The largest theft in crypto’s history took about 20 minutes. Starting just after 8 p.m. UTC on October 29, attackers drained roughly $6.36 billion from Binance across ten blockchains, according to TRM Labs, which put the haul at about four times the $1.5 billion Bybit theft of February 2025. Two days later the FBI blamed North Korea’s TraderTraitor group, AFP reported.
The more revealing number is what happened next. Within about an hour, the companies that issue dollar-pegged stablecoins started freezing the stolen tokens, and by Binance’s count roughly $3 billion is now verified as frozen. The part that got away was almost entirely bitcoin and ether, which no one can switch off.
I think that split is the real story of this hack. Crypto now runs on two kinds of money: dollar tokens whose issuers can stop a transfer within minutes, and native coins that nobody can stop at all. When the system was under attack, the first kind behaved like a bank and the second kind behaved like cash. That is a useful thing to learn, and it will be hard for the industry to un-learn it.
How the money moved, and how it stopped
Binance’s preliminary investigation points to a compromised engineer’s laptop, and the exchange says it has found no evidence its private keys were taken. TRM’s analysis leans toward a compromise of Binance’s hot-wallet signing systems; in one early sweep on Ethereum, 167,464 ETH and 1.615 billion USDT left the exchange.
The response from token issuers was fast. Per TRM’s timeline, Tether froze 971 million USDT at 9:01 p.m. UTC and about 1.77 billion in total, Circle froze about 825 million USDC three minutes later “in coordination with law enforcement,” and Ripple and World Liberty Financial froze smaller amounts of their own tokens. Even the Arbitrum network’s security council stepped in, locking about $30 million in ETH and ARB.
Tether chief executive Paolo Ardoino announced the first freeze on X while the theft was still unfolding:
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Protecting the industry and our partners is our main priority.
Stay safe everyone.
— Paolo Ardoino 🤖 (@paoloardoino) October 29, 2026
The attackers clearly expected this. TRM says they dumped about 325 million USDT for ether at more than 10 percent below market price, and parked 60 million USDT on the lending platform Aave to borrow roughly 19,760 ETH. Paying a steep discount to get out of a freezable asset tells you which asset they considered risky. About $2.4 billion, including 18,270 bitcoin and more than 420,000 ether, remains in their control.
Binance’s balance sheet is the other safety net
Binance says customers won’t lose money: it set aside more than $6.34 billion in company funds to cover the full loss and has already replaced about 90 percent, AFP reported. When withdrawals reopened in phases on Sunday, customers pulled $4.65 billion and deposited $1.01 billion between 6 a.m. and 3:30 p.m. GMT, a net outflow of about 2.1 percent of assets. That is a run that didn’t happen.
The rescue, however, was only possible at Binance’s scale. Its emergency SAFU fund holds about $1 billion in bitcoin, Tech Times reported, roughly one-sixth of the loss; the rest came from corporate reserves few exchanges have. One industry executive quoted in the same report argued that smaller hack victims don’t get the same treatment. A hack that empties a mid-size exchange would look very different.
The case that this proves crypto works
The strongest counterargument is that decentralization didn’t fail here, because Binance isn’t decentralized. The money sat in hot wallets controlled by one company, and the breach came through that company’s systems. Self-custody advocates have warned for a decade that coins held on an exchange are only as safe as the exchange, and nothing about bitcoin’s design was broken. CoinDesk framed it as a paradox: centralization made the theft possible and also saved about $3 billion, while fully decentralized protocols keep losing money to code bugs with no one to call.
There are also real costs to the freeze button. Bull Bitcoin founder Francis Pouliot warned that lending markets built on stablecoin collateral are fragile if issuers can freeze tokens a lender already accepted. Gizmodo also noted that Circle’s chief executive had said earlier this year the company would not freeze USDC without a court order or direction from law enforcement. And freezing is not recovery: a lawyer quoted by Tech Times pointed out that a freeze “does not in itself determine who is entitled to the assets.”
The attribution is also contested at the top. The FBI named North Korea, but President Trump told reporters “We don’t know if it’s North Korea,” according to AFP. Blockchain analytics firms TRM and Chainalysis both pointed to TraderTraitor.
What to watch
My take: last week settled an argument the industry has been having in theory. Stablecoins are already treated by their issuers as controllable money, and that control is now the main defense against state-backed hackers. I’d argue regulators writing crypto rules will treat that as a feature to require, not a bug to tolerate, and the market-structure bill known as the Clarity Act, which Gizmodo described as stalled, is the obvious place for that to show up.
What I’ll be watching is the $2.4 billion in bitcoin and ether that nobody could freeze, and whether it gets laundered through the bridges and swap services TRM expects. If most of it gets through, this hack will be remembered less for its size than as proof that the only crypto that can be protected is the crypto that can be stopped.
Related reading: The stablecoin yield fight between banks and crypto · A gang hacked the FBI over a four-month-old warning
