Binance Lost $6.3 Billion in a Hack. The Scam Coming Next Targets Anyone With Withdrawals Frozen

On the night of Thursday, 29 October, wallets belonging to Binance, the world's largest crypto exchange, were drained across ten different blockchains. Binance itself put the total impact at roughly $6.3 billion — close to R$34 billion — and warned the figure could rise. TRM Labs, the blockchain tracing firm, counts $6.36 billion. That is around four times the $1.5 billion Bybit theft of February 2025, which until yesterday held the record.

According to TRM, the outflows began around 5 p.m. Brasília time, with the largest moving in under half an hour: bitcoin, ether, XRP, solana and the stablecoins USDT and USDC. Further waves followed through the night.

What is known so far

• How it started. In its first statement, Binance said the initial investigation points to the compromised laptop of a DevOps engineer, which is believed to have given the attacker access to an internal service from which unauthorised withdrawals were issued. The company later said it had found additional points of intrusion, and co-CEO Richard Teng stated that the attacker "did not simply use an engineer's permissions." Binance says it has found no evidence that wallet private keys were exposed and has promised a technical report once the investigation concludes.
• How much was frozen. Roughly $3 billion in total, according to Binance, counting issuers and other partners. Most of it in stablecoins, locked by the issuers themselves: by TRM's count, Tether froze around $1.77 billion in USDT and Circle around $825 million in USDC. In bitcoin and ether, which have no issuer able to freeze them, the attacker still controls close to $2.4 billion.
• Who did it. TRM and Chainalysis attribute the attack to TraderTraitor, the North Korea–linked group the FBI named as the perpetrator of the Bybit theft. TRM says it holds "high confidence." This is private-sector attribution, not an official finding.
• And the customer. Binance states that user funds are safe and that it will cover all losses using SAFU, the emergency fund it has maintained since 2018, together with its own resources. In a post on X on Friday, per The Block, it said it had set aside more than $6.34 billion for that purpose, roughly $5 billion already held in the same assets that were stolen; the remainder is being purchased on the market, which, it warned, may take time. Deposits are working again; withdrawals remain suspended pending a security review of the withdrawal service. The company spoke of resuming in about two days. BBrasil, Binance's Brazilian entity, told Brazilian customers, according to TechTudo, that funds "remain safe," that it follows the segregation requirements set by the Banco Central, and that it keeps virtual assets in cold wallets disconnected from the internet. It gave no timeline for withdrawals.

The scam coming next

Frozen withdrawals, headlines about billions stolen, and a promise that "all losses will be covered." This is exactly the scenario a scammer waits for. Anyone with money sitting on Binance is anxious to know whether they will get it back, and anyone who lost money in an earlier scam is looking for any route to recovery. Both will be getting messages in the days ahead.

The script is the same one we described in the recovery scam, with Binance's name on the front:

• a "Binance support agent" who turns up on WhatsApp, Telegram, or by phone, saying your account has been affected;
• a link to "request your SAFU reimbursement" or "verify your account to release your withdrawal";
• a "release fee," a "tax," or a "security deposit" to unlock the money;
• a "compensation token" to be claimed through a wallet connected to a website;
• a "recovery firm" that claims to trace the attack and return what you lost.

None of this appears in the official statements. In Binance's announcements and in executives' posts through the afternoon of 30 October, we found no request for customers to fill in a form, connect a wallet, send documents, or pay anything in order to be covered. The company advises following official channels only. BBrasil, according to TechTudo, asked customers to avoid links received via messaging apps or social media promising to release withdrawals or recover funds, and warned about contacts requesting passwords, authentication codes, or personal data.

To check whether a site, email, phone number, or profile genuinely belongs to Binance, the company maintains Binance Verify. The page itself notes that Binance "will never request funds or tokens through private communications."

If you buy or sell crypto OTC

The funds that were not frozen will look for an exit. Based on previous large-scale thefts, TRM expects them to move over the coming days through cross-chain bridges, swap services, and OTC desks, and it recommends that exchanges and desks screen the addresses of depositors. Part of the stolen amount, TRM says, has already been sold at a steep discount.

For anyone trading crypto via Pix with individuals or desks, that has two practical consequences:

• A price that looks too good this week is a red flag. Bitcoin or ether below market, from a seller you don't know, may be stolen coin looking for a buyer.
• Coin originating from the attack can get your account frozen. Exchanges are flagging the attacker's addresses. If you receive crypto that passed through them and deposit it at an exchange, the deposit may be blocked, and you are the one who will have to explain its origin. Keep the Pix receipt, the wallet address, and the transaction hash for every purchase, as we explained in I paid by Pix and it became crypto.

What the stablecoin issuers did within a few hours also shows both the reach and the limits of freezing, which we analysed in the Tether case: freezing stops the coin from moving, but it only applies to assets that have an issuer, and on its own it returns nothing.

In one line

Binance says it will cover the loss from the attack without asking customers for anything. Any message asking for a link, a wallet, a document, or a fee to "release" or "reimburse" your money on Binance is a scam.

Received a message like this? Report it. Reporting won't recover your money, but it helps map who is running the scam and warns those who come next.

Sources

• Binance — Security Incident Update (published 30/10/2026, updated the same day)
• Binance — Binance Verify
• TRM Labs — North Korea steals USD 6.36 billion from Binance in the largest hack in history (30/10/2026)
• Help Net Security — Binance hit by $6.3 billion theft in what could be the biggest crypto heist on record (30/10/2026), with posts from Richard Teng, Paolo Ardoino (Tether), Jeremy Allaire (Circle) and Jonathan Levin (Chainalysis)
• The Block — Binance says it has $6.34 billion ready to cover hack losses (30/10/2026)
• TechTudo — Binance sofre ataque hacker com roubo de US$ 6,3 bilhões; veja o que se sabe (30/10/2026), BBrasil statement
• InvestNews — Binance, maior exchange cripto do mundo, é alvo de ataque hacker de US$ 6,3 bilhões (30/10/2026)
• CyberX — The recovery scam, I paid by Pix and it became crypto and Tether can freeze USDT