Binance said on Friday that its hot wallets were compromised at around 20:05 UTC on Thursday, October 29, resulting in a loss of approximately $6.3 billion in token assets. The company described the event as unauthorized withdrawals and said it would absorb the loss.
Binance named the affected objects as its hot wallets and listed USDC, USDT, BTC, ETH and BNB among the stolen tokens. In its Security Incident Update #2, it said it had already set aside more than $6.34 billion in company funds, with $5 billion held in the exact impacted token assets. “Binance will absorb the financial impact of these stolen funds, not our users,” the update stated. The exchange said it would cover the amount through its Secure Asset Fund for Users and its corporate treasury. It temporarily suspended withdrawals for security checks while deposits and other unaffected services remained open.
TRM Labs said it attributed the attack with high confidence to TraderTraitor, a North Korean unit, and tracked approximately $6.36 billion moved from Binance wallets across ten blockchains, most of it in about 20 minutes. Chainalysis also linked the activity to the same unit. North Korea has not commented; Reuters noted that Pyongyang routinely denies involvement in such thefts. Binance said approximately $3 billion of the affected assets had been frozen on-chain by partners to date.
Public U.S. statements do not confirm the attribution to North Korea or the precise total for these wallets. The FBI said it was aware of the incident and was coordinating with partners to understand the scope and take investigative steps, according to reports citing the bureau. Binance said it had found no evidence that wallet private keys were leaked.
In February 2025, the FBI attributed a theft of approximately $1.5 billion from the cryptocurrency exchange Bybit to TraderTraitor. That earlier figure is a background reference.
Cryptocurrency exchanges have previously reported large thefts of hot-wallet assets. The background number is not a tally of today’s named objects. On Saturday, Binance said it had replenished 90 percent of the stolen assets by buying replacement tokens with company funds, according to the exchange and Reuters.
SOURCES: Binance Security Incident Update #2, Binance update on X October 31, Reuters, AP, TRM Labs, FBI (via Bloomberg and other reports), FBI public service announcement on Bybit.
