Institutional crypto investors rush to pull funds from exchanges after Binance hack
- Published
- Updated
Binance said the October 29 theft began with a fake job interview and a months-long intrusion that started in June, and later reopened withdrawals in phases after setting aside company funds to cover user losses. Recovery efforts drew in stablecoin issuers and U.S. investigators, while blockchain firms tied the stolen funds to North Korea and tracked rapid movement across multiple networks.
Key claims & sources
What it means
Binance's October 29 breach follows the Bybit hack of 2025, which held the prior record at $1.5 billion before TraderTraitor-linked actors took roughly four times that from a single hot wallet. Binance used EIP-7702 delegation and a compromised signing process rather than classic private-key theft, a technique that let attackers authorise withdrawals without the usual approval controls the exchange relied on since earlier security overhauls.
Exchange customers saw withdrawals paused entirely, then reopened network by network, starting with Bitcoin and followed by USDT, USDC, ETH and BNB, while holders of less liquid tokens waited longest for access to their own funds. Tether, Circle and Ripple froze over $2.5 billion between them within hours, a move that protected users but also showed stablecoin issuers can lock funds unilaterally, for better or worse, whenever they judge it necessary.
Pledging $6.34 billion of company funds to make users whole is a reassurance, not a fix: it does not explain how a single wallet's signing authority could be hijacked for five months before any coin moved. Elliptic's tracking of 12,000 wallets across 11 chains in under four days shows laundering now outpaces freezing tools, which sits uneasily against crypto's founding promise of resistance to censorship and seizure.
Binance's full forensic report, promised after its October 29 disclosure, will determine whether the fake-interview recruitment scheme exploited a one-off lapse or a systemic gap in how exchanges vet engineering hires. Watch also the remaining token withdrawals Binance targeted for reopening by November 13, and whether the roughly $3.1 billion Elliptic says is still unlaundered gets frozen or finally moves.
Market reaction i
Bitcoin rose 1.5% in the 4 hours after the first headline, after falling 1.9% in the 2 hours before.
47 prices, one every 30 minutes · The move was larger before the first headline than after: an observation, not an explanation. The market also moves on things nobody publishes.
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 5.9 years ago | LuBian · Weak key generation incident | $3.5B |
| 5.6 years ago | Thodex · Scam incident | $2.5B |
| 5.4 years ago | Africrypt · Scam incident | $2.3B |
| 6.4 years ago | Wirecard · Scam incident | $2.1B |
| 5.2 years ago | BitConnect · Scam incident | $2B |
4285 incidents stored · 0 were as large as this one or larger ($6.4B)