The Feature Crypto Was Built to Kill Just Stopped Nearly Half of a $6.3 Billion Heist
On October 29 attackers took about $6.3 billion from Binance across ten blockchains in roughly twenty minutes, four times the Bybit record.
Summary: At 4:05 p.m. Eastern on Thursday, someone took over the system Binance uses to approve its own withdrawals and started emptying the world's largest crypto exchange.
About twenty minutes later, roughly $6.3 billion had left across ten blockchains. Analysts at TRM Labs and Chainalysis say the thief was TraderTraitor, the North Korean unit behind last year's $1.5 billion Bybit theft.
Then a race started.
More than half the haul was in stablecoins, digital dollars whose issuers can freeze them whenever they choose, and within hours Tether, Circle and three others had locked up about $2.7 billion.
The attackers spent those same hours dumping dollars for ether (because ether has no off switch) at a discount of more than 10 percent.
Thesis: The feature crypto purists like least, a company that can freeze your money, is the reason close to half of the largest theft in history is sitting in the right vaults and wallets.
The attackers proved how much it mattered by paying a steep price to get out of the freezable dollars. Binance is covering what escaped out of its own pocket, so the recovery from the biggest crypto heist ever ran almost entirely through a handful of companies with off switches.
Twenty minutes on a Thursday afternoon
The preparation started at least a day and a half earlier. On the morning of October 28, according to TRM Labs, small withdrawals from Tornado Cash, a service that mixes coins together to hide where they came from, began funding a wallet the attackers would use to run the operation.
The theft began at 20:05 UTC on October 29. On Ethereum, the attacker submitted a single transaction carrying 50 pre-signed authorizations, every one of them signed by Binance's own hot wallet (the online wallet an exchange keeps topped up to pay out customer withdrawals).
Each authorization handed control of that wallet to a contract that took orders only from the attacker.
There were fifty because the attacker couldn't know exactly which transaction number the wallet would be on when the batch landed, so they brought a signature for every likely slot.
A little over three minutes later, the wallet sent everything it held to the attacker: 167,464 ether, 63 other tokens and 1.6 billion USDT.
The heists on the other nine chains were less clever. Binance's wallets simply signed ordinary transfers out. TRM's read is that the attacker had control of Binance's signing machinery itself, the system that approves withdrawals, rather than a single stolen key.
Binance's first explanation was a compromised laptop belonging to a DevOps engineer, which gave the attacker a foothold inside a service container.
By Friday the company had found "additional points of breach," and co-CEO Richard Teng said "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action."
Binance itself hasn't named a culprit. "Our investigation has not attributed responsibility to any individual," Teng wrote.
The count, at prices when each coin was taken, is about $6.36 billion by TRM's math, $6.43 billion by Elliptic's and $5.9 billion by Chainalysis's.
Any of them is roughly four times Bybit, the old record. Al Jazeera, citing TRM's annual crime report, puts total crypto hacking losses for all of 2025 at $2.87 billion across nearly 150 attacks.
One Thursday afternoon at Binance more than doubled a full year.
The blockchains did what they always do. They recorded every transfer, in public, to the second. That was the easy part.
More than half the loot came with an off switch
The attacker's haul was split across assets:
On Ethereum it included 200,630 ether, 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD, Ripple's dollar token. On Tron, another 612.7 million USDT.
Add those up and roughly $3.4 billion of the $6.3 billion was stablecoins.
A stablecoin is a token a company issues and promises to redeem for a dollar. Because a company issues it, the company also writes a blacklist into the token's code. Put an address on the list and every coin in it stops moving, wherever it sits.
Tether froze about 1.77 billion USDT.
Circle froze about 825 million USDC, working with law enforcement.
Ripple froze 40.5 million RLUSD, and World Liberty Financial froze 27.8 million of its USD1.
Even some of the ether got caught.
On Arbitrum, a network that runs on top of Ethereum, a Security Council with emergency powers froze 8,426 ETH and 74.6 million ARB tokens, about $30 million worth. By 23:35 UTC, three and a half hours after the theft began, Binance said verified freezes had reached $2.54 billion.
By late Friday it was saying about $3 billion had been traced and frozen.
Stopping a stolen wire in the banking system usually means a relay of phone calls, legal requests and compliance reviews across correspondent banks in several countries, and it can take days.
Here, five organizations pressed a button and something like 40 percent of the largest theft on record went still before dinnertime on the East Coast.
The issuers could move that fast for one reason. Their coins were built to be stoppable.
The getaway ran through a currency exchange
The attackers knew the freezes were coming. Their whole strategy in the first hours was to turn money that can be frozen into money that can't, as fast as possible, at almost any price.
Chainalysis found the stolen USDT sat for 37 minutes on Ethereum and 46 minutes on Tron before it started moving.
TRM tracked one batch of 500 million USDT. About 325 million of it was sold to market makers through UniswapX, a system where professional trading firms fill large orders, for roughly 122,300 ether.
The attackers accepted a discount of more than 10 percent to market price to get it done. The other 175 million got frozen before it could move. Another 60 million USDT went into Aave, a lending protocol, as collateral to borrow about 19,760 ether.
(They had no interest in the loan. They wanted the ether, and they were happy to leave freezable dollars behind as the deposit.)
Of the 88.5 million RLUSD, 48 million was sold on decentralized exchanges before Ripple's freeze landed.
That 10 percent haircut is the most useful number of the week. It's the market price of escaping an issuer freeze, set by people with every reason to know exactly how the system works.
A state-run theft operation looked at a dollar with an off switch and an ether without one, and decided the ether was worth paying a tenth more for.
What's left is out of anyone's reach. TRM counts more than 420,000 ether and 18,270 bitcoin, about $2.4 billion, still in attacker wallets. Elliptic puts it at $3.33 billion across 43 wallets.
There's no issuer to call for either one. The bitcoin was already being split into chunks of 1,000 and 100 coins through a peel chain, a long string of wallets that each pass most of their balance to the next, and TRM expects cross-chain bridges, swap services and over-the-counter brokers to come next.
The open part of crypto worked exactly as designed. It just worked for the thief.
Binance is paying for what got away
So who eats the $2.4 to $3.3 billion that's gone? Binance says it will, and that none of it falls on users.
By Saturday it said it had replaced about 90 percent of the affected assets, up from 80 percent at its previous update, using money from its corporate treasury, part of its Secure Asset Fund for Users (SAFU, an emergency fund it set up in 2018) and part of its futures insurance fund.
Co-CEO Yi He said the company has allocated $6.34 billion of corporate funds, and that Binance will keep buying smaller tokens on the market and over the counter "until the replenishment ratio for all tokens reaches 100%."
SAFU holds about $1 billion, all of it in bitcoin, according to Al Jazeera. The theft was more than six times that.
Most of the make-whole is coming straight off Binance's balance sheet, which is to say out of the profits of running the world's biggest exchange. Insurance won't help much here either; most crime and cyber policies don't cover stolen crypto.
Binance published a proof-of-reserves snapshot at 8 p.m. Eastern on Friday, a public check that what it holds matches what customers are owed, and says a fuller zero-knowledge version, which takes 40 to 50 hours to generate, is due Tuesday.
Deposits never stopped. Withdrawals were still paused on Saturday, and CNBC reported that Binance plans to reopen them Sunday.
Few companies on earth could write a $6 billion check on two days' notice and keep the lights on. Binance customers are whole because their exchange happened to be rich enough.
Two hours earlier, the same story at a smaller size
At about 2 p.m. Eastern on the same Thursday, two hours before Binance's wallets started emptying, Polymarket switched its international site to cancel-only mode.
Someone had swapped a script from DebugBear, a UK company whose performance-monitoring code ran on Polymarket.com, for malicious code.
Anyone with the site open during that window had their logged-in session used to sell their positions and send the proceeds out of their wallets. Estimates from Betting Intelligence and Polysights put the damage at about 710 wallets and $2.7 million.
Polymarket's smart contracts, the onchain code that actually holds the bets, were untouched.
The attack came in through the website, the part users look at, by way of a vendor most of those users had never heard of. Trading resumed at 3 p.m. Polymarket says it's returning $3.9 million, "the $2.7M plus $1.2M to cover pause-related losses," and that 95 percent of affected wallets had been refunded by Friday afternoon.
Washington drew two different lessons
CFTC Chairman Michael Selig went on CNBC Friday and said the hack "proves our exact point in proposing regulations for crypto markets earlier this month."
His pitch was registration: "We want to offer these exchanges a federal option to come and register with the CFTC," with federal supervision of cybersecurity, custody and customer protection.
The weight sits on the word "option." Without new authority from Congress, the CFTC can't make an offshore exchange like Binance sign up.
Senator Cynthia Lummis of Wyoming reached for something else. "Every minute lost is money gone for good," she said, arguing that the CLARITY Act would have helped by shielding companies that pause suspicious transactions when law enforcement asks.
That bill fell short of the 60 votes it needed in a Senate procedural vote on September 15.
Lummis's version maps more closely onto what actually happened this week. The money that got saved was saved by speed, and the speed came from companies that could freeze coins on their own authority in the first few hours, long before any court got involved.
Her bill would give more companies legal cover to act that fast. Selig's plan would put exchanges under a supervisor, which matters for the laptop and the service container, and does less for the minutes.
The honest case against this read
The first objection is that I'm praising a power that cuts both ways. A blacklist that can stop North Korea can stop anyone.
A freeze is a private company's decision, usually made at a government's request, with no judge in the room when the button gets pressed. Anyone building on these coins is accepting that the issuer can do to them what it did to TraderTraitor this week.
The second is that the freeze lost. Somewhere between $2.4 billion and $3.3 billion is gone by current counts, and the attackers moved hundreds of millions of freezable dollars before the issuers caught up.
A 10 percent toll is a cost of doing business for a state that steals at this scale.
The third is that this is a story about one company's security, and it says little about crypto.
Binance runs a centralized exchange, and it got breached the way a bank or a payments processor might. Coinbase said it wasn't affected. The rest of the onchain economy kept settling transactions all week.
What keeps me on this side of the argument is the 10 percent. The attackers had the strongest possible incentive to understand where the real controls sit, and they answered with a discount. They treated the freezable dollars as radioactive and the unfreezable ether as safe. If you're deciding what kind of digital dollar to build a product on, that's the clearest price signal you'll get this year.
What this means for you
If you're choosing a stablecoin for a payments product, treat the freeze function as a feature you're buying. This week it was worth about $2.7 billion. Ask your issuer how fast it moves when you call, who it takes calls from, and what it does when the request comes from someone you'd rather it ignored.
If you're at a bank or fintech deciding whether to hold customer funds in crypto, the Binance lesson is about the hot wallet and every system that can touch it.
The blockchains were fine. A laptop and a service container weren't. Price the operator's controls before you price the protocol's.
If you hold crypto on an exchange, your balance is a promise from a company, backed by whatever that company has on hand. Binance had $6.34 billion to spare. Find out whether yours would.
If you work in policy, the minutes mattered most. Rules that let issuers and platforms freeze quickly, with clear legal cover and clear limits on when they can, would have saved more of this money than a registration regime will.
Watch four things. Binance's zero-knowledge proof of reserves, due Tuesday. Whether withdrawals actually reopen on schedule.
The root cause, which Binance still hasn't published. And where the 18,270 bitcoin goes next, because every bridge and OTC desk it passes through is about to get a phone call.
The blockchains recorded the largest theft in history to the second. The companies with off switches are the reason almost half of it is still standing still.
Daniel McGlynn
Sources
[1] TRM Labs. "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History," October 29, 2026, figures as of October 30, 00:30 UTC. Timeline, 50 pre-signed authorizations, ten chains, asset breakdown, freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum Security Council, UniswapX sale at more than 10% discount, Aave borrowing, RLUSD sales, remaining attacker holdings, peel chain, Bybit comparison. https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
[2] The Hacker News. "Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen," October 30, 2026. Chainalysis and Elliptic estimates, Elliptic's $3.33 billion in unfreezable assets across 43 wallets, DevOps laptop explanation, Teng quote on "one-click," Chainalysis 37- and 46-minute hold times, Binance's 23:35 UTC frozen figure. https://thehackernews.com/2026/10/binance-suffers-security-breach.html
[3] Al Jazeera. "Binance says $6.3bn stolen in biggest crypto heist in history: What we know," October 30, 2026. Teng attribution quote, "additional points of breach," SAFU size and composition, insurance coverage, TRM 2025 hacking total. https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know
[4] TheStreet via Yahoo Finance. Mehab Qureshi, "Binance says 90% of hack impact now covered," October 31, 2026. 90% coverage, funding sources, Yi He's $6.34 billion allocation and quote, proof-of-reserves snapshot and zero-knowledge proof timing, deposits and withdrawals status. https://finance.yahoo.com/markets/crypto/articles/binance-says-90-hack-impact-191513226.html
[5] CNBC. "Binance says 90% of $6.3 billion hack losses are now covered, plans to resume withdrawals Sunday," October 31, 2026. https://www.cnbc.com/2026/10/31/binance-hack-asset-coverage-withdrawals.html
[6] Hackread. "Polymarket Users Lose $2.7 Million in Third-Party Script Hack," October 31, 2026. DebugBear script, 710 wallets, cancel-only window, $3.9 million refund and Polymarket quote, 95% refunded, June incident. https://hackread.com/polymarket-users-lose-2-7m-third-party-script-hack/
[7] The National. "US CFTC boss says Binance hack 'proves his point' about need for crypto market regulations," October 30, 2026. Selig quotes from CNBC's Squawk on the Street. https://www.thenationalnews.com/future/technology/2026/10/30/trump-binance-hack-cftc-selig-crypto/
[8] Bitcoin.com News. "CFTC and US Lawmaker Offer Two Different Answers to Binance's $6.3B Hack." Selig registration quote and its voluntary scope, Lummis quote and CLARITY Act safe harbor, September 15 Senate vote. https://news.bitcoin.com/regulation-and-legal/cftc-and-us-lawmaker-offer-two-different-answers-to-binances-6-3b-hack