NederlandsLargest crypto hack ever: 6.3 billion dollars gone at Binance through an employee's laptop
The crypto exchange Binance confirms a hack: according to a first investigation, an attacker got in through an employee's laptop. The damage is estimated at 6.3 billion dollars, the largest crypto theft ever. About 3 billion has been frozen, and Binance will cover all losses.
Binance confirms that the crypto exchange has been hit by a security incident. On the evening of Thursday 29 October, billions of dollars in digital coins were moved from the exchange's online wallets to addresses that had never been used before. This could be seen on the blockchain, the public ledger in which every crypto transaction is recorded, visible to everyone.
According to a first investigation by Binance, the attack started with the laptop of a DevOps employee: someone who manages the exchange's technical systems. Through that hacked laptop, the attacker gained access to a so-called service container, a shielded part of Binance's systems. From there, the attacker gave orders to withdraw money without permission. Binance says it has no evidence that secret wallet keys were leaked. A full technical analysis will follow once the investigation is complete, the exchange writes on X.
How much money is involved?
Binance estimates the total damage at about 6.3 billion dollars (about 5.7 billion euros).
That makes this the largest crypto theft so far. The previous record was held by the hack at the exchange Bybit in February 2025, in which almost 1.5 billion dollars was stolen.
Binance says it will pay for all losses from the SAFU fund and from the company's own money. SAFU stands for Secure Asset Fund for Users: an emergency fund that Binance set up in 2018 to compensate customers after a hack. The fund holds about 1 billion dollars (about 900 million euros) in bitcoin, far less than the damage. A large part of the compensation will therefore have to come from Binance's own money. According to the exchange, customers' money is safe. After the recovery, Binance will publish a new Proof of Reserves: an overview that shows the exchange holds enough to cover all customer balances.
What is Binance doing now?
As a precaution, Binance temporarily paused deposits and withdrawals until the security checks are complete. The exchange withdrew the permissions of the address that was used to give the orders. Binance is also working with law enforcement and with companies that analyse blockchain data, to follow the money, get it back and track down the people behind the attack.
Founder Changpeng Zhao, who no longer runs the company but is its largest shareholder, had already written on X that it looked like a hack and that he expected customers to be fully reimbursed.
3 billion dollars frozen: almost half
Working with blockchain companies, about 3 billion dollars (about 2.7 billion euros) has been frozen so far, Binance reports. That is almost half of the estimated damage. The attacker can no longer move frozen coins.
Most of that comes from Tether and Circle. These companies issue so-called stablecoins: digital coins whose value is tied to an ordinary currency. Tether's USDT and Circle's USDC stablecoins are linked to the US dollar: one coin is worth one dollar. There are also stablecoins linked to the euro or another currency. Such issuers can freeze coins at a particular address. Tether chief executive Paolo Ardoino reported that his company froze more than 1.5 billion dollars (about 1.3 billion euros) in USDT. Circle chief executive Jeremy Allaire said that Circle froze more than 800 million dollars (about 720 million euros) in USDC, working together with law enforcement. Together that is more than 2.3 billion dollars (about 2.1 billion euros) of the roughly 3 billion, CoinDesk reports. It is not known who froze the rest.
Not everything can be frozen. Coins such as bitcoin and ether have no issuer that can block them. According to the analysis company Arkham, the attacker's wallets at one point held more than 5.7 billion dollars (about 5.1 billion euros), including about 1.5 billion dollars in bitcoin and 900 million dollars in ether. The attacker is exchanging coins through Uniswap, a trading platform without a central operator.
The lending platform Aave also became involved. Shortly before the first coins were frozen, the attacker deposited 60 million dollars (about 54 million euros) of stolen USDT there as collateral. Against that, he borrowed almost 19,800 ether, worth about 44.6 million dollars (about 40 million euros) at the time. Nobody can freeze that ether.
A story went round on X that Aave is now left with frozen collateral and an unpaid loan. That is not correct. The USDT sits in Aave's contract, not in a wallet of the attacker, and the collateral is worth more than the loan. According to Aave, the people who have deposited money on the platform therefore run no risk. If the attacker never pays back, his debt slowly grows through interest, and at some point the collateral is sold to repay the loan. In effect, the attacker swapped 60 million dollars of USDT for ether that is worth about 15 million dollars less.
As a precaution, Aave then froze almost three hundred lending markets on sixteen networks. In them nobody can deposit or borrow new money; repaying and withdrawing is still possible. This stops the attacker from using the platform again. Aave is reopening the markets step by step once the stolen money is no longer being moved.
What can users do?
Binance warns that scammers use incidents like this to trap people. Users should therefore trust only the exchange's official channels, avoid clicking on links in messages that tell them to "secure" their money, and never share login details or wallet recovery codes. Customers with questions can contact Binance's customer service. People who own a lot of crypto can keep most of it in their own wallet that is not connected to the internet.
What does this mean for the road to the singularity?
More and more money and value exist only in digital form. This incident shows that the weak spot is not always in the technology of the blockchain: according to Binance, it started here with one laptop of one employee. It also shows what already works well. Because every transfer can be followed in public, investigators could trace the money straight away, and within a day almost half of it had been frozen. How Binance closes this gap will be an important lesson for the security of all exchanges.
What is the technological singularity? Read the explanation →
