NEW YORK — Hackers stole more than $6 billion from Binance, the world’s largest cryptocurrency exchange, on Thursday. About $3 billion was frozen as firms raced to track the money across digital wallets, according to CNN. Binance says it will cover the losses, and that user funds are safe.
Based on Zark News reporting and CNN reporting verified for this piece. The case is still open, the total is an estimate, and no court has found who did it.
Why it matters
Binance holds money for millions of users. A theft this size tests whether an exchange can pay users back from its own funds, and whether stolen crypto can be frozen before it is washed through other wallets. The previous record was the $1.5 billion theft from Bybit in February 2025, according to CNN — about a quarter of this theft on early estimates. It also matters beyond crypto: U.S. officials and private firms say North Korean teams steal money to fund the state, and investigators are pointing to North Korea again here.
What we know
- The entry point, according to Binance: Binance said late Thursday that its first investigation pointed to an engineer’s laptop. Through it, the company said, an attacker gained access to a service container and could submit unauthorized withdrawals. Binance said it found no evidence a wallet private key had leaked, and a co-chief executive said the attack was not a simple “one-click” action, according to CNN.
- The size is an estimate, and estimates differ: Binance put the amount affected at about $6.3 billion. CNN reported more than $6 billion stolen. Chainalysis put it at about $5.9 billion at the time of the theft. TRM Labs said about $6.36 billion left Binance wallets across ten blockchains, most of it in about 20 minutes on Thursday afternoon U.S. time, in reporting cited by other outlets. None of these is a final loss figure.
- About half was frozen, on early tallies: Crypto firms froze about $3 billion, according to CNN. Binance said partners helped freeze that amount on-chain, separate from money Binance set aside to restore balances. Frozen is not the same as returned — recovery still has to be worked through.
- Users were told they will be covered: Binance said it would cover all losses from its own funds and an emergency asset fund. Changpeng Zhao, who co-founded Binance in 2017 and remains its largest shareholder, said on X that he expected user funds to be fully covered, according to Zark News reporting.
- Withdrawals were paused: Binance paused withdrawals for security checks and expected them to resume by Sunday morning, according to CNN. Bitcoin and ether fell sharply after the news, then traded about 2 to 3 percent lower by midday Friday in Hong Kong, according to CNN.
- U.S. agencies are involved: The FBI said Friday it was working with public and private partners to understand the scope, according to CNN. The Secret Service said its investigators were working with partners, including Circle, to freeze, trace and recover the funds.
What we still don’t know
- Who did it, as a proven fact: TRM Labs attributed the theft to an elite North Korean unit, based on what it called robust on- and off-chain intelligence. Pangolin Intelligence said it also believed a North Korean unit was behind it, and Chainalysis told CNN it had high confidence North Korea was behind the hack. That is an assessment by private firms, not a court finding. CNN said it had asked North Korea’s U.N. mission for comment; Pyongyang has denied hacking claims in the past.
- The final total: Early estimates range from about $5.9 billion to about $6.3 billion. The final amount stolen, frozen and lost may differ once tracing ends.
- How the laptop was compromised: Binance has not publicly explained how the attacker got into it, or what other access the attacker may have had.
- How much will be recovered: The $3 billion frozen figure is an early tally. How much is returned, and how fast, is not yet known.
What’s next
The near-term test is the race to freeze the rest before it moves through laundering networks — a game a Pangolin analyst told CNN had barely begun. Binance’s expected return of withdrawals on Sunday will be the first public check on its claim that user funds are safe. Then come a final accounting from Binance, any formal U.S. attribution, and whether the frozen funds are returned.
Timeline
- February 2025: Hackers steal about $1.5 billion from Bybit, the previous record theft, which investigators also blamed on North Korean hackers, according to CNN.
- Thursday, Oct. 29, 2026, afternoon U.S. time: Most of the stolen funds leave Binance wallets in about 20 minutes across ten blockchains, according to TRM Labs figures cited in later reporting.
- Late Thursday, Oct. 29: Binance points to an engineer’s laptop as the entry point and says it will cover losses.
- Thursday night U.S. time: Crypto firms have frozen about $3 billion, according to CNN.
- Friday, Oct. 30: The FBI and Secret Service confirm they are working on the case, according to CNN.
- Sunday, Nov. 1: The date CNN reported for the expected return of Binance withdrawal services.
Read the original Zark News report: Hackers Steal More Than $6 Billion From Binance in Largest Crypto Heist on Record.
