Binance lost $6.3 billion in 20 minutes; Tether and Circle froze $1.8 billion in an hour

01Twenty minutes out, under an hour to the first freezes

TRM’s reconstruction from on-chain data: five Binance wallets on the XRP Ledger sent 233.46 million XRP to one address between 20:05 and 20:09. At 20:20 a Bitcoin hot wallet sent 18,270 BTC, and a Tron wallet sent 612.7 million USDT within two minutes. On Ethereum, the attacker submitted one transaction carrying 50 EIP-7702 authorisations, each signed by Binance’s hot wallet; three minutes and 24 seconds later the wallet’s balance, 167,464 ETH and 63 tokens including 1.615 billion USDT, was gone. Avalanche and Polygon wallets were drained in a second wave at about 23:05.²

Stablecoins are the part an issuer can stop. Tether froze 971.1 million USDT at 21:01 and Circle 823 million USDC at 21:04; Ripple and World Liberty Financial followed within the next 70 minutes. The ether and bitcoin cannot be frozen this way: TRM counts more than 420,000 ETH and 18,270 BTC, about $2.4 billion, “beyond any issuer’s reach”.²

02What Binance says, and who says it was North Korea

Binance’s announcement of 30 October gives an initial finding: the incident may involve a “compromised DevOps engineer’s laptop”, which gave the attacker access to a service container from which unauthorised withdrawals were submitted. It has “found no evidence of any wallet private key leak”, has revoked the affected address authorisation, will cover losses from its SAFU fund and company funds, and will publish a post-mortem and an updated Proof of Reserves.¹ Co-CEO Richard Teng wrote that it “was not a single ‘one-click’ action”; a later Binance post said the investigation had “uncovered additional points of breach”, unnamed.⁷ The announcement gives no date for withdrawals; co-CEO Yi He wrote on X at 04:17 UTC that they should resume “in the next 48 hours”.⁶

How the signing happened is open. Blockaid counts eleven Binance hot-wallet keys signing transfers;⁷ TRM’s reading is that the attacker could make Binance’s signing system “sign transactions of its choosing”.² TRM attributes the theft to TraderTraitor, North Korea’s state hacking unit, “with high confidence”.² Chainalysis reached the same “intelligence assessment” at 04:30 UTC, citing stolen funds mixing with proceeds of last month’s Bitget exploit;³ four hours earlier it had told Reuters it could not yet confirm the cause.⁴ No law-enforcement agency has attributed this theft. The FBI named TraderTraitor for Bybit’s $1.5 billion loss in February 2025.²

03Markets on 30 October

Bitcoin fell 3% to $76,469.82, a six-week low, in Asian trading;⁴ CoinDesk measured BTC down 4.8% and BNB down 8%.⁵ Coinbase fell 4.8% and Strategy nearly 6% in extended US trading,⁴ then 5.2% and 5.1% before Friday’s open.⁸ US indices fell as well, on Amazon’s and Intel’s AI spending by Reuters’ account: the Nasdaq opened 2.26% lower and the S&P 500 1.16% lower, while the Dow was flat.⁹ How much of the crypto-stock fall belongs to Binance cannot be separated from these numbers.

04Not yet known, and what to check now

Not yet known: the root cause and the “additional points of breach”; whether keys were copied or the signer was driven; a law-enforcement attribution; when withdrawals actually resume; the new Proof of Reserves.

For a company holding crypto or running signing infrastructure, TRM’s published guidance:²

• Alert on any EIP-7702 delegation on a treasury wallet; treat many authorisations across a nonce range as compromise.
• Keep a tested, pre-approved way to sign a revocation.
• Separate signing infrastructure and approval paths by chain and wallet tier.
• Screen deposits and counterparties against the attacker addresses TRM has labelled.

Binance’s first finding also poses one question any signing team can answer today: which engineers’ machines can reach the service that submits withdrawals.