By Emaan Nazar Shah
Shortly after 8pm UK time on Thursday 29 October, someone began emptying the wallets of the world’s largest cryptocurrency exchange. About twenty minutes later, roughly $6.3 billion had left Binance. That is more than four times the previous record, which was the $1.5 billion taken from Bybit in 2025. Blockchain analysts at Elliptic called it “almost certainly the single largest known theft of any kind.”
According to Binance’s initial investigation, it started with a single compromised laptop belonging to one of its engineers.
Within hours, Binance had frozen all deposits and withdrawals. Bitcoin fell to a six-week low below $77,000, ether dropped to a two-month low, and Binance’s own token, BNB, slid more than 5%. The exchange that holds more than $160 billion of other people’s money was suddenly asking its 335 million users to trust that it could cover a loss larger than many countries’ annual defence budgets.
How it happened
Blockchain intelligence firms TRM Labs, Chainalysis and Elliptic all point the same way. They attribute the attack “with high confidence” to TraderTraitor, the North Korean hacking unit linked to the Lazarus Group, which was also behind the Bybit theft. TRM’s Ari Redbord called it “a watershed” and said theft at this scale is “a global security issue, not just a crypto theft.” North Korea routinely denies such accusations.
The method matters more than the headline figure. Binance has been at pains to say this was not “a single one-click action.” Co-CEO Richard Teng says the attacker went further than one engineer’s permissions, and the exchange has since found additional points of breach. Still, the starting point was a person and not the code. Crypto was built on the promise that trust in institutions could be replaced by trust in cryptography. This attack went after the institution.
The numbers behind the story
Recovery has been faster than anyone might have expected. Within days, about $3 billion had been located and frozen, much of it by the companies that issue stablecoins. Tether froze nearly $1.57 billion, Circle more than $800 million and Ripple around $200 million. Binance has also set aside around $6.34 billion of company funds to cover losses, on top of a $1 billion bitcoin reserve that exists for exactly this situation.
That still leaves more than $3 billion unaccounted for. Binance hasn’t said where the money to cover it comes from. For context, total crypto thefts across all of 2025 came to $2.9 billion over nearly 150 separate attacks, according to TRM. One evening in October has exceeded an entire year’s worth of hacking.
The optimistic read vs. the worrying read
Optimistic: The system bent but didn’t break. Binance says it will make every customer whole. It has the balance sheet to try, and the freezes show that crypto is far less “untraceable” than its reputation suggests. When Tether and Circle can freeze stolen funds within hours, the industry starts to look less like the Wild West and more like a payments system with compliance teams. Compared with Mt. Gox in 2014, where around 24,000 customers simply lost access to their money, this is a very different outcome.
Worrying: The freezes that saved Binance also undercut crypto’s founding idea. If a handful of companies can freeze billions on request, crypto is not as decentralised as its supporters claim. Meanwhile the old warning, “not your keys, not your coins,” has never looked more relevant. As Macquarie University’s Sean Foley put it, assets on an exchange are “only as safe as the exchange itself.” The attack may push traders toward self-custody and decentralised platforms, which carry risks of their own. It will also almost certainly bring tighter regulation of centralised exchanges, which have long argued they could police themselves.
Binance will probably survive this. Few other exchanges could absorb a $6.3 billion hit and keep trading. But the heist shows how much the crypto industry has come to resemble the banks it set out to replace. Customers rely on a central institution to hold their assets, that institution depends on its staff’s security practices, and when things go wrong, a group of intermediaries steps in to freeze funds. The question now isn’t whether crypto can be hacked. It’s whether investors are comfortable that the safety net turned out to be a corporate balance sheet.
The views expressed in this article are the author’s own and may not reflect the opinions of The St Andrews Economist.
Image Credit: Reuters