Twenty Minutes, $6.3 Billion: What the Binance Heist Teaches Everyone Who Holds Crypto
Most bank robberies in history were measured in hours of planning and minutes of action. The theft that hit Binance late on Thursday, October 29, followed the same rhythm, only at a scale no vault has ever held. According to the blockchain analysis firm TRM Labs, roughly $6.36 billion was moved out of Binance wallets across ten blockchains, most of it in about twenty minutes from 20:05 UTC. That makes it the largest crypto theft on record, around four times the $1.5 billion taken from Bybit in February 2025.
By Saturday the FBI had named the culprit it believes is responsible: TraderTraitor, a North Korean state-backed unit that researchers also track as Lazarus Group or APT38. TRM Labs and Chainalysis had reached the same conclusion, both citing transaction patterns that resembled earlier North Korean operations. Pyongyang has long denied running state hacking units for profit.
Not a stolen key, but a stolen laptop
The most uncomfortable detail is how the attackers got in. Binance has linked the breach to the compromised laptop of a DevOps engineer. From there, the intruders reached a service container and were able to submit withdrawal transactions that the system treated as legitimate. The exchange says it has found no evidence that a wallet private key leaked, and co-CEO Richard Teng stressed that this was a complex, multi-step operation rather than a single careless click; the company has not blamed any individual. Malicious software designed to erase traces of its activity made the investigation harder, Teng said, and Binance has acknowledged finding additional points of breach that it is still examining.
That matters well beyond one company. Crypto security debates often focus on cold wallets, seed phrases and multi-signature schemes. This case shows that the weakest point can be the ordinary machinery of a tech company: the laptops, build pipelines and internal tools that engineers use every day. TRM Labs says the attackers began preparing at least 36 hours before they struck.
A race against the freezes
Once the money moved, a second contest began. Stablecoin issuers including Tether, Circle and Ripple, together with World Liberty Financial, froze around $2.67 billion in stablecoins, and Arbitrum’s Security Council froze further tokens on its network, for a total of roughly $2.7 billion according to TRM Labs. Binance said about $3 billion had been located as of Friday. The attackers fought back by quickly selling USDT to market makers and borrowing ether against it, leaving them with more than 420,000 ETH and 18,270 BTC, worth roughly $2.4 billion and beyond the reach of any issuer. The FBI says it has observed the unit converting assets into ether and expects further laundering.
The episode is a reminder of a quiet paradox in crypto: the centralised stablecoin companies that purists distrust were the ones that could actually stop part of the loss.
Who pays?
Binance has said from the start that customers will not bear the cost. It set aside about $6.34 billion of company funds and says it has already covered $6 billion, or 95% of the stolen tokens, by buying replacements with money from its roughly $1 billion Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury. Co-CEO Yi He said half of the SAFU fund would be used and promised to rebuild it to around $1 billion. The remaining 5% consists of less liquid tokens that take longer to source.
On Sunday, Binance resumed bitcoin withdrawals, with a first phase covering 15 assets including bitcoin, ether, XRP and dogecoin, and said others would follow. It has also promised an updated proof of reserves once the clean-up is complete.
Lessons for ordinary users
For the exchange’s 335 million registered users, the immediate message is reassuring. The longer lesson is not. An exchange’s promise to make customers whole depends entirely on its balance sheet, and few platforms could absorb a loss of this size. Spreading holdings, keeping long-term assets in self-custody where it makes sense, and paying attention to an exchange’s published reserves are sensible habits, not paranoia.
For governments in Asia and beyond, the case sharpens an older worry. When a sanctioned state can extract billions in an evening, crypto security stops being a niche technology issue and becomes a question of national security, and of how fast the industry can cooperate when the clock is measured in minutes.