Attackers took about $6.43 billion from Binance in a breach that blockchain analysis firm Elliptic says is being attributed to North Korea. Binance says it has since replenished virtually all the stolen assets, according to The Block, and it is working to reopen more token withdrawals. If you keep coins on any exchange, the episode is a useful lesson in what you own there, what you can actually do with it, and how long a theft of this size can take to unwind.
What happened, in plain terms
Binance was hacked on October 29, according to Protos, which cited Reuters for related reporting. Binance's own report, as summarized by The Block, says the attack unfolded over months. It involved a tampered developer tool, a fake job interview and compromised internal AI tooling, which together gave the attackers access to the exchange's wallet-signing infrastructure.
Protos describes the chain of events like this. One engineer searching for a popular AI coding tool clicked a malicious search ad and installed malware-laden software. Binance caught that incident, but the engineer's details had already leaked. Later, a second engineer was lured into a fake job interview and downloaded an "assignment" containing malicious code. That malware pulled out sensitive information, and by October 29 it let the attackers log into a third engineer's computer and run the script behind the theft.
None of these steps involved breaking cryptography. They were ordinary tricks aimed at people: an ad, a job offer, a file to open. Those are the same tricks used against ordinary holders.
Where the stolen money stands
Elliptic's latest update, reported by The Block and Decrypt, shows how slowly a theft like this resolves. The attackers have used more than 20,000 wallets across 16 blockchains and 65,000 transactions to hide the trail. Even so, Elliptic estimates only a "negligible amount" has likely been cashed out. Decrypt's summary adds that the bulk of the stolen ETH and bitcoin has not moved.
| Item (per Elliptic, via The Block) | Figure | What it means for a holder |
|---|---|---|
| Total taken in the breach | $6.43 billion | Exchange-held assets can be a single large target. |
| Frozen so far | $2.85 billion | Some stolen funds can be stopped, but only part of them. |
| Still in addresses linked to the attack | $3.11 billion, mostly ether and bitcoin | Recovery is not over, and neither is the risk of laundering. |
| Not accounted for | About $470 million | It is unclear whether this is price changes, cash-outs or both. |
| Altcoins swapped into bitcoin | Around $124 million | Swapping into bitcoin is a way to blur the trail. |
| Stolen XRP swapped, mostly into bitcoin | About $50 million, with about $226 million remaining | Laundering was still in progress as of early Friday. |
Why stolen coins take so long to resolve
Moving crypto is fast. Proving where it ends up and getting it stopped is slow. Elliptic says the laundering is clearly automated, though it found nothing showing an AI agent making decisions. It expects the attackers to swap the remaining ether into bitcoin in small batches. After that, it expects them to try to cash out through over-the-counter brokers and Chinese money laundering networks.
Small batches and many wallets make each step look unremarkable. Meanwhile, analysts, exchanges and others can freeze what they can reach, which explains why $2.85 billion is frozen while $3.11 billion is still sitting at linked addresses. CoinDesk has reported on the hacking group known as TraderTraitor and calls it responsible for some of the industry's most recent high-profile thefts. For ordinary users, the practical point is that a headline number never tells you how much will be recovered or when.
The shortfall in this case was covered by the exchange rather than by recovering the coins. Binance says it has replenished virtually all the stolen assets. That is Binance's own statement. Many hacked platforms in other cases may not be able to do the same.
What withdrawal reopenings and frozen funds mean for your balance
Two different things are easy to confuse here.
Frozen stolen funds are coins the attackers took that have been blocked at the point where they tried to move them. That does not mean customer accounts are frozen.
Paused withdrawals are the exchange's own decision about which tokens and networks it lets users move off the platform. On Friday, Binance said on X that it was working to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the "end of next week." It also aims to reopen withdrawals for all tokens on networks that are already restored, including ETH, BSC, Arbitrum and Optimism, according to The Block.
If you hold one of those tokens on the exchange, your balance may still show on screen, but you cannot move it off the platform until withdrawals are live. That is the core of exchange risk. What you hold is a claim on the exchange, and your ability to use it depends on the exchange's systems being safe and open.
The incident has also reached beyond crypto. Protos, citing Reuters, reports that the Federal Reserve and the Office of the Comptroller of the Currency have been contacting banks to check for unusual activity or disruptions. One bank source said their services were not disrupted, and a large bank's security team has contacted Binance to learn from the attack.
What this means for you: a practical checklist
You cannot control an exchange's internal security. You can control how exposed you are to it and how well you protect your own accounts.
- Decide how much you want on an exchange. Coins you are actively trading belong there. Coins you plan to hold for years can sit in self-custody, such as a hardware wallet. That has its own risks, so only do it once you understand backups.
- If you self-custody, protect the recovery phrase. Write it on paper or metal, keep it offline, and never type it into a website, chat or "support" form. Test a small transfer first.
- Use strong account security. Choose a unique password, an authenticator app or security key instead of SMS codes, and turn on any anti-phishing code your exchange offers.
- Use a withdrawal address allowlist if your exchange offers one, so funds can only go to addresses you approved in advance.
- Do not install software from search ads. The first Binance engineer was caught this way. Go to the developer's official site directly, or use a bookmark.
- Treat unexpected "assignments" and job offers with suspicion. If someone sends you a file to run as a test, do not open it on a computer that holds wallets or exchange logins.
- Keep crypto work on a clean device if you can, and keep your operating system and apps updated.
- Expect scams after big news. Fake emails, texts and social posts about "withdrawal reopenings," "compensation" or "recovery of stolen funds" are common. Use only the exchange's official app or a site address you typed or bookmarked yourself. Nobody legitimate needs your recovery phrase.
This is about risk, not a call to buy or sell anything. Whether and when to move assets is your decision, and both exchange custody and self-custody involve trade-offs.
FAQ
Is my crypto safe on an exchange after a hack like this?
There is no guarantee. Binance says it has replenished virtually all the assets stolen in the breach, according to The Block, but that depends on the company's own resources. Funds on an exchange are only as safe as the exchange's security and finances, which is why many holders split their coins between platforms and self-custody.
Why can't stolen crypto just be frozen or returned immediately?
Attackers spread funds across thousands of wallets and several blockchains and swap between assets. Elliptic counted more than 20,000 wallets, 16 blockchains and 65,000 transactions in this case. Funds can only be frozen where an exchange or other party can see them and act, so some of the money is stopped, as with the $2.85 billion frozen here, while the rest stays at large for a long time.
What should I do if my exchange pauses withdrawals for a token?
Check the exchange's official status page or verified social account for updates, and ignore messages that ask for your login details or recovery phrase. Do not send funds anywhere new because someone contacted you, and keep your account protections in place until withdrawals reopen.
Sources
- The Block: Elliptic says Binance hackers swapped stolen tokens for $124M in bitcoin, exchange plans more withdrawal reopenings
- Decrypt: $3.1B in Stolen Binance Crypto Has Yet to Be Laundered: Elliptic
- CoinDesk: What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist?
- Protos (hacks, scams, investigations): Binance hack spooks US gov’t into checking on banks, report
Photo: Alesia Kozik / Pexels
I'm an Italian creator who builds apps, games and websites. I run Crypto Radar Daily with the help of AI tools: every article starts from the sources linked above, and I check what goes out. I'm not a doctor, a lawyer or a financial adviser. Spotted a mistake or have an idea? Write to me.
Instagram @spartaco_94_My websiteWrite to meAbout this blog