On the night of Oct. 29 (UTC), a large amount of crypto suddenly left the customer withdrawal wallet of Binance, the world's biggest crypto exchange. Binance estimates the loss at about $6.3 billion, or roughly KRW 8.3 trillion at the Oct. 23 exchange rate. That is more than four times the previous record, the February 2025 Bybit hack (about $1.5 billion).
The common reaction is, "KRW 8 trillion of customers' money was stolen." But what matters to customers is something else. The wallet that was robbed was run by Binance, and Binance says it will cover every loss. The open questions are where that money will come from and when customers can withdraw their funds again.
- What happened
The coins left a hot wallet, a wallet connected to the internet that handles customer withdrawals right away. In the first tally, $3.51 billion on Ethereum, 18,270 Bitcoin ($1.44 billion) and $630 million on Tron were moved. Blockchain analytics firm TRM Labs found that the attacker took the money across 10 blockchains within 20 minutes.
In its Oct. 30 notice, Binance pointed to a possible breach of an operations developer's (DevOps engineer's) laptop as the cause. It said it found no evidence that the wallet's private key, a password-like value that lets someone move the coins, had leaked.
In a later update the same day, Binance said it had found additional points of breach. That means the problem was not just one laptop, but Binance has not said what else was breached. It promised a detailed technical report once the investigation is complete.
The culprit has not been confirmed. TRM Labs named the North Korean hacking group TraderTraitor with "high confidence," and Chainalysis also blamed North Korea. But these are analytics firms' judgments, not law enforcement announcements, and Binance has not yet attributed responsibility.
- How was the money in the hacker's wallet stopped?
The first response came not from the exchange but from the issuers of stablecoins, coins pegged to $1 each. In the first tally, Tether froze 975.1 million USDT at the hacker's address, and Circle froze 823 million USDC in the same wallet. Circle's freeze came at 21:04, 40 minutes after the first transaction.
Think of a bank freezing a fraud account. The difference is that a bank blocks the account, while an issuer uses a stop function built into the coin from the start to keep the coins at that address from moving.
Binance said about $3 billion has been frozen on-chain. Bitcoin, by contrast, has no issuer and no freeze function, so no one could stop the 18,270 Bitcoin.
- Is the frozen $3 billion money that has come back?
No. A freeze only keeps the hacker from using the coins; it does not return them to Binance's vault.
Neither Binance nor the issuers have said when, or through what process, the frozen coins would return to Binance. Put simply, about half of the stolen amount has been locked up, but it is not yet known whether that money can be used to cover customer losses.
- Who covers customer losses, and how?
Binance said it would "cover all losses with the SAFU fund and company funds" and that "user funds are safe." SAFU is a user protection fund that Binance has set aside for incidents such as hacks.
The problem is its size. SAFU holds about $1 billion in Bitcoin, roughly one-sixth of the estimated $6.3 billion loss. Most of the rest has to come from company funds. It is like a rainy-day account that is not enough, so you have to dip into your salary account too.
It has not been announced whether customers must apply for compensation, how it will show up in their balances, or when it will be done. Binance said it will publish an updated Proof of Reserves, data showing it actually holds as many coins as customers have deposited, once remediation is complete. That data will show whether the losses have been covered.
- Can customers withdraw their money now?
As of Oct. 30, deposits are back to normal but withdrawals are still blocked. In its latest update, it said it plans to reopen withdrawals in about 45 hours after a security overhaul, but that is an estimate, not a set date.
If you hold KRW 10 million worth on Binance, your balance stays the same if the promise holds. But you cannot move that money elsewhere until withdrawals reopen. It is like a landlord saying he will return your deposit but no moving date has been set.
In Korea, Upbit issued a notice urging extra caution when sending coins to Binance and said it may restrict withdrawals to Binance if needed. We could not confirm any action by Korean financial authorities over the incident.
- How is this different from the 2019 hack?
Binance was also hacked in May 2019, losing 7,000 Bitcoin (about $40 million). It halted deposits and withdrawals for a week and covered the lost Bitcoin with its own money.
This loss is more than 150 times that one. It is about 4% of the roughly $144 billion in assets Binance held before the hack. The promise to cover the loss is the same, but the amount riding on it is completely different.
- BITPRESS Insight
What protects customer balances in this hack is not the freeze on the hacker's wallet. The frozen $3 billion is simply still locked up, and customer balances depend on Binance's promise to cover losses with its own money.
The weight of that promise comes from the gap between the loss and the protection fund. This time the fund is only one-sixth of the loss, so company funds must cover the rest. That is why what customers face right now is not a loss but the time their withdrawals are stopped.
When an exchange promises "full compensation," what to weigh is not the promise itself but how far the loss exceeds the protection fund and whether the company can bear the difference.
Sources
https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets
https://decrypt.co/382191/binance-suspected-hack-5-billion-tether-circle-freeze-crypto
https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171
https://decrypt.co/382203/binance-finds-additional-points-of-breach-in-6-3b-hack
https://thenextweb.com/news/binance-hack-6-3bn-north-korea-tradertraitor
https://www.news1.kr/finance/blockchain-fintech/6337977
https://www.fnnews.com/news/202610301319493582
https://www.spark.money/research/stablecoin-blacklisting-sanctions-mechanics
https://techcrunch.com/2019/05/15/binance-resumes-trading-following-40m-bitcoin-hack
https://fred.stlouisfed.org/series/DEXKOUS
Glossary
Hot wallet — An exchange wallet connected to the internet that processes customer withdrawals right away; it is convenient but more exposed to hacking.
SAFU — A user protection fund that Binance sets aside separately to prepare for incidents such as hacks.
Stablecoin — A coin like USDT or USDC, where the issuer holds dollar assets and mints coins so that 1 coin stays pegged to 1 dollar.
Freeze — The issuer blocks a specific address from sending or receiving its stablecoin; this is not the same as getting the money back.
Proof of Reserves — Data an exchange publishes to show that it actually holds as many coins as customers have deposited.
BITPRESS articles are information to help your investment decisions, not a recommendation to buy or sell any stock or coin. Investment decisions and their results are your own responsibility.
