hack or exploit

USDT0 Freezes 6.19 Million Tokens Linked to Binance Exploit

34Importance
closedStatus
16News media
22Pieces
Published
Updated
Since then
22 new reports
Also mentions
BTCETHUSDT +6

Binance said it was dealing with a record-scale theft that touched about $6.3 billion, then moved to cover losses with company funds and matching tokens while outside firms and law enforcement tracked frozen assets. Separate onchain and intelligence assessments tied the incident to North Korea, and DeFi venues such as Aave later adjusted market settings after the breach.

Key claims & sources

✓
The attackers were described as moving funds into two buckets: assets that could be frozen or clawed back and assets such as ETH and BTC that do not have issuers or freeze switches.
✓
Binance said about $6.3 billion was impacted in an apparent hack, and the exchange halted withdrawals after the incident.
✓
Binance later said it had set aside more than $6.34 billion to cover the shortfall and would include those assets in its next proof-of-reserves report.
✓
Blockchain intelligence firms linked the attack to North Korea while Binance reported that about $6.3 billion was impacted in the apparent hack.
✓
Industry partners froze another $3 billion in affected assets, and Binance said it was working with law enforcement to recover those funds.
✓
TRM Labs said the theft came from North Korea’s TraderTraitor operation with high confidence and estimated that about $6.36 billion was moved across ten blockchains.
✓
Aave reopened its V3 and V4 markets on October 30, 2026, after a precautionary closure tied to the Binance hack, but nine assets remained restricted.

What it means

Binance's halt on withdrawals cut off access to funds for account holders regardless of whether their own assets were touched, forcing traders to wait while the exchange investigates. Law enforcement, including the FBI, is now chasing roughly $3 billion in assets that industry partners managed to freeze before they could be laundered further. Binance says the remaining shortfall will be covered from company funds, meaning depositors are not meant to lose principal, but restored withdrawals depend on how that recovery effort plays out.

Binance holding $6.34 billion in reserve to cover the gap underlines how centralized exchanges still function as de facto banks, with solvency resting on one company's balance sheet rather than on-chain guarantees. That cuts against the self-custody ethos crypto was built on: holders of funds on Binance never controlled the keys that were ultimately compromised. Whether a proof-of-reserves snapshot, promised in the next report, can substitute for genuine transparency after a breach this size is a fair question critics are already raising.

Binance's next proof-of-reserves report, meant to show the $6.34 billion set aside, will be the first independent-style test of whether its recovery claims hold up. The gap between Binance's own $6.3 billion estimate and BitOK's $6.15 billion trace across nine blockchains remains unresolved and could shift as forensic analysis continues. Recovery of the $3 billion frozen by industry partners, pursued jointly with the FBI, will determine how much of the stolen total is ultimately clawed back.

Market reaction i

BitcoinBTC it is the asset of the company or protocol in the event
first headline
+0.3% 2 h before
-1.3% 4 h after
$78,542price at publication
11data points

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 30 09:43
+1 h 3 m
Oct 30 10:46
CR Cryptopolitan adds
Adds $6.3B and $3B, with quotes
+1 h 5 m
Oct 30 10:48
+2 h 17 m
Oct 30 12:00
+2 h 30 m
Oct 30 12:13
+2 h 48 m
Oct 30 12:31
+2 h 48 m
Oct 30 12:31
CR Cryptopolitan adds
Adds $1B and $500M; brings into the story: CZ, with quotes
+2 h 55 m
Oct 30 12:38
+2 h 58 m
Oct 30 12:41
+3 h 18 m
Oct 30 13:01
NPR — Business echo
Picks up what was published, with no new facts
+3 h 18 m
Oct 30 13:01
NPR — World echo
Picks up what was published, with no new facts
+3 h 28 m
Oct 30 13:11
Cointelegraph echo
No new facts: shortfall, setting, recover
+3 h 32 m
Oct 30 13:14
The Block echo
No new facts: allocated, partners, ready
+3 h 40 m
Oct 30 13:23
Financial Times echo
No new facts: bypassed, standard, suggests
+3 h 50 m
Oct 30 13:33
Cryptonews.com context
Its angle: institutions, accelerating, accumulation
+4 h 50 m
Oct 30 14:33
The Crypto Guardian adds
Adds $1.5B; brings into the story: TRM, with quotes
+5 h 32 m
Oct 30 15:15
The Cryptocurrency Post context
Its angle: infrastructure, exfiltrations, authorization
+9 h 17 m
Oct 30 19:00
The Coin Republic echo
No new facts: intervention, maintaining, wintermute; with quotes
+9 h 53 m
Oct 30 19:36
Crypto Economy echo
No new facts: cybercriminal, unprecedented, developments
+11 h 25 m
Oct 30 21:08
Crypto Briefing context
Its angle: investigates, accelerate, regulatory
+19 h 47 m
Oct 31 05:30
CR Cryptopolitan adds
Brings into the story: LTV
+1 d 2 h
Oct 31 11:47
The Defiant echo
No new facts: transferred, deposited, separate

Thefts of a similar size

WhenWhat happenedFigure
5.9 years ago LuBian · Weak key generation incident $3.5B
5.5 years ago Thodex · Scam incident $2.5B
5.4 years ago Africrypt · Scam incident $2.3B
6.4 years ago Wirecard · Scam incident $2.1B
5.2 years ago BitConnect · Scam incident $2B

4280 incidents stored · 0 were as large as this one or larger ($6.4B)