Binance hack: full timeline and what we know

What is new today

Binance says its investigation found additional points of breach beyond the compromised engineer laptop it named at 02:24 UTC. Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action", and that the investigation "has not attributed responsibility to any individual", according to Decrypt.

Binance says about $3 billion is frozen onchain and that it will cover all losses from its SAFU fund and company funds. Deposits have reopened. Withdrawals stay suspended while Binance rebuilds its withdrawal service, and at 08:37 UTC it said it was on track to resume them in 45 hours.

Binance says it is gathering facts in coordination with law enforcement. One wire report at 10:54 UTC names the FBI and the US Secret Service; that detail comes from a single report and is not yet confirmed by a second source.

Musk and CZ on X

Elon Musk posted "Everyday is Zeroday" on Oct 29, and Binance co-founder Changpeng Zhao (CZ) posted "Loss might be a bit higher than that, but will cover.", as reported by Yahoo Finance and Benzinga.

On Oct 30, crypto outlets reported a sharper exchange: Musk reacting to CZ's posts with emojis, and CZ asking him to stop trolling citing their $500 million X investment. The Defiant reports that CZ said the hack leaves about a $2 billion gap and pointed to Binance's SpaceX shares, without explaining how those shares would fund reimbursements. Spectre has not verified these posts on X, so treat them as unconfirmed. Binance's own statements say it will cover all losses from its SAFU fund and company funds.

Why it matters beyond Binance

A theft this size touches far more people than one exchange's customers.

Binance users: withdrawals have been paused since the first night and are expected back in about 45 hours; deposits work; Binance says it will cover all losses.
BNB holders: BNB fell 6.5% to a low of 684.06 at 00:15 UTC on Binance spot and at 11:00 UTC was 4.0% below its close before the first report.
Stablecoin holders and issuers: Tether ($1.567B of USDT), Circle ($823M of USDC) and First Digital (FDUSD) froze tokens held by the attacker. The freezes protect victims, and they are also a reminder that these issuers can freeze any address.
Other exchanges and trading firms: Wintermute said its Binance exposure was less than 20% of net equity and GSR less than 5% of net equity. Standard Chartered's Geoffrey Kendrick said the breach could speed up a shift to decentralised exchanges.
DeFi on the chains the money moved through: Aave froze markets across its V3 and V4 deployments as a precaution, the Arbitrum Security Council froze about $30.5M, and THORChain's RUNE jumped 13% because North Korean hackers previously used THORChain to move funds stolen from Bybit and Bitget.
Regulators and the industry: Chainalysis puts the theft at four times the 2025 Bybit theft, the largest on record, and Binance is working with law enforcement.
Every reader: coins held on any exchange depend on that exchange's operational security, and withdrawals can stop without warning while it responds to an attack.

Silver linings: how this compares with past hacks

The loss is a record, but the response so far looks better than in most past exchange hacks.

More money stopped: about $3 billion of the $6.3 billion is frozen, about 48%, within a day. After the 2025 Bybit hack of about $1.4 billion, Bybit's CEO Ben Zhou said in April that 3.8% had been frozen.
Users are not left holding the loss: Binance says it will cover all losses from its SAFU fund and company funds. In May 2019 it said "Binance will use the SAFU fund to cover this incident in full" after hackers took about 7,000 BTC, about $40 million. Bybit closed its gap in 2025 and returned to 1:1 backing of client assets.
Unlike Mt. Gox: after it shut down in 2014 having lost 850,000 BTC, creditors waited about a decade; repayments began only in July 2024 and the deadline now runs to October 2027.
Fast, coordinated freezes: Tether and Circle moved within 35 minutes of the first report, the Arbitrum Security Council at 00:52 UTC and First Digital at 02:21 UTC.
The exchange is still running: deposits work and Binance says withdrawals are on track to restart in 45 hours.
Fast attribution: Chainalysis and TRM Labs pointed to North Korea's TraderTraitor under 9 hours after the first report, which helps exchanges and issuers know which addresses to block.

Timeline (UTC)

From the first report on Spectre's news wire to the newest statement.

Oct 29, 20:40 - Spectre's wire carries the first report: Binance appears to be under an ongoing hack, according to on-chain data.
21:06 - Tether freezes USDT tied to the suspected hack, first reported as $971M.
21:14 - Circle freezes $823M of USDC.
21:24 - Binance says it is investigating a potential security breach.
21:28 - Tether says it has frozen $1.567B of USDT.
22:32 - Aave freezes markets across its V3 and V4 deployments as a precaution.
23:06 - Outflows of $6.26B to attacker-controlled addresses across nine chains are reported.
23:28 - Binance says $2.54B of the stolen crypto is frozen.
Oct 30, 00:52 - The Arbitrum Security Council freezes about $30.5M tied to the exploit.
00:56 - Binance puts the frozen amount at $3B.
02:21 - First Digital says it froze the stolen FDUSD.
02:24 - Binance discloses a $6.3B loss that began with a compromised engineer laptop.
04:17 - Binance says withdrawals stay paused and are expected to resume within 48 hours; deposits work normally.
05:01 - Chainalysis CEO Jonathan Levin says North Korea's TraderTraitor likely carried out the hack and puts the theft at $6.4B.
05:51 - TRM Labs links the hack to North Korea with high confidence; ZachXBT finds funds from the Binance and Bitget hacks converging at the same address.
07:37 - Richard Teng: a multi-step breach, no evidence of a private-key leak, and Binance will cover all losses.
08:37 - Binance reports additional points of breach and says it is on track to resume withdrawals in 45 hours.
09:52 - THORChain's RUNE jumps 13%.
10:54 - A single wire report says Binance is working with the FBI and the US Secret Service (unconfirmed).

Confirmed and reported

Confirmed by Binance: the $6.3 billion loss, the compromised engineer laptop as the starting point and additional points of breach since, about $3 billion frozen, deposits working, withdrawals paused and on track to restart in 45 hours, and all losses covered from its SAFU fund and company funds.

Reported by others: the North Korea link, from TRM Labs, Chainalysis and ZachXBT; Chainalysis's estimates of $5.912 billion at the time of theft and later $6.4 billion; the FBI and US Secret Service detail (single report). Binance says its investigation has not attributed responsibility to any individual and found no evidence of a private-key leak.

Unconfirmed X posts: the Musk and CZ exchange and CZ's reported $2 billion gap and SpaceX shares.

Freezes and recovery

Binance has not said how the issuers' freezes fit into its own figure, so these figures should not be added up.

Tether: $1.567B of USDT by Tether's own figure, first reported as $971M.
Circle: $823M of USDC.
Binance's frozen amount rose from $2.54B at 23:28 UTC to $3B at 00:56 UTC.
Arbitrum Security Council: about $30.5M, held in a wallet only the council or an Arbitrum DAO vote can unlock.
First Digital: the stolen FDUSD; no amount given.

Market reaction

Spectre's 15-minute candles from Binance spot.

BNB: 731.69 at 20:15 UTC, the last close before the first report; low 684.06 at 00:15 UTC (-6.5%); 702.21 at 11:00 UTC (-4.0% since the first report).
BTC: 80,396 at 20:15 UTC; low 76,837 at 01:45 UTC (-4.4%); 77,762 at 11:00 UTC (-3.3%).
RUNE: 0.6070 at 20:15 UTC; 0.6600 at 11:00 UTC (+8.7% since the first report).

Live tracker: Crypto market today, today’s numbers, updated through the day.

What to watch

Whether withdrawals restart inside the 45-hour window Binance gave at 08:37 UTC
Fund tracing and any further freezes, especially funds moving through THORChain
How Binance funds the cover beyond its SAFU fund, and whether BNB holds above its overnight low of 684.06

Questions readers ask

Will Binance users lose money?

Binance says it will cover all losses from its SAFU fund and company funds. Withdrawals are paused until the restart Binance expects in about 45 hours.

How much of the stolen crypto is frozen?

Binance puts the frozen amount at about $3 billion, about 48% of the $6.3 billion it disclosed. Tether said it froze $1.567 billion of USDT and Circle froze $823 million of USDC; Binance has not said how those freezes fit into its figure, so the figures should not be added up.

How does this compare with the Bybit hack?

Chainalysis puts this theft at four times the 2025 Bybit theft. Bybit's CEO said in April 2025 that 3.8% of the roughly $1.4 billion taken had been frozen; here about 48% was frozen within a day.

Who is behind the hack?

TRM Labs, with high confidence, and Chainalysis CEO Jonathan Levin link it to North Korea's TraderTraitor. Binance says its investigation has not attributed responsibility to any individual.

Ask Spectre: When will Binance withdrawals resume after the hack?Use Spectre inside ChatGPT or Claude Join the Spectre beta

Sources

See a discrepancy? Send the article URL and supporting evidence to spectre@spectreai.io.

Explore Spectre