About $6.3-6.4 billion was withdrawn from Binance hot wallets. This happened late in the evening on October 29, the money went out across 10 blockchains. There has never been anything like this in the industry's history: the sum is roughly four times larger than the $1.5 billion Bybit hack in February 2025.
A hot wallet is an exchange's storage connected to the network. It is from there that client payouts are made, so access to it equals access to users' money.
This affects traders directly. Withdrawals on Binance are halted, and the crypto market went down following the news.
How did it happen?
Most of the funds left within 20 minutes. The count starts at 23:05 Moscow time on October 29.
- BTC and ETH - the main stolen assets
- USDT and USDC - stablecoins, i.e. coins whose rate is pegged to the dollar
- Small tokens - the FUN token fell 90% at the start of trading
How did the attackers get in?
Binance first named an infected DevOps engineer's laptop as the cause. Through it, unauthorized withdrawal requests went into internal systems. The exchange then reported "additional points of compromise."
- The EIP-7702 delegation mechanism. On Ethereum, the attacker used it to turn the exchange's hot wallet into an automatic "collector."
- 50 pre-signed permissions. That is exactly how many the attacker used for this scheme.
- The keys, according to the exchange, are intact. Binance claims the private keys were not stolen.
Who will return how much?
The exchange has set aside more than $6.34 billion of its own funds to restore client balances. It already has about $5 billion in the same tokens, and the rest is being bought on the market and off-exchange. These assets will be included in the next reserves report.
- $2.67 billion - frozen by partners Tether, Circle, Ripple and World Liberty Financial in stablecoins
- 8,426 ETH and 74.6 million ARB - blocked by Arbitrum
- about $3 billion - total frozen
- over 420,000 ETH and 18,270 BTC - left with the attacker, roughly $2.4 billion that issuers cannot reach
The trail leads to North Korea. TRM Labs and Chainalysis attribute the attack with high confidence to the TraderTraitor group - the same one behind the Bybit hack.
What about the market and withdrawals?
Withdrawals on Binance are halted pending checks; deposits work. The exchange estimated resumption at 45-48 hours.
- BTC - about $77.3K (-3.6%)
- ETH - $2,231 (-4%)
- $1.57 billion - market liquidations in 24 hours
- the 322nd incident in 2026 - according to DefiLlama, with total losses of more than $8.7 billion
The main point: when an exchange closes withdrawals, the position remains but access to the money does not. Before the next such move, it is worth checking in the prop firm rules which exchanges and assets you are allowed to use.
Were you in crypto when withdrawals froze?
Trading such news and physically not having access to your own funds are different things. Many found that out overnight. Hence a simple question for any trading program: which exchanges and coins are allowed in it, what volume you can hold, and how drawdown is calculated when the market falls 4% in an hour. Prop firms have the answers written in the rules, not in a banner, and they differ greatly. It is worth checking them before the market stages the next such Friday.