Quick Answer: The Binance hack drained about $6.3 billion in cryptocurrency from the exchange's wallets on October 29, mostly within a roughly 20-minute window. Attackers spread the theft across at least ten blockchains. Analysts at TRM Labs and Chainalysis link the operation to North Korea's TraderTraitor group, though Binance and law enforcement haven't confirmed that. About half the funds have been frozen so far.
Twenty minutes is how long it took to move most of $6.3 billion out of a major exchange. That's a number that should make anyone holding crypto on a platform pause. The Binance hack is already being called the largest crypto heist on record, and the speed is only part of what makes it unsettling. The more useful story is what happened before the first transaction, and why so much of the money is now beyond anyone's reach.
What Actually Happened on October 29
Starting around 4pm ET on Thursday, attackers began siphoning cryptocurrency from wallets belonging to Binance. Binance suspended all deposits and withdrawals almost immediately, as WIRED reported. The drained assets were spread across Ethereum, Bitcoin, Tron, Solana, and several other networks.
According to TRM Labs' analysis, the majority of the theft happened in roughly 20 minutes. Every drained wallet routed funds to multiple addresses controlled by a single attacker. That consolidation is a useful clue. It suggests one coordinated operator, not a loose group of opportunists.
Speed like this doesn't happen by accident. The attacker had to know which wallets mattered, how to authorize transfers from them, and how to route funds before anyone could react.
The 36-Hour Rehearsal Most Coverage Skipped
Here's the part that gets lost in the headlines. TRM says preparation began at least 36 hours before the theft. The attacker's timeline, as TRM describes it, looks like this:
- Early October 29: The operator deployed a first version of the attack code and tested it on two wallets.
- Later that day: The final version was rehearsed on a third wallet, and the test funds were routed back to the attacker.
- Four hours after the rehearsal: The same code was installed on a Binance hot wallet.
That sequence is the real lesson. The 20 minutes of draining was the visible event. The rehearsal was the window where monitoring could have flagged unusual behavior, such as unexpected test withdrawals and code running on wallets that shouldn't be executing anything new. Chainalysis also reported that one of the attacker's wallets received three small withdrawals during the test period. Small, low-value test transactions are easy to dismiss as noise, which is exactly why attackers use them.
The counter-intuitive point: most exchange security discussions focus on preventing a breach. This case suggests that detecting the preparation phase, through anomaly monitoring on wallet behavior and code changes, may matter just as much.
Why Hot Wallets Were the Weak Point
Hot wallets are cryptocurrency wallets connected to the internet. Exchanges use them to process customer withdrawals quickly. That convenience is also what makes them attractive to attackers. A cold wallet, kept offline, is much harder to reach remotely. A hot wallet has to be reachable by design.
Analysts say the funds were drained from hot wallets across all the affected chains. That points to a common structural weakness rather than a single flawed blockchain.
Binance's explanation has also shifted. The company's first investigation suggested a compromised laptop was involved. Its later statement says the investigation uncovered additional points of breach. Elliptic's Tom Robinson said the attack began with a compromised engineer's laptop, calling targeting of crypto company staff a TraderTraitor hallmark. Binance hasn't publicly confirmed the full chain of events, so treat the details as provisional.
That's worth sitting with. If an engineer's endpoint is the entry point, the security question shifts from "how strong is our code?" to "how well do we control the devices and accounts that touch production systems?"
Who's Behind It: TraderTraitor and the Attribution Problem
Three firms have publicly linked the attack to North Korea. Elliptic's Robinson said, "We think North Korea is likely responsible," and noted that if so, this single theft would almost double everything the regime has stolen in crypto to date.
The attribution picture is more nuanced than the headlines suggest:
- TRM Labs and Chainalysis say they believe TraderTraitor may be behind the attack. Chainalysis's strongest evidence was observing, in real time, funds stolen from Binance commingling with funds from last month's Bitget exploit, which had been attributed to North Korean actors.
- Elliptic hasn't tied the attack specifically to TraderTraitor, but it sees overlapping activity.
- Binance and law enforcement haven't named any suspected links to North Korea.
TraderTraitor has a track record. The FBI attributed the $1.5 billion Bybit hack to the group last year. Sophos's Rafe Pilling described the group as specialists in infiltrating decentralized finance organizations, sometimes by building fake applications to get inside. Attribution based on on-chain and off-chain analysis is useful, but it's still inference. Until authorities make a formal determination, it's fair to say the evidence points toward TraderTraitor without proving it.
Why Only Half the Money Can Be Frozen
This is where the story gets practical for anyone holding crypto. Binance and other firms have frozen a large share of the stolen funds, but a large share is still moving. Robinson said about $2.8 billion, or roughly 44% of the total, has been frozen so far, almost all of it stablecoins. The rest, he said, is mostly Bitcoin, Ether, and XRP, which "no one can freeze."
Why the difference? Stablecoin issuers and exchanges can block specific tokens because they control the contracts or accounts involved. Native assets like Bitcoin or Ether don't have a central freeze function. Stopping them depends on tracing and catching them at a point where they touch a regulated service.
Here's where most people get this wrong. They assume a freeze means the money is gone for the attacker. In reality, Robinson expects only a few more recoveries "over the coming months," and says the frozen share is unlikely to rise much further.
| Category | Approximate amount | Status (per reporting) |
|---|---|---|
| Total stolen | $6.3 billion | Drained across at least 10 blockchains |
| Frozen by firms and exchanges | About $2.8 billion (~44%) | Almost all stablecoins (Elliptic) |
| Not frozen | About $3.3 billion | Mostly BTC, ETH, XRP; recoverable only at an exchange off-ramp |
Note that WIRED's reporting cited around $3 billion frozen early on, while Binance and others described roughly half. Figures shift as tracing continues, so check the latest numbers before drawing conclusions.
What Exchanges and Users Should Take From This
Three practical lessons stand out, and none require a crystal ball:
- Segment hot wallet exposure. Keep only the liquidity needed for withdrawals in hot wallets. The less sitting in an internet-connected wallet, the less an attacker can drain in a single operation.
- Treat engineer endpoints as production assets. If a compromised laptop can lead to a treasury breach, the device needs the same controls as the systems it reaches. Hardware-backed credentials and strict access separation are the usual starting points.
- Watch for rehearsal behavior. Small test withdrawals, new code appearing on dormant wallets, and funds routed back to the origin address are all signals. Alerting on them is cheaper than recovering from a 20-minute drain.
For individual users, the lesson is simpler. Don't assume a platform's balances are safe because the platform is large. Diversify custody, and understand what your exchange does to protect withdrawals.
Frequently Asked Questions
what is the binance hack?
The Binance hack refers to the theft of about $6.3 billion in cryptocurrency from Binance wallets on October 29. Attackers drained assets across at least ten blockchains, mostly within roughly 20 minutes. Binance suspended deposits and withdrawals and says it will cover all losses while working with law enforcement.
how did attackers steal funds from binance so fast?
Attackers reportedly prepared for at least 36 hours, testing their code on several wallets and rehearsing the final version. Four hours after the rehearsal, the code was installed on a Binance hot wallet. Most funds were then drained in about 20 minutes and sent to addresses controlled by one operator.
why can't all of the binance hack money be frozen?
Stablecoins can be frozen by issuers and exchanges. Bitcoin, Ether, and XRP don't have a central freeze function, so they can only be stopped when they reach a regulated exchange or service. Elliptic estimated about 44% of the stolen funds were frozen, mostly stablecoins.
is north korea behind the binance hack?
TRM Labs and Chainalysis say TraderTraitor, a North Korea-linked group, may be responsible, and Elliptic sees overlapping activity. Binance and law enforcement haven't confirmed any link. Treat the attribution as a strong but unproven assessment until authorities make a formal determination.
Final Takeaway
The most useful lesson from the Binance hack is that the damage was set in motion long before the money started moving. Monitoring preparation signals, limiting hot wallet exposure, and securing staff devices would have addressed the weak points the attackers used. Try auditing one thing this week: how much your own exchange or wallet setup relies on a single internet-connected point of control, and what would alert you if it changed. Pass this to anyone who holds crypto on an exchange and assumes it's safe by default.