hack or exploit

Institutional crypto investors rush to pull funds from exchanges after Binance hack

77Importance
no updates 6h+Status
23News media
68Pieces
Published
Updated
Since then
68 new reports
Also mentions
BTCETHUSDT +10

Binance’s October 29 hack remained the central story across later coverage, with the exchange saying the intrusion started months earlier and first surfaced through a fake job interview and other access points. The latest reporting adds more detail on the recovery, including phased withdrawals, large amounts frozen or replaced, and continuing movement of stolen funds across blockchains.

Key claims & sources

✓
Crypto.news said the hack triggered heavy liquidations and pushed bitcoin to $78,419, with traders watching $80,000 resistance and $76,300 support.
✓
TRM Labs and Chainalysis tied the attack to North Korea’s TraderTraitor group, and Binance said it had set aside $6.34 billion of company funds to cover user losses.
✓
Binance restored USDT, USDC, ETH and BNB withdrawals across Ethereum and BNB Smart Chain, while other networks were still waiting for approval.
✓
Binance opened withdrawals in phases starting with bitcoin, after saying Bitcoin would be the first network to reopen.
✓
Tether froze more than $1.5 billion in USD₮ within 30 minutes of the October 29 breach, while the U.S. Secret Service joined Circle, the FBI and other industry firms in the recovery effort.
✓
Elliptic said the stolen funds were moving through 12,000 wallets on 11 blockchains in less than four days, with a new wallet appearing roughly every 25 seconds.
✓
Binance said the October 29 theft began with a fake job interview and followed a months-long intrusion that started in June and ran through September before any coins moved.
✓
Binance said two engineers were compromised separately between June and September through malicious software and a fraudulent hiring process.

What it means

Binance's Oct. 29 breach, which drained about $6.34 billion in roughly 20 minutes, became the largest exchange hack on record, eclipsing Bybit's $1.5 billion loss in 2025. Unlike a single-moment exploit, this one began months earlier, in June, through a tampered software install and a fake job interview that compromised two engineers, only surfacing when stolen coins moved through an Ethereum hot wallet in October.

Institutions reacted by pulling capital rather than waiting for forensic clarity, and Binance later reported $3.64 billion in net outflows, equal to 2.1% of its $171 billion in assets, after reopening withdrawals in phases. Holders of BTC, ETH, USDT and BNB regained access first; holders of other tokens still waited for clearance. Rival exchanges moved to tighten signing infrastructure and wallet-delegation controls, a response competitors can no longer put off.

Binance's pledge to cover losses from its own treasury works because it owned the compromised hot wallet outright, sparing customers direct harm, but it also shows how much trust in exchange custody still runs through one company's balance sheet. The episode revives a familiar tension: platforms marketed as gateways to decentralized finance remain centralized points of failure, where a single exploited signature can move billions before any user ever acts. (per coinpedia.org)

Binance says it has frozen roughly $2.85 billion of the stolen funds and is still sourcing the remainder to complete its promised reimbursement; the final tally depends on how quickly the networks still awaiting clearance reopen and whether frozen assets convert back into usable reserves. Continued tracing by the Secret Service, FBI and stablecoin issuers across Tron and bridge routes will decide how much of the $6.34 billion is recovered versus laundered beyond reach.

Market reaction i

BitcoinBTC it is the asset of the company or protocol in the event
first headline
-1.9% 2 h before
+1.5% 4 h after
$77,127price at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

+42 min
Oct 30 04:38
CP CryptoPotato adds
Breaks the figures down; the largest, $6B, with quotes
+1 h 30 m
Oct 30 05:27
+1 h 55 m
Oct 30 05:51
Cointelegraph context
Its angle: converging, hacks, same; with quotes
+3 h 34 m
Oct 30 07:30
AMBCrypto context
Its angle: followed, resume
+3 h 37 m
Oct 30 07:33
+3 h 37 m
Oct 30 07:33
crypto.news echo
No new facts: liquidations, triggers, watching
+3 h 43 m
Oct 30 07:40
+4 h 5 m
Oct 30 08:02
BBC News — Business context
Its own its angle
+4 h 5 m
Oct 30 08:02
BBC News — World echo
Picks up what was published, with no new facts
+5 h 24 m
Oct 30 09:20
Cryptonews.com context
Its angle: undertaking, platforms, eclipsing; with quotes
+6 h 52 m
Oct 30 10:48
Coinpedia echo
No new facts: cryptocurrencies, analysisother, unauthorised
+7 h 7 m
Oct 30 11:03
Crypto Economy echo
No new facts: suspending, executives, escalated; with quotes
+7 h 36 m
Oct 30 11:32
Crypto Briefing echo
No new facts: allocation
+7 h 55 m
Oct 30 11:51
CoinDesk echo
No new facts: responded, here
+8 h 25 m
Oct 30 12:22
Decrypt adds
Sharpens the figure: $6.4B; brings into the story: TRM, with quotes
+9 h 41 m
Oct 30 13:37
The Crypto Guardian adds
Adds the identifier eip-7702, with quotes
+10 h 42 m
Oct 30 14:38
The Defiant echo
No new facts: publish; with quotes
+10 h 57 m
Oct 30 14:53
Crypto News Flash adds
Sharpens the figure: $6.4B
+10 h 58 m
Oct 30 14:54
The Defiant echo
No new facts: deadline, testing, rebuilt; with quotes
+11 h 16 m
Oct 30 15:12
Protos echo
No new facts: specifically, convenience, exploiting
+11 h 23 m
Oct 30 15:19
crypto.news echo
No new facts: chairman, strategy, backing
+12 h 15 m
Oct 30 16:11
Crypto Briefing echo
No new facts: reshaping, standards, backs
+12 h 38 m
Oct 30 16:34
Decrypt echo
No new facts: mechanism, approval, bypassed; with quotes
+14 h 2 m
Oct 30 17:58
+14 h 12 m
Oct 30 18:09
+15 h 9 m
Oct 30 19:05
Coinpedia echo
No new facts: spokesperson, journalist, untouched; with quotes
+17 h 9 m
Oct 30 21:06
The Block echo
No new facts: legislation, looking, rules
+18 h 3 m
Oct 30 22:00
Cointelegraph echo
No new facts: immobilize, convert, players
+18 h 39 m
Oct 30 22:35
CP CryptoPotato echo
No new facts: additionally, cautioned, regarding; with quotes
+20 h 58 m
Oct 31 00:54
Crypto Briefing echo
No new facts: collaboration, integrates, mainstream
+1 d 10 h
Oct 31 14:46
Crypto Briefing echo
No new facts: volatility, liquidity, stabilize
+1 d 11 h
Oct 31 14:58
Crypto Briefing echo
No new facts: protection, resilience, proactive; with quotes
+1 d 11 h
Oct 31 15:24
CoinDesk echo
Picks up what was published, with no new facts
+2 d 2 h
Nov 1 06:10
Crypto Briefing echo
No new facts: reopenings, cautious, critical
+2 d 5 h
Nov 1 09:31
+2 d 5 h
Nov 1 09:38
Cointelegraph echo
No new facts: phase; with quotes
+2 d 5 h
Nov 1 09:42
Crypto Briefing adds
Adds $46M; brings into the story: SOL
+2 d 6 h
Nov 1 10:15
The Daily Hodl echo
No new facts: involvement, insurance, treasury; with quotes
+2 d 6 h
Nov 1 10:35
CoinDesk echo
Picks up what was published, with no new facts
+2 d 7 h
Nov 1 11:35
BeInCrypto echo
No new facts: progressively, bszpn41yrl, controlled; with quotes
+2 d 11 h
Nov 1 15:28
+2 d 12 h
Nov 1 16:32
+2 d 14 h
Nov 1 18:43
The Defiant echo
No new facts: explicitly, downstream, operators
+3 d 1 h
Nov 2 05:19
crypto.news echo
No new facts: commonly, thanked, helping
+3 d 4 h
Nov 2 08:01
The Daily Hodl echo
No new facts: investments, disclaimer, precaution; with quotes
+3 d 4 h
Nov 2 08:09
The Defiant echo
No new facts: reopened, groups; with quotes
+3 d 5 h
Nov 2 09:53
Crypto Briefing echo
No new facts: highlighting, fragility, markets
+3 d 8 h
Nov 2 11:57
CoinDesk echo
Picks up what was published, with no new facts
+3 d 13 h
Nov 2 17:20
Tether echo
No new facts: transferred, proactivity, authorities; with quotes
+3 d 13 h
Nov 2 17:47
Coinpedia adds
Adds $3.3B, with quotes
+3 d 15 h
Nov 2 19:48
CP CryptoPotato echo
No new facts: improvement, historical, indicative; with quotes
+3 d 18 h
Nov 2 22:30
AMBCrypto adds
Brings into the story: TRON
+3 d 19 h
Nov 2 23:05
Unchained echo
No new facts: inadvertently, immediately, validators; with quotes
+4 d 4 h
Nov 3 08:28
CP CryptoPotato context
Its angle: justification, international, allegations; with quotes
+4 d 12 h
Nov 3 16:17
Unchained echo
No new facts: representative, installation, colleagues; with quotes
+4 d 12 h
Nov 3 16:44
Bitcoin Magazine adds
Sharpens the figure: $2.9B, with quotes
+4 d 14 h
Nov 3 18:40
Crypto Economy echo
No new facts: organizational, researching, independent
+4 d 16 h
Nov 3 20:43
The Block echo
No new facts: accelerating, cyberattacks, accelerate; with quotes
+4 d 17 h
Nov 3 21:30
NPR — Business echo
No new facts: interviewing, recruited, thinking
+5 d 1 h
Nov 4 05:14
Crypto Briefing echo
No new facts: maintain, answers, demands
+5 d 11 h
Nov 4 15:50
Coinpedia adds
Brings into the story: BTC, with quotes
+6 d 13 h
Nov 5 17:17
CP CryptoPotato adds
Breaks the figures down; the largest, $132.3B, with quotes
+7 d 10 h
Nov 6 14:04
+7 d 16 h
Nov 6 20:10
crypto.news echo
No new facts: maintained, santiment, negative; with quotes
+8 d 4 h
Nov 7 08:30
The Coin Republic echo
No new facts: restorations, restrictions, announcement; with quotes

Thefts of a similar size

WhenWhat happenedFigure
5.9 years ago LuBian · Weak key generation incident $3.5B
5.6 years ago Thodex · Scam incident $2.5B
5.4 years ago Africrypt · Scam incident $2.3B
6.4 years ago Wirecard · Scam incident $2.1B
5.2 years ago BitConnect · Scam incident $2B

4285 incidents stored · 0 were as large as this one or larger ($6.4B)