Institutional crypto investors rush to pull funds from exchanges after Binance hack

87Importance
updatingStatus
24News media
Published
Updated

Binance said the October 29 theft began with a fake job interview and a months-long intrusion that started in June, and later reopened withdrawals in phases after setting aside company funds to cover user losses. Recovery efforts drew in stablecoin issuers and U.S. investigators, while blockchain firms tied the stolen funds to North Korea and tracked rapid movement across multiple networks.

Key claims & sources

✓
Crypto.news said the hack triggered heavy liquidations and pushed bitcoin to $78,419, with traders watching $80,000 resistance and $76,300 support.
✓
TRM Labs and Chainalysis tied the attack to North Korea’s TraderTraitor group, and Binance said it had set aside $6.34 billion of company funds to cover user losses.
✓
Binance restored USDT, USDC, ETH and BNB withdrawals across Ethereum and BNB Smart Chain, while other networks were still waiting for approval.
✓
Binance opened withdrawals in phases starting with bitcoin, after saying Bitcoin would be the first network to reopen.
✓
Tether froze more than $1.5 billion in USD₮ within 30 minutes of the October 29 breach, while the U.S. Secret Service joined Circle, the FBI and other industry firms in the recovery effort.
✓
Elliptic said the stolen funds were moving through 12,000 wallets on 11 blockchains in less than four days, with a new wallet appearing roughly every 25 seconds.
✓
Binance said the October 29 theft began with a fake job interview and a months-long intrusion that started in June and ran through September before any coins moved.
✓
Binance said two engineers were compromised separately between June and September through malicious software and a fraudulent hiring process.

What it means

Binance's October 29 breach follows the Bybit hack of 2025, which held the prior record at $1.5 billion before TraderTraitor-linked actors took roughly four times that from a single hot wallet. Binance used EIP-7702 delegation and a compromised signing process rather than classic private-key theft, a technique that let attackers authorise withdrawals without the usual approval controls the exchange relied on since earlier security overhauls.

Exchange customers saw withdrawals paused entirely, then reopened network by network, starting with Bitcoin and followed by USDT, USDC, ETH and BNB, while holders of less liquid tokens waited longest for access to their own funds. Tether, Circle and Ripple froze over $2.5 billion between them within hours, a move that protected users but also showed stablecoin issuers can lock funds unilaterally, for better or worse, whenever they judge it necessary.

Pledging $6.34 billion of company funds to make users whole is a reassurance, not a fix: it does not explain how a single wallet's signing authority could be hijacked for five months before any coin moved. Elliptic's tracking of 12,000 wallets across 11 chains in under four days shows laundering now outpaces freezing tools, which sits uneasily against crypto's founding promise of resistance to censorship and seizure.

Binance's full forensic report, promised after its October 29 disclosure, will determine whether the fake-interview recruitment scheme exploited a one-off lapse or a systemic gap in how exchanges vet engineering hires. Watch also the remaining token withdrawals Binance targeted for reopening by November 13, and whether the roughly $3.1 billion Elliptic says is still unlaundered gets frozen or finally moves.

Market reaction i

BitcoinBTC it is the asset of the company or protocol in the event

Bitcoin rose 1.5% in the 4 hours after the first headline, after falling 1.9% in the 2 hours before.

$77,127 price at the headline
-1.9% 2 h before
+1.5% 4 h after
+0.2% 12 h after
First headline

47 prices, one every 30 minutes · The move was larger before the first headline than after: an observation, not an explanation. The market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

+42 min
Oct 30 04:38
CP CryptoPotato adds
Breaks the figures down; the largest, $6B, with quotes
+1 h 30 m
Oct 30 05:27
+1 h 55 m
Oct 30 05:51
Cointelegraph context
Its angle: converging, hacks; with quotes
+3 h 34 m
Oct 30 07:30
AMBCrypto context
Its angle: followed, resume
+3 h 37 m
Oct 30 07:33
+3 h 37 m
Oct 30 07:33
crypto.news echo
No new facts: liquidations, triggers, watching
+3 h 43 m
Oct 30 07:40
+4 h 5 m
Oct 30 08:02
BBC News — Business context
Its own its angle
+4 h 5 m
Oct 30 08:02
BBC News — World echo
Picks up what was published, with no new facts
+5 h 24 m
Oct 30 09:20
Cryptonews.com context
Its angle: undertaking, reassured, eclipsing; with quotes
+6 h 52 m
Oct 30 10:48
Coinpedia echo
No new facts: cryptocurrencies, analysisother, unauthorised
+7 h 7 m
Oct 30 11:03
Crypto Economy echo
No new facts: suspending, executives, escalated; with quotes
+7 h 36 m
Oct 30 11:32
Crypto Briefing echo
No new facts: allocation
+7 h 55 m
Oct 30 11:51
CoinDesk echo
No new facts: responded, here
+8 h 25 m
Oct 30 12:22
Decrypt adds
Sharpens the figure: $6.4B; brings into the story: TRM, with quotes
+9 h 41 m
Oct 30 13:37
The Crypto Guardian adds
Adds the identifier eip-7702, with quotes
+10 h 42 m
Oct 30 14:38
The Defiant echo
No new facts: publish; with quotes
+10 h 57 m
Oct 30 14:53
Crypto News Flash adds
Sharpens the figure: $6.4B
+10 h 58 m
Oct 30 14:54
The Defiant echo
No new facts: deadline, depends, rebuilt; with quotes
+11 h 16 m
Oct 30 15:12
Protos echo
No new facts: specifically, convenience, exploiting
+11 h 23 m
Oct 30 15:19
crypto.news echo
No new facts: strategy, chairman, backing
+12 h 15 m
Oct 30 16:11
Crypto Briefing echo
No new facts: reshaping, standards, backs
+12 h 38 m
Oct 30 16:34
Decrypt echo
No new facts: mechanism, destruct, approval; with quotes
+14 h 2 m
Oct 30 17:58
+14 h 12 m
Oct 30 18:09
+15 h 9 m
Oct 30 19:05
Coinpedia echo
No new facts: spokesperson, journalist, typically; with quotes
+17 h 9 m
Oct 30 21:06
The Block echo
No new facts: legislation, looking, rules
+18 h 3 m
Oct 30 22:00
Cointelegraph echo
No new facts: immobilize, convert, players
+18 h 39 m
Oct 30 22:35
CP CryptoPotato echo
No new facts: additionally, suggested, cautioned; with quotes
+20 h 58 m
Oct 31 00:54
Crypto Briefing echo
No new facts: collaboration, mainstream, integrates
+1 d 10 h
Oct 31 14:46
Crypto Briefing echo
No new facts: volatility, stabilize, liquidity
+1 d 11 h
Oct 31 14:58
Crypto Briefing echo
No new facts: resilience, protection, proactive; with quotes
+1 d 11 h
Oct 31 15:24
CoinDesk echo
Picks up what was published, with no new facts
+2 d 2 h
Nov 1 06:10
Crypto Briefing echo
No new facts: reopenings, cautious, critical
+2 d 5 h
Nov 1 09:31
+2 d 5 h
Nov 1 09:38
Cointelegraph echo
No new facts: phase; with quotes
+2 d 5 h
Nov 1 09:42
Crypto Briefing adds
Adds $46M; brings into the story: SOL
+2 d 6 h
Nov 1 10:15
The Daily Hodl echo
No new facts: involvement, insurance, standard; with quotes
+2 d 6 h
Nov 1 10:35
CoinDesk echo
Picks up what was published, with no new facts
+2 d 7 h
Nov 1 11:35
BeInCrypto echo
No new facts: progressively, bszpn41yrl, available; with quotes
+2 d 11 h
Nov 1 15:28
+2 d 12 h
Nov 1 16:32
+2 d 14 h
Nov 1 18:43
The Defiant echo
No new facts: downstream, explicitly, breakdown
+3 d 1 h
Nov 2 05:19
crypto.news echo
No new facts: commonly, thanked, helping
+3 d 4 h
Nov 2 08:01
The Daily Hodl echo
No new facts: investments, disclaimer, investment; with quotes
+3 d 4 h
Nov 2 08:09
The Defiant echo
No new facts: groups; with quotes
+3 d 5 h
Nov 2 09:53
Crypto Briefing echo
No new facts: highlighting, fragility, markets
+3 d 8 h
Nov 2 11:57
CoinDesk echo
Picks up what was published, with no new facts
+3 d 13 h
Nov 2 17:20
Tether echo
No new facts: proactivity, transferred, authorities; with quotes
+3 d 13 h
Nov 2 17:47
Coinpedia adds
Adds $3.3B, with quotes
+3 d 15 h
Nov 2 19:48
CP CryptoPotato echo
No new facts: improvement, indicative, historical; with quotes
+3 d 18 h
Nov 2 22:30
AMBCrypto adds
Brings into the story: TRON
+3 d 19 h
Nov 2 23:05
Unchained echo
No new facts: inadvertently, immediately, validators; with quotes
+4 d 4 h
Nov 3 08:28
CP CryptoPotato context
Its angle: justification, international, accusations; with quotes
+4 d 12 h
Nov 3 16:17
Unchained echo
No new facts: representative, installation, undetected; with quotes
+4 d 12 h
Nov 3 16:44
Bitcoin Magazine adds
Sharpens the figure: $2.9B, with quotes
+4 d 14 h
Nov 3 18:40
Crypto Economy echo
No new facts: organizational, independent, researching
+4 d 16 h
Nov 3 20:43
The Block echo
No new facts: cyberattacks, accelerating, accelerate; with quotes
+4 d 17 h
Nov 3 21:30
NPR — Business echo
No new facts: interviewing, recruited, thinking
+5 d 1 h
Nov 4 05:14
Crypto Briefing echo
No new facts: maintain, demands, answers
+5 d 11 h
Nov 4 15:50
Coinpedia adds
Brings into the story: BTC, with quotes
+6 d 13 h
Nov 5 17:17
CP CryptoPotato adds
Breaks the figures down; the largest, $132.3B, with quotes
+7 d 10 h
Nov 6 14:04
+7 d 10 h
Nov 6 14:50
Bitcoin Magazine adds
Adds $226M; brings into the story: XRP, with quotes
+7 d 16 h
Nov 6 20:10
crypto.news echo
No new facts: maintained, santiment, examined; with quotes
+8 d 4 h
Nov 7 08:30
The Coin Republic echo
No new facts: restorations, restrictions, announcement; with quotes
+9 d 18 h
Nov 8 22:00

Thefts of a similar size

WhenWhat happenedFigure
5.9 years ago LuBian · Weak key generation incident $3.5B
5.6 years ago Thodex · Scam incident $2.5B
5.4 years ago Africrypt · Scam incident $2.3B
6.4 years ago Wirecard · Scam incident $2.1B
5.2 years ago BitConnect · Scam incident $2B

4285 incidents stored · 0 were as large as this one or larger ($6.4B)