Binance halted all deposits and withdrawals after a 20‑minute hack siphoned $6.3 billion.
BINANCE $6.3B HACK EXECUTED IN 20 MINUTES
*On Oct 29 hackers drained $6.3 billion from Binance in a 20‑minute burst. *The breach triggered an emergency freeze of deposits and a scramble to lock down half the loot. *Analysts see hallmarks of North Korean TraderTraitor group, but Binance has not confirmed any link.
At 4 pm ET on Oct 29, hackers began siphoning $6.3 billion from Binance wallets spanning at least ten blockchains. In just 20 minutes the hot wallets were emptied, forcing Binance to suspend all deposits and withdrawals. The breach ignited a race among crypto firms and investigators to freeze the stolen assets.
Crypto tracing firms have frozen roughly half the loot, but $3.3 billion remains fluid. Early analysis links the operation to the North Korean group TraderTraitor, known for high‑profile crypto attacks. Binance says a compromised engineer’s laptop was part of the breach, while law‑enforcement officials have not named any suspects.
How did the attackers breach Binance’s hot wallets?
TRM Labs traced the operation to a 36‑hour preparation window. Early on Oct 29 the attacker deployed test code on two wallets, then rehearsed a final version on a third, routing the test funds back to itself. Four hours later the same code was installed on a Binance hot wallet. Hot wallets—online wallets used for customer withdrawals—across at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana, were drained. The theft unfolded in a tight 20‑minute window, emptying the wallets before Binance could react.
What evidence points to North Korean group TraderTraitor?
TRM Labs and Chainalysis both flagged the attack as consistent with TraderTraitor, an elite North Korean hacking unit. The group previously executed the $1.5 billion Bybit hack and uses similar tactics: compromised engineer laptops, fake applications, and pre‑attack rehearsals. Chainalysis observed stolen Binance funds commingling with those from the Bitget exploit, another North Korean‑attributed case. Elliptic’s chief scientist Tom Robinson said, “We think North Korea is likely responsible,” noting overlaps in on‑chain activity and the use of Tornado Cash for laundering.
How much of the stolen crypto has been frozen?
Crypto tracing firms froze roughly half of the stolen assets shortly after the breach. Elliptic reports $2.8 billion—about 44 % of the total—has been frozen, primarily stablecoins. Binance and other exchanges initially locked $3 billion of the loot. The remaining $3.3 billion remains unfrozen and is moving through new laundering patterns that Chainalysis describes as unprecedented, with thousands of rapid transactions likely automated to obscure the trail.
What is Binance’s response and next steps?
Binance halted all deposits and withdrawals within minutes of detecting the breach. In a statement the exchange said its initial investigation pointed to a compromised laptop, but later uncovered additional breach points. Binance pledged to cover all losses and is cooperating with law‑enforcement agencies to identify the perpetrators. The firm has not publicly linked the attack to North Korean actors, maintaining a neutral stance while tightening security on its hot‑wallet infrastructure.
Frequently asked questions
When did the Binance hack occur and how much was stolen?
On October 29 at around 4 pm ET, hackers siphoned about $6.3 billion from Binance wallets across multiple blockchains in roughly 20 minutes.
What evidence ties the hack to North Korean hackers?
TRM Labs and Chainalysis identified patterns matching the TraderTraitor group, which has been linked to previous North Korean‑attributed attacks such as the $1.5 billion Bybit breach; Elliptic’s chief scientist said, “We think North Korea is likely responsible.”
How much of the stolen funds have been frozen?
Crypto firms have frozen roughly half of the loot—about $2.8 billion (44 %)—mostly stablecoins, while $3.3 billion remains unfrozen.
The Binance hack underscores the vulnerability of hot‑wallet architectures and the growing sophistication of state‑backed cyber‑crime. With half the stolen funds still at large, the incident will pressure exchanges to rethink real‑time security controls. Binance’s pledge to cover losses may calm customers, but the episode leaves a stark reminder: a single compromised laptop can unleash billions in digital cash.
Sources: Wired article “The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes”