Binance $6.3B hack: what it means for traders

On the evening of October 29, about $6.36 billion left Binance wallets across ten blockchains, most of it in roughly 20 minutes. It is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025 (TRM Labs). Bitcoin slid to a six-week low, and more than $1.5 billion of leveraged positions were liquidated within a day.

What happened

According to TRM, the outflows started at 20:05 UTC, with a second wave hitting Binance wallets on Avalanche and Polygon around 23:05 UTC. Binance's official update says the preliminary finding is a compromised DevOps engineer's laptop, which gave the attacker access to a service container and let them submit unauthorized withdrawals. The exchange says it found no evidence of a private key leak. It puts the total impact at around $6.3 billion, says about $3 billion has been frozen on-chain, and promises to cover all losses from its SAFU fund and company money. Deposits and withdrawals are suspended.

The Ethereum leg is the telling part. The attacker used EIP-7702, which lets a regular wallet hand control to a smart contract by signing an authorization. They prepared 50 signed authorizations in advance, one for each of 50 consecutive nonces. A busy hot wallet burns through nonces constantly, so one of the 50 was almost certain to be valid when the transaction landed. One was. Three and a half minutes after the delegation, a single transaction moved 167,464 ETH and 1.615 billion USDT out. TRM attributes the attack to North Korea's TraderTraitor group with high confidence; Binance has not confirmed that.

Why the market fell harder than the theft "weighs"

The stolen amount is roughly 0.2% of bitcoin's market cap (BlockchainReporter). On its own, it doesn't move price. Positioning does. Bitcoin was already under $80,000 after the Fed held rates at 3.75–4.00% on October 28, with two officials voting for a hike. The hack was the trigger; leverage did the rest.

CoinGlass data showed $1.57 billion liquidated over 24 hours, 83.9% of it longs (The Crypto Times). Almost half, $754.6 million, happened on Binance itself (CoinCentral). The mechanics are familiar: a forced long close is a market sell, and each one pushes price toward the next cluster of stops. Bitcoin printed $76,443, just above its September 18 low.

The real risk for traders

The lesson isn't the price. When an exchange shuts the doors in both directions, your money is still there, but it's stuck. You can't top up margin on a hedge somewhere else, you can't move a position, and arbitrageurs can't pull prices back in line across venues. Trading inside keeps going — Binance logged liquidations all day. Venue risk becomes position risk, even if you called the direction right.

The other detail is how the attacker raced the freezes. TRM says they sold about 325 million USDT to market makers for roughly 122,300 ETH. That works out to about $2,650 per ETH while the market was at $2,300–2,350 — a haircut of more than 10%. Stablecoins can be frozen; ETH and BTC can't. The attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion. TRM expects those funds to move next through bridges, swap services and OTC brokers.

What to watch

Binance later said it had found more breach points beyond the laptop and expects to restart withdrawals in about 45 hours (The Crypto Times), which points to around November 1. The key questions: do withdrawals reopen on schedule, when does the promised updated Proof of Reserves land, and where does the $2.4 billion in unfrozen ETH and BTC go. One more thing: Binance asks users to rely only on its official channels for updates, so treat any "fund recovery" message from elsewhere as suspect.