Is Binance Being Hacked? $2 Billion Outflow Puts Customer Funds in Question

Binance's Oct 29 hot-wallet drain was not the first time a major exchange lost user funds to tooling it controlled: Bybit lost $1.5 billion to the same North Korea-linked TraderTraitor unit in 2025, and Bitget was hit for $387 million in September. Each time, the response has been identical: issuers freeze stablecoins, the exchange promises full reimbursement, and investigators trace the rest across chains. This hack, at roughly $6.3 billion, is simply the largest version of a pattern the industry has seen before.

Users who kept funds on Binance could not withdraw for days, then moved $4.649 billion out against $1.01 billion in deposits once withdrawals reopened, pulling 2.1% of the exchange's $171 billion in reported assets. DeFi lenders took their own defensive steps: Aave froze 292 reserves across 16 chains to stop the attacker borrowing against stolen collateral, cutting off ordinary depositors and borrowers on those markets too. Binance must now separately petition blockchains it does not control, asking Arbitrum's DAO to release 8,425.997 ETH and 74.56 million ARB frozen mid-exploit.

A stablecoin freeze of $1.8 billion within hours shows how much control Tether and Circle retain over tokens marketed as permissionless, a power that recovered funds here but sits uneasily with the original pitch of money nobody can seize. Aave's market-wide freeze raises the same question for 'decentralized' lending: a protocol governed by a DAO still acted like a single administrator when it mattered. North Korea's denial, through Kim Yo Jong, that it carried out the attack the FBI has attributed to it leaves attribution genuinely contested even as blockchain firms converge on TraderTraitor.

Arbitrum's DAO must now vote on Binance's Nov. 5 request to release the 8,425.997 ETH and 74.56 million ARB frozen on its chain, a governance process Binance itself says could take seven weeks or longer. A release would set a precedent for exchanges recovering stolen funds through on-chain governance rather than issuer freezes; a refusal or long delay would show the limits of that route. Meanwhile Elliptic's tally of roughly $3.1 billion still unmoved across thousands of wallets will determine how much of the theft is ultimately recoverable at all.

BNBBNB it is the asset of the company or protocol in the event

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.