record set in 2025, when Bybit suffered a $1.5 billion loss. The scale of the breach has intensified scrutiny on the exchange's protection mechanisms and its promise to cover client losses against massive attacks. Users are currently advised to rely only on official channels for updates before moving funds.