Binance Sees $6B Outflows After Largest Crypto Hack

Attack Drained Billions Within Minutes

The October 29 breach targeted the systems and permissions used to operate cryptocurrency wallets rather than breaking Ethereum’s underlying cryptography. Analysts’ examination of the exploit found that attackers drained about $2.5 billion from one Binance wallet in less than four minutes after malicious code was authorized through Ethereum’s EIP-7702 feature, which allows ordinary wallets to run software known as smart contracts.

Binance co-CEO Richard Teng said investigators subsequently uncovered multiple security breaches, including evidence that the attackers used a mechanism designed to erase traces of their activity. Binance began rebuilding its withdrawal infrastructure and reviewing signing procedures, employee devices and key management.

The FBI attributed the theft to North Korea’s TraderTraitor hacking group and asked cryptocurrency services to block transactions involving wallets linked to the stolen assets.

Binance Restarts Withdrawals as Billions Leave

Binance began restoring withdrawals at 06:00 UTC on November 1. All 15 networks and assets in the initial reopening phase were available by 12:36 UTC, including Bitcoin, Ether, Solana, XRP and major stablecoins.

Withdrawal demand surged after access returned before easing, while deposits remained substantial. DefiLlama’s publicly visible wallet data also require caution: movements between Binance-controlled wallets can appear in the figures, meaning the total cannot be treated entirely as customer withdrawals.

The inflows to OKX and Bybit show that money was entering rival venues during the reopening, although the aggregate data do not establish how much came directly from Binance customers. Binance said on November 1 that it had replenished approximately 95% of assets affected by the hack. The remaining portion largely involved less-liquid tokens that require more time to acquire.

Elliptic Finds No Evidence AI Directed Laundering

Investigators are also tracking how the stolen assets are being moved. Elliptic said North Korean hackers used about 20 automated software services in less than three days, routing funds through decentralized exchanges, lending protocols and cross-chain bridges.

Elliptic co-founder and chief scientist Tom Robinson said the activity did not show evidence of autonomous AI agents choosing how to move the money.

“Our assessment is that the laundering is automated, but nothing we have seen shows an AI agent making decisions. The pattern fits scripts written and supervised by people.”

Elliptic said repeated transfers and failed transactions looked like software carrying out preset instructions. The hackers reused transaction amounts and tested new routes using smaller transfers before moving larger sums. Six cross-chain bridges were first used within a 100-minute period on October 30, although Elliptic said the evidence does not establish whether humans or AI systems selected the services.

Separate blockchain tracking showed an address linked to the Binance hacker swapping stolen Solana for Bitcoin through RelayProtocol on Sunday. The address, labeled AffzF and identified by the U.S. Secret Service and blockchain analytics firms, held 970,000 SOL after the exploit. Roughly half was moved to another unidentified address that then began converting the assets into bitcoin.

“Active SOL-to-BTC conversion is the laundering phase of the $6.3B Binance breach — immediate sell pressure on SOL and a future BTC overhang once converted coins reach exchanges,” AI agent handle Hupzy said.

The SOL price fell 1.6% over 24 hours while the BTC price was largely unchanged, according to COIN360 data.

Why Crypto Theft Can Be Harder to Contain

The Binance breach has also reopened a broader dispute over whether cryptocurrency exchanges are inherently more vulnerable than traditional financial institutions or whether blockchain settlement simply makes successful attacks harder to contain.

A 2024 International Monetary Fund report found banks were the most frequent cyberattack targets within the financial sector. Financial firms accounted for nearly 20% of reported cyber incidents across industries and almost $12 billion in reported direct losses between 2004 and 2023. Those figures cover reported cyber losses and cannot establish whether banks or cryptocurrency exchanges are hacked more frequently.

Tomer Sharoni, CEO of Israeli blockchain intelligence firm Addressable, said the main difference is what attackers can do after gaining access.

“A bank employee’s laptop can be compromised exactly the same way as an exchange employee’s laptop,” Sharoni said. “The phishing email, the malicious download and the fake job interview are all the same. The difference is what the attacker gets at the end.”

Banks can have several opportunities to stop fraudulent payments through compliance checks and reviews by institutions processing transfers. Some payments can also be recalled. Confirmed blockchain transactions generally cannot be reversed, although issuers can freeze certain stolen tokens.

“Speed, finality and irreversibility make large crypto treasuries the most valuable targets in finance,” Sharoni said. 

He argued that crypto firms are attacked more often because a successful breach can deliver larger rewards.

Abdul Rafay Gadit, co-founder of ZIG Finance, disputed that assessment.

“Crypto doesn’t get hacked more than banks. It just can’t hide it, and it can’t undo it,” Gadit said. “Banks get breached constantly, but most incidents are handled quietly and surface later, if at all. A crypto hack shows up on a block explorer within minutes, so it feels more frequent.”

Gadit said bank breaches may involve customer records or passwords without deposits being stolen, while blockchain activity makes crypto thefts easier for the public to follow. Neither expert provided comparative data establishing which industry experiences more attacks.

Gadit said exchanges need safeguards developed in banking, including separate signing authorities, approval procedures and withdrawal limits.

“So, no, crypto isn’t more vulnerable; it’s just less forgiving,” he said.

Broader loss figures show the scale of the security problem facing digital-asset platforms. CertiK recorded $1.28 billion in crypto losses during the third quarter of 2026, nearly 56% more than the previous quarter. Bybit also suffered a $1.5 billion theft in February 2025 involving systems used to control digital assets.

Daniel Tunkel, head of financial regulation at London law firm Edwin Coe, described crypto exchange security risks as “an accident waiting to happen.” He said regulators also need to consider whether exchanges have the financial resources and operational safeguards needed to withstand a major breach.

Sharoni said blockchain transparency can help investigators trace stolen assets, but tracing funds does not mean they can be stopped or recovered.

“Closing the gap between spotting a theft and stopping it ahead of time is now the industry’s central security challenge.”