Six billion dollars. Gone in about twenty minutes.
That is the short version of what happened to Binance, the world’s biggest crypto exchange, late on Thursday night. While most of us in Pakistan were asleep, attackers drained wallet after wallet on the exchange, Bitcoin, Ethereum, stablecoins, all of it, in the largest crypto theft ever recorded. Bigger than the Bybit hack last year. Bigger than anything the industry has seen.
By Friday morning, Binance had paused all withdrawals, admitted the scale of the loss, and promised that users would not pay for it. About $3 billion of the stolen money has already been frozen. The rest is still out there, moving through the blockchain where everyone can watch it and nobody can grab it.
I follow crypto because a lot of my readers earn, save, or get paid through it — freelancers receiving payments from foreign clients, students trading small amounts, people holding stablecoins because the rupee keeps sliding. So let me walk through what actually happened, what is confirmed, what is still guesswork, and what you should do if your money sits on Binance right now.
What happened, hour by hour
The attack started on Thursday, October 29, at about 20:05 UTC. In Pakistan time, that is 1:05 in the morning on Friday, October 30.
Investigators at TRM Labs, one of the firms that tracks stolen crypto, say the first movements came out of Binance wallets on the XRP Ledger. Minutes later, at around 20:20 UTC, the big hit landed on Binance’s main Ethereum hot wallet. Within roughly twenty minutes, the attackers had moved an enormous pile of crypto out of the exchange: around 167,000 ETH and about $1.6 billion in USDT from Ethereum alone, according to TRM’s tracking. Binance’s Bitcoin wallet was hit too, losing about 18,270 BTC. In total, money moved out across 10 different blockchains.
Here is the timeline, in Pakistan time:
| Time (PKT, Oct 30) | What happened |
|---|---|
| 1:05 AM | First suspicious outflows spotted from Binance wallets (XRP Ledger) |
| 1:20 AM | Main Ethereum hot wallet drained — the biggest single hit |
| ~3:35 AM | Binance publicly acknowledges a possible attack and pauses deposits and withdrawals |
| Morning | Binance confirms an estimated $6.3 billion impact; about $3 billion frozen |
| 1:47 PM | Binance says the breach was bigger than one laptop; withdrawals to resume in about 45 hours |
Binance’s own estimate of the total damage is around $6.3 billion. TRM Labs puts it slightly higher, at $6.36 billion. Chainalysis, another tracking firm, counts about $5.9 billion, and Arkham’s numbers land somewhere between $5.8 and $6 billion. The honest way to say it: nobody has a final audited number yet, and the real figure will take weeks to pin down. But every serious estimate puts this at the top of the list: the biggest exchange hack in history.
For comparison, the Bybit hack in February 2025, which held the record until now, took about $1.5 billion. This one is roughly four times that.
How did the attackers get in?
A quick piece of background first, because it shapes everything else. Exchanges keep crypto in two kinds of wallets. Cold wallets are offline, slow to reach, and hold the bulk of the money. Hot wallets stay connected to the internet so deposits and withdrawals can move quickly, and because they are connected, they are the part an attacker can actually reach. A hack like this one is a hot-wallet disaster: the connected money was drained at machine speed, while whatever sat in cold storage was never touched. It is also why the withdrawal pause matters. Before Binance lets money flow out again, it has to be sure the connected systems (the doors the attackers walked through) are rebuilt, not just patched.
This is the part where I have to be careful, because the story has already changed once.
Binance’s first explanation, posted in the early hours of Friday, pointed at a compromised laptop belonging to one of its DevOps engineers. The idea was that the attacker got from that laptop into an internal service container, and from there could submit withdrawal transactions that looked legitimate.
Later on Friday, Binance updated that story. The investigation, it said, had uncovered “additional points of breach,” and it called the incident “a complex attack.” In plain English: it was not one laptop, and it was not simple. Binance says it still has no evidence that any wallet private keys leaked, and it has promised a full technical post-mortem once the facts are verified. That report is not out yet.
TRM Labs’ own analysis adds one chilling detail. On Ethereum, the attackers seem to have used 50 pre-signed authorisations (a newer Ethereum feature called EIP-7702) prepared in advance so the sweep could happen fast. That is not the work of someone poking around randomly. That is planning.
I am not going to pretend I can judge the technical claims better than the firms doing the tracing. What I can say is this: when a company’s explanation changes within twelve hours, the right move is to wait for the full report before treating any single version as the whole truth. Binance has promised that report. Judge them on whether it actually comes out, and on what it says.
Is user money safe? What Binance is actually promising
Here is the sentence that matters most if you hold anything on Binance: the company says user funds are safe, and that it will cover all losses from its SAFU fund and the company’s own funds.
Two honest qualifications on that.
First, the SAFU fund (Binance’s emergency insurance pot, built up over years from trading fees) holds roughly $1 billion in Bitcoin. The loss is around $6.3 billion. So SAFU alone does not cover this. The rest has to come from the company’s own money, and Binance is one of the few exchanges in the world that plausibly has that kind of money. Co-CEO Yi He has said the exchange’s yearly revenue is already enough to cover the losses. That is a claim, not an audited statement, but it is the right claim for them to make, and so far they are making it loudly and publicly.
Second, a big part of the stolen money never really escaped. Stablecoin issuers can freeze tokens at the address level, and they moved fast:
| Who froze it | What was frozen |
|---|---|
| Tether | Over $1.5 billion in USDT |
| Circle | Over $800 million in USDC |
| Ripple | Around $200 million |
| World Liberty Financial | $27 million in USD1, plus WLFI tokens |
Add it all up and Binance says about $3 billion is frozen on-chain so far — roughly half the stolen amount. That money is not back in Binance’s hands yet, and frozen does not automatically mean recovered. But frozen money cannot be sold or laundered easily, which is why the freeze matters.
The uncomfortable flip side: firms tracking the wallets say roughly $2.4 billion is still controlled by the attackers, including more than 420,000 ETH and the 18,270 BTC. Bitcoin cannot be frozen the way stablecoins can. What happens to that pile over the coming weeks is one of the biggest open questions in crypto right now.
Who did it? What is proven, and what is not
You will see headlines today stating flatly that North Korea did this. Slow down before you repeat that.
TRM Labs attributes the attack to TraderTraitor, a North Korean hacking unit, and says it has high confidence based on on-chain and off-chain intelligence. Chainalysis has pointed the same way, and the independent investigator ZachXBT noted that stolen Binance funds were mixed with addresses from a separate $388 million exploit at Bitget — the kind of overlap that suggests the same crew.
That is serious evidence from serious firms. But it is still an assessment, not a court verdict. Binance itself has not confirmed the attribution. No government has confirmed it either. North Korea, asked by Reuters, did not respond.
So the accurate sentence is: investigators strongly suspect North Korea’s TraderTraitor group. Anything stronger than that is running ahead of the facts. I would rather tell you that plainly than dress up a suspicion as a certainty, especially on a story this big, where being wrong loudly is easy and being careful is not.
The market felt it within hours
Crypto prices dropped across the board as the news spread, and BNB (Binance’s own token) took the hardest hit, which tells you the market read this as a Binance problem, not just a crypto problem.
As I write this on Friday afternoon, BNB is trading at around $705, down about 5% in 24 hours. During the worst of the panic it touched $680. Bitcoin fell to about $76,400 at its lowest point, a six-week low, and Ethereum slid to around $2,178, its weakest in two months. Around $1.5 billion worth of leveraged trades were liquidated across the market as prices dropped: people betting on prices going up, wiped out in hours. If that word is new to you: liquidation is what happens when you trade with borrowed money and the price moves against you. The exchange closes your position automatically to protect its loan, and your deposit is gone. On a normal day that is a personal risk. On a day like Friday, thousands of those forced closures happen at once, each one pushing prices a little lower, which triggers the next batch. That spiral is a big part of why a single exchange’s bad night turned into a red screen for the whole market by morning.
Standard Chartered’s analysts have warned there could be more downside until the frozen-asset picture clears up. Maybe. Prices in a panic move on fear first and facts later, and I am not going to pretend I know where BNB or Bitcoin goes next week. Nobody does. If someone tells you they do, they are selling something.
The shock spread beyond Binance itself. In India, the exchange CoinDCX switched its futures market into reduce-only mode (meaning traders could close positions but not open new ones) because it uses Binance as a key source of liquidity. Binance also quietly delayed a token listing (a project called PREDICT) that was supposed to start trading on Friday. Small things, but they show how much of the crypto world leans on this one exchange.
It has been that kind of week for markets — I wrote about the AI stock sell-off this morning too.
Using Binance from Pakistan or India? Read this part carefully
The practical situation right now is simple:
- Deposits are working normally. Binance restored them after the first checks.
- Withdrawals are paused for everyone. This is a global pause, not something aimed at Pakistan or India. Binance says it is rebuilding parts of its withdrawal system and expects to resume withdrawals in about 45 hours from its Friday update, which lands on Sunday morning, Pakistan time.
- That time is a target, not a promise. Security work has a habit of taking longer than the first estimate. If withdrawals slip past Sunday, that alone is not a reason to panic. If they slip by days with no clear update, that is a different conversation.
If you earn online and receive client payments through Binance, and I know many freelancers in Pakistan do exactly this, because the alternatives are limited, a two-day withdrawal pause is annoying but survivable. What would worry me more is silence. So far, to Binance’s credit, the updates have been frequent and specific. Keep an eye on whether that continues.
Now the part I really want you to hear: the scammers are already circling. After every big exchange incident, fake “Binance support” accounts, phishing emails, and messages asking you to “verify your account” or “secure your funds” by clicking a link flood in. Some will look very convincing. Binance will never ask for your password, your seed words, or a transfer to a “safe wallet” through a message. Only use the official app and the official site, typed in yourself. If a message creates urgency (act now or lose everything), that urgency is the scam.
One more local note: Pakistan’s crypto regulator has not put out any public statement on this incident that I have seen. Binance operates here under a no-objection certificate rather than a full local licence, so do not assume there is a Pakistani regulator standing behind your account. Your protection, for now, is Binance’s own cover pledge. That is worth knowing, calmly and clearly.
Two rumours going around that are not true
Big stories attract nonsense, so let me clear two things I have already seen repeated:
Bybit was not hacked again. The rumour spread on social media on Friday, and Bybit publicly denied it. One disaster at a time: this one belongs to Binance alone.
Binance.US was not affected. The American exchange is a separate company that shares a name and little else. The breach hit Binance.com, the global exchange most of us actually use.
And a third, softer one: no, Binance is not “about to collapse” based on anything known today. An exchange that can freeze $3 billion in hours and publicly commit to covering a $6.3 billion hole is in trouble of a specific kind (a security and trust problem), which is different from being broke. If the facts change, I will say so.
If my money was on Binance, here is what I would do
People keep asking versions of the same question today: should I get everything off Binance the moment withdrawals open?
My honest answer is: I would not rush, and I would not relax either. Here is my thinking.
I would not deposit new money into Binance this weekend. There is no upside to adding funds while the withdrawal system is mid-repair, and waiting costs nothing.
When withdrawals reopen, I would move a portion (not everything in a panic, a portion) to a wallet I control myself, especially any money I cannot afford to have frozen for a week if something like this happens again. This is the oldest lesson in crypto, and every few years the market teaches it again at great expense: money on an exchange is money you have lent to that exchange. For trading and cashing out, exchanges like Binance are the practical route for most of us in Pakistan, and I am not going to pretend otherwise. But long-term savings sitting on any single platform, however big, is a risk you are choosing.
I would also turn this weekend into a security check of my own: password changed, two-factor authentication on, withdrawal address whitelist on if the option is there, and a fresh look at which apps and sites have access to my accounts. The attackers in this story got in through layers of small doors, most likely. Small doors are exactly what ordinary users can shut.
What I would not do is make a fear decision — dumping coins at the bottom of a panic dip, or moving everything to some unknown exchange an influencer is promoting today. Bad weeks produce bad decisions. The facts we have say: your balance is intact, the exchange is paying for its mistake, half the stolen money is frozen, and withdrawals are expected back within days. Act on that, not on the loudest post in your feed.
This story is not finished. The post-mortem, the final loss figure, the fate of the unfrozen billions, and the withdrawal restart are all still to come, and I will update this piece as the confirmed facts land. For now: keep your money where you can see it, your passwords where nobody else can, and your head cooler than the timeline.
Sources: Binance’s official statements on X (October 30, 2026), TRM Labs’ incident report, Reuters market coverage, and live coverage from CoinTelegraph and CoinDesk, as linked throughout this article. Prices noted as of Friday afternoon, Pakistan time.