The $6.3 Billion Binance Hack and the Coins That Could Be Stopped

On 29 October at about 20:05 UTC (7:05 am Friday in Sydney), attackers took control of Binance’s hot wallets and moved out about $6.34 billion in crypto, by Binance’s own count. Most of it left in about 20 minutes, across ten blockchains, according to blockchain analysts TRM Labs. It is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

Two days later the FBI said North Korea was responsible, naming the hacking unit it calls TraderTraitor. North Korea denied it: Kim Yo Jong, Kim Jong Un’s sister, called the US claim “absurd rhetoric” in a statement carried by state media. Binance says it will cover all losses itself. Its first report on the attack, published on 3 November, opens with an apology: “This should not have happened.”

The headline number hides the most useful part of the story. About $2.85 billion has been frozen or seized, and 94% of that was stablecoins, according to the analytics firm Elliptic. None of the funds stolen on the Bitcoin network has been frozen.

Every coin has a switch. The question is who holds it.

Months of preparation, 20 minutes of theft

This wasn’t a break-in to individual customer accounts. The attackers took over Binance’s hot wallets: the online wallets an exchange uses to pay out withdrawals, which hold pooled customer deposits.

Binance’s report describes a campaign that began months earlier. In June, a wallet engineer searched online for a popular AI coding tool and, to install it, downloaded a tampered copy of Homebrew, a widely used developer tool. Binance caught it and replaced his device, but says his role and his colleagues on the wallet team were exposed to the hacker. In September, another engineer was approached on a legitimate job site, sat through two rounds of fake interviews, and was told to download an “assignment” onto his work computer. It carried malware that Binance’s security tools didn’t detect.

On 20 October, the attackers used an internal AI tool as a springboard to reach two engineers on the wallet team. One of them had a permission token for deploying software on his computer. On 29 October, the attackers used his stolen credentials to launch a malicious script and reached Binance’s internal wallet signing service, which let them send transactions outside the normal withdrawal process.

From there, an Ethereum feature called EIP-7702 let them give their own smart contract partial control of a Binance hot wallet. Pausing withdrawals didn’t stop it, because those permissions lived on the blockchain itself. The wallet was secured with MPC, which splits control so that no single private key exists, so Binance had no one key to cancel them with quickly. The last unauthorised transfer landed at 23:56 UTC, nearly four hours after the first. The design that protects against one stolen key also slowed the fix.

The same playbook, at four times the scale

The FBI, TRM, Chainalysis and Elliptic all point to TraderTraitor, and Binance’s account fits its record. A 2022 US government advisory describes the group targeting crypto companies’ DevOps and IT staff with fake offers of high-paying jobs. In 2024 it took $308 million from Japan’s DMM Bitcoin after a fake LinkedIn recruiter sent a wallet-software company’s employee a malicious “pre-employment test”. Binance says it detected and prevented 57 suspected North Korea-linked cases in 2026. This one got through.

The scale is new. TRM counts $12.8 billion stolen by North Korea since 2017, $7.4 billion of it in 2026. By our calculation from TRM’s figures, this one theft is about half of everything it attributes to North Korea. It is also nearly double the more than $3.4 billion stolen across the industry from January to early December 2025, as counted by Chainalysis.

The laundering is industrial. In under four days, Elliptic counts about 12,000 wallets across 11 blockchains and more than 40,000 transactions. It believes only a negligible amount has been cashed out so far.

The coins that could be stopped

In The Most Boring Coin in Crypto, we looked at stablecoins, the coins built never to move in price. This hack showed another feature of the biggest ones: a company behind them that can freeze them.

Within about an hour of the first transfers, Tether and Circle had begun freezing stolen USDT and USDC. Circle froze all 823 million stolen USDC before any of it could be swapped. In Elliptic’s count, stablecoins made up $3.46 billion of the $6.43 billion taken, and about $786 million of them were swapped before the freezes landed. By our calculation, roughly three in four stolen stablecoin dollars were stopped.

You could see the race on-chain. To beat the freezes, the attackers sold about 325 million USDT for ether at more than 10% below the market price.

Bitcoin has no such switch. The 18,270 stolen bitcoin, split into 19 addresses on the night of the theft, hadn’t moved since as of 4 November, and none of the funds stolen on the Bitcoin, XRP Ledger or Solana networks has been frozen. The FBI has published the attacker’s addresses and asked exchanges, swap services and node operators to block them.

The switch cuts both ways. A company that can freeze a thief can freeze anyone. Anton Golub, head of exchange go-to-market at Forte, backed the freezes but saw a double standard: Binance got nearly $3 billion frozen within hours, while smaller victims hear about court orders. “The rules should be the same for everyone.” A freeze also isn’t a refund. Returning frozen funds can take months or years, Chainalysis told CNBC. In the US, the GENIUS Act will require permitted stablecoin issuers to be technically able to comply with lawful orders to freeze or seize coins. It takes effect by 18 January 2027.

Binance paid. That was a choice, not a guarantee

Binance set aside more than $6.34 billion. Its 3 November report says it has replaced 98% of the stolen token assets and is buying the remaining, less-liquid ones. Withdrawals stopped for more than two days. They came back in phases from 1 November, with a second phase for more assets from 3 November, and others added as they’re ready. Binance says deposits stayed open.

Binance’s emergency fund for hacks, SAFU, held about $1 billion in bitcoin before the attack, and Binance said it would use half of it. By our calculation, the hack fund covered less than a tenth of this hack. The rest came from part of Binance’s futures insurance fund and its own corporate treasury.

That worked because Binance is enormous. Net withdrawals reached about $4.7 billion by 2 November, around 3% of its assets by Binance’s count. Smaller exchanges haven’t always survived. DMM Bitcoin was set for liquidation months after its 2024 theft. New Zealand’s Cryptopia went into liquidation after a 2019 hack, and its first payouts only began in 2024.

An earlier post made the same point about audiences: not your keys, not your coins. Martin Mulyadi of Shenandoah University put it more simply: “Coins on an exchange are a promise from a company.”

If you hold crypto on an exchange

This is education, not financial advice. Three things are worth knowing:

• An exchange balance is a claim on a company. Whether you’re made whole after a hack depends on that company’s money and its choices.
• Self-custody moves the switch to you. No exchange can freeze your coins (though stablecoin issuers can still freeze theirs), and no one can refund them. If you lose your recovery phrase, there is no help desk.
• Scams follow hacks. Expect fake support agents and “recovery” offers. Australia’s Scamwatch is blunt: “Never accept offers from anyone who says they can get your money back.” Binance asks users to rely only on its official channels.

For Australians: the new Digital Assets Framework Act, which commences on 9 April 2027, brings crypto platforms under financial services licensing, phased in over 18 months, according to ASIC. As of 4 November, we had found no statement from ASIC or Binance Australia about local accounts.

What this changes for us

We’re a small network, not an exchange. But look at the doors the attackers used at Binance: a tampered installer found while searching for an AI coding tool, a job-interview “assignment” and an internal AI tool. Every small team that builds with AI has the same doors. Our AI agents work inside the same accounts we do, so this hack goes straight into our operating rules:

• install software and AI tools only from their official sources, never from a search result or a link someone sends;
• no unknown code, “test” files or take-home assignments on any machine that holds our sign-ins;
• AI tools get only the access a task needs, with no standing keys or tokens left on a machine;
• phishing-resistant security keys on every account that touches money, domains or publishing, and a second check before anything moves money or changes a domain.

The cryptography didn’t break at Binance. In Elliptic’s assessment, it was the infrastructure and people around the wallets that gave way. That’s the part of security nobody can outsource.

Over to you: is a coin that can be frozen a safety feature or a red flag? Hit reply and tell us.

---

How we made this: AI tools helped us research and draft this post. We checked every figure, quote and link against its original source before publishing. Figures are as of 4 November 2026, and estimates still differ (Binance about $6.34 billion, TRM $6.36 billion, Elliptic $6.43 billion). Binance calls its 3 November report initial, and we’ll update this post if later findings change the picture.

Education, not financial advice. Signal from the Dynamic Nexus Crypto node.