TL;DR
Two Binance hot wallets were drained in an incident estimated to have cost around $6.3B. The funds were moved across multiple networks, with much of the initial activity unfolding in roughly 40 minutes.
Binance and its partners have frozen around $3B. The exchange says it will cover all losses, but it has suspended deposits and withdrawals.
The attacker converted much of the stolen stablecoins into ETH, which stablecoin issuers can’t freeze. DeFi protocols also took emergency measures to contain the fallout.
What happened?
Attackers drained two Binance hot wallets in a coordinated attack, and Binance estimates the total impact at around $6.3B. The initial outflows occurred over roughly 40 minutes, making it one of the largest thefts in crypto history—potentially around four times the size of the Bybit hack.
The response was unusually fast. Tether and Circle moved to freeze affected stablecoin addresses, with billions of dollars in assets ultimately frozen across issuers and other ecosystem participants. But the attacker had already begun swapping stablecoins for ETH, moving funds into an asset a centralized issuer can't freeze.
The scale of the incident is still being assessed. Binance has pledged to cover all losses, while investigators and blockchain analytics firms continue tracing the remaining funds.
Where things stand
Binance’s preliminary estimate puts the impact at approximately $6.3B, with around $3B frozen on-chain, according to its latest update. On-chain analysis shows that at least $5.912B had been stolen as of its reporting cutoff. These figures are not directly interchangeable: stolen funds, frozen funds, and funds ultimately recovered are different measures.
Deposits and withdrawals remain temporarily suspended, with no firm reopening time announced. Binance says it will cover all losses using its SAFU fund and company funds.
The remaining balance is not necessarily a final loss figure. Some assets may still be traceable or recoverable, while the full extent of the incident remains under investigation.
How the attack unfolded
The first major outflows were identified from Binance hot wallets on October 29. On-chain activity shows a rapid series of transfers across multiple networks, with the initial Ethereum movements concentrated in a window of roughly 40 minutes.
Before Binance publicly confirmed the incident, CZ said the activity looked like a hack. Binance initially said it was investigating a potential security issue, then later confirmed unauthorized withdrawals.
The attacker had prepared infrastructure in advance. TRM Labs identified small withdrawals from Tornado Cash that funded an operator wallet used in the attack. That wallet then deployed contracts and began moving the stolen assets.
Once the funds left Binance’s wallets, the attacker split and routed them through different addresses and protocols. Stablecoins were moved quickly, with some funds reaching addresses that issuers would later blacklist. Other assets were converted into ETH and moved across chains.
The speed mattered. Freezing an address only helps if the funds are still there when the freeze takes effect. By the time some blacklists were activated, portions of the stolen stablecoins had already moved onward.
Find and execute the 15%+ stablecoin yields in minutes
Save time without checking every protocol manually. DeFi Saver’s Discover page surfaces rates across Aave, Morpho, Spark, and more, lets you simulate leverage before committing, and handles the full loop in one click. Stop leaving yield on the table.
<Discover Yields on DeFi Saver> | Today in DeFi is Supported by DeFi Saver
How did the attacker get in?
Binance’s preliminary investigation points to a DevOps engineer’s compromised laptop. The attacker allegedly used that access to reach a service container and submit unauthorized withdrawal requests.
Binance says it has found no evidence that wallet private keys were leaked. It has revoked authorization for the affected address while continuing its investigation.
Blockaid described the incident as a case of “key misuse.” That distinction matters: it suggests the attacker may have manipulated the signing process without necessarily extracting the underlying private keys.
The exact technical path has not yet been confirmed. TRM Labs has also highlighted the use of EIP-7702 in the Ethereum portion of the attack, where pre-signed authorizations helped facilitate the transfers. Binance has not yet published a full technical post-mortem.
The race to freeze the funds
Stablecoin issuers can blacklist addresses and freeze tokens held there. ETH lacks the same issuer-level control, which incentivized the attacker to swap stablecoins as quickly as possible.
On Aave, the attacker supplied around $60M in USDT and borrowed approximately $45M in WETH. This allowed the funds to move into ETH exposure while using the lending market as part of the route.
Around $700M in USDT reportedly moved out of targeted addresses before Tether’s blacklist took effect. Tether and Circle ultimately froze billions in assets, alongside other ecosystem participants.
The Aave borrowing also introduced liquidation risk. If collateral value falls far enough below the debt, the position can be liquidated. In this case, the immediate concern was not just the attacker’s position, but the possibility that unusual activity could create knock-on effects for the wider market.
DeFi’s awkward night
The incident quickly spilled into DeFi. Aave froze 292 markets across its V3 and V4 deployments as a precaution, while the Arbitrum Security Council took emergency action to move assets linked to the attacker into a frozen wallet.
The response highlighted a tension in crypto: centralized issuers can freeze stablecoins, while decentralized protocols have different and sometimes more limited emergency controls. Those controls can still be used when governance or security mechanisms allow it, but they come with trade-offs.
The Arbitrum action was narrowly targeted at assets associated with the attacker. The Security Council said other user funds and applications were not affected.
The majority of the roughly $3B frozen so far came through centralized issuers and ecosystem partners. Several protocols also reported no direct exposure to the incident.
Can Binance cover the losses?
Binance says it will cover all losses using its SAFU fund and its own company funds. It has done this before: after the 2019 hot-wallet theft, Binance said SAFU would cover the incident in full.
SAFU holds 15,000 BTC, worth about $1.16B at current prices. If about $3.0B of the stolen funds are frozen and eventually returned, the net loss would be about $3.3B. SAFU would cover roughly a third, and Binance has said it will top the fund up if it falls below $800M.
The rest would have to come from Binance’s own money. Binance has not said how much company money it holds. As a private company, it publishes no accounts, so its capacity can only be judged from outside signals:
The pledge is not the same as recovery. The frozen funds are not back with Binance yet; the attacker still controls about $3.3B, and Binance plans to publish an updated proof of reserves once it finishes its fixes.
What users should do now?
Check: If you have positions on Aave, review your health factor and borrowing rates. Frozen markets and changing utilization can affect borrowing conditions.
Watch: Follow Binance’s official updates to confirm deposits and withdrawals have resumed. Avoid relying on unofficial reopening claims.
Avoid: Be alert for phishing attempts posing as Binance refunds, compensation claims, or recovery services. Binance will not need your seed phrase or private key to return funds.
What we still don’t know
The final amount stolen, frozen, and recovered remains unconfirmed. Binance has not yet published a full technical post-mortem, so the precise attack vector remains unconfirmed.
Attribution is also still developing. TRM Labs has linked the incident to North Korea’s TraderTraitor group with high confidence, but that assessment is not an official confirmation from Binance.
The timing of the exchange’s reopening remains unclear, as does the fate of the assets that have not been frozen.
For now, the incident is a reminder that even the largest exchanges remain exposed to operational security failures — and that the response can be just as consequential as the exploit itself.
We will update this report as Binance publishes its post-mortem and investigators provide a clearer picture of where the remaining funds went.
Sources
Reuters — Analysts React to Binance Freezing Assets After $6.3B Security Breach
Reuters — Tether and Circle Freeze Assets After Binance Incident
Aave Governance — Binance Hot Wallet Exploit: Aave’s Response
Cointelegraph — Binance Incident Live Updates and Market Reaction
Follow @todayindefi to keep up with the latest DeFi news on Twitter.
Disclaimer: Projects or tokens mentioned in this newsletter are often experimental or unaudited. Do your own diligence before using or buying anything mentioned.
