Binance's $6.4 billion breach leaves bitcoin and ether under pressure

What happened

Attackers drained roughly $6.4 billion from Binance hot wallets on Thursday in what blockchain analytics firms Chainalysis and TRM Labs describe as the largest crypto theft to date. Withdrawals began at about 4:05 p.m. ET, after U.S. markets had closed, and moved across roughly 10 blockchains, with most of the funds leaving within about 20 minutes. The total is more than four times the previous record, the $1.5 billion Bybit heist of February 2025; CoinGape put the figure at about $6.3 billion. The breach hit Binance's own infrastructure rather than the underlying networks.

Binance initially traced the incident to a compromised laptop used by a DevOps engineer, which may have given the attacker access to a service container and allowed unauthorized withdrawals. The exchange later said its investigation had found additional points of breach, with CEO Richard Teng describing a more complex process that did not depend on one engineer's permissions. Binance said it found no evidence that wallet private keys leaked and that the attacker used a self-destruct mechanism to wipe tooling and traces. On Ethereum, the attacker used EIP-7702, a feature introduced in 2025 that lets ordinary wallets run smart-contract code temporarily, turning a hot wallet into a sweeper contract through 50 pre-signed authorizations, according to TRM Labs. Teng said the delegation bypassed normal approval controls, and TRM said the episode pointed to a compromise of Binance's signing infrastructure rather than a flaw in Ethereum itself.

Chainalysis and TRM Labs both attributed the theft to TraderTraitor, a North Korean state-linked group also blamed for Bybit. Teng said Binance would cover every dollar of the losses with company funds and its Secure Asset Fund for Users, stressing that customer assets were never touched. The exchange has set aside more than $6.34 billion, about $5 billion of it in the exact tokens taken, BTC, ETH, BNB, USDC and USDT, and is buying the rest on the open market and over the counter. Withdrawals were paused while systems are rebuilt and retested, with a target of restoring them by Sunday and publishing a complete proof of reserves by Monday; deposits are operating normally. Tether froze more than $1.5 billion and Circle about $823 million, leaving roughly $3 billion frozen or located. Elliptic estimated the attacker still controls about $3.3 billion, including more than 420,000 ETH and 18,270 BTC.

Why it matters

Prices fell, though less sharply than in past exchange failures. Bitcoin dropped to about $76,400 on Friday, down roughly 4%, and more than $1.3 billion in leveraged positions were liquidated. By comparison, a failed attack on Binance in March 2018 knocked nearly 11% off bitcoin within minutes. Analysts credited a larger market, now worth around $2.6 trillion, and spot bitcoin ETFs holding roughly 1.3 million BTC in steadier hands. Institutional flows nonetheless weakened: CoinGape, citing SoSoValue, reported $643 million in net outflows from U.S. spot bitcoin ETFs on October 30, including $234 million from BlackRock's IBIT, and $156 million from spot ether ETFs, a fifth consecutive day of withdrawals with $76.64 million leaving BlackRock's ETHA. Wall Street firms including Cantor Fitzgerald, TD Cowen and Compass Point urged clients to buy crypto-linked stocks on the weakness, framing the hack as a Binance security failure rather than a threat to the technology, while CFTC Chairman Michael Selig told CNBC the breach supported the agency's case for U.S. oversight of offshore exchanges.

What the data shows

CoinGape reported bitcoin trading at $77,247 and ether at about $2,243 on October 31, with the total crypto market capitalization at $2.59 trillion, down 0.59% over 24 hours. It noted bitcoin's MACD line at -1,148.98 against a signal line of -580.12 and a histogram of -568.86, which it read as continued selling pressure, with support at $76,300 and then $75,900 and resistance at $78,000 and $80,000. Ether's four-hour relative strength index stood at about 37, near oversold territory by that measure, with support at $2,208 and $2,156 and resistance at $2,300 and $2,400.

Background

The Binance breach joins a series of large exchange and protocol failures. CoinGape listed the $1.5 billion Bybit ether theft of February 2025, the $611 million Poly Network loss in 2021, roughly $624 million taken from Ronin Network in March 2022, $534 million from Coincheck in January 2018 and about $470 million in bitcoin from Mt. Gox. Decrypt reported that after the Bybit hack, TraderTraitor converted roughly 84% of the stolen ether into bitcoin through the cross-chain network Thorchain, and that attribution of the Binance theft pushes North Korea's 2026 crypto haul past $1 billion. Binance is cooperating with law enforcement worldwide, including the FBI and the U.S. Secret Service; the FBI confirmed it was aware of the incident and coordinating with partners, while the Secret Service declined to comment. The case echoes April's Operation Atlantic, which traced tens of millions in stolen crypto.

What to watch

Binance's stated timetable, withdrawals by Sunday and a full proof of reserves by Monday, will be the first test of its pledge to make users whole. Investigators will also track where the unrecovered funds go: the attacker has kept shuffling assets through Tron and other networks, and the ether and bitcoin portions cannot be frozen by any issuer. The public exchange between Binance founder Changpeng Zhao and Elon Musk on X, in which Zhao cited the exchange's $500 million investment in Musk's Twitter takeover, and the wider political argument over offshore oversight are likely to run alongside the technical investigation.

Questions readers ask