Binance incident: what happened, where we are, and how ICONOMI responded

On the evening of 29 October, Binance reported a security incident that Chainalysis calls the largest theft in crypto history. Part of the assets we hold for ICONOMI clients was on Binance, one of the largest exchanges, where we hold assets so we can execute client trades quickly. We activated our crisis plan the next morning. ICONOMI stayed open throughout, and we began moving assets back from Binance as soon as it reopened withdrawals on 1 November.

What happened: Binance estimated the impact at about $6.3 billion and, with partners, froze about $3 billion of it.

Where things stand: Binance reopened withdrawals in phases from 1 November and says about 98% of the affected assets are replenished. Some of the assets we held there were affected, and Binance has restored them in full. Client balances were not changed.

What we did: We kept clients updated, ran additional AML checks on deposits and withdrawals, including screening incoming deposits for funds linked to the incident, and started reducing how much of your portfolio sits on any one exchange.

What happened

The attack

On the evening of 29 October, large outflows began from Binance's hot wallets, the wallets an exchange uses to process everyday withdrawals. TRM Labs reported that about $6.36 billion left wallets on ten blockchains, most of it in about 20 minutes. Binance estimated the impact at about $6.3 billion, and Chainalysis put it at about $6.4 billion.

Binance's first explanation was a compromised DevOps engineer's laptop, which gave an attacker access to a service container and let them submit unauthorised withdrawals. It later said its investigation had found more than one point of breach, and co-CEO Richard Teng said the attack was complex and not done with one click. Binance said it found no evidence of a wallet private key leak, and it has promised a technical report.

Chainalysis's analysis of the Ethereum transfers adds detail. The attacker appears to have submitted valid signed authorisations that let a Binance hot wallet run code the attacker had deployed, and then swept its contents out. Binance hasn't confirmed this account.

How the attackers got in

On 3 November Binance published an initial incident report. It says this was not a single breach or a simple phishing attempt, but a campaign over several months that compromised three engineers' computers and an internal AI tool.

• June, the first foothold. A wallet DevOps engineer searching for an AI coding tool downloaded a tampered installer for a developer tool. Binance's security team caught it, replaced his device and reset his credentials. By then the attackers had learned how he worked and who he worked with.
• September, a fake job. Attackers posing as recruiters approached a second engineer. After two interviews, one with a fake HR representative and one with the supposed CEO of a company that did not exist, he downloaded a coding assignment onto his work computer. It hid malware that endpoint security tools did not detect at the time.
• 20 October, moving inside. The attackers used that computer and an internal AI tool to take control of the first engineer's system and a third wallet engineer's. The report doesn't explain how the AI tool was used.
• 29 October, the theft. The first engineer's computer held a token that allowed container deployments. The attackers signed in to the third engineer's computer, deployed a container with credentials taken from the first engineer, and ran a malicious script. That gave them unauthorised access to an internal wallet signing service.

They used the signing service to move assets out of the hot wallets, and to abuse an Ethereum mechanism that gave a contract they controlled partial execution rights over a hot wallet.

Binance says pausing withdrawals alone could not stop this. The malicious authorisations existed on-chain and operated independently of its normal withdrawal systems, and the hot wallet's multi-party computation setup meant it had no single key to cancel them at once.

The last unauthorised transfer settled at 23:56 UTC on 29 October (00:56 CET), and the delegation was cleared shortly after midnight. SecurityWeek summarises the report.

Chainalysis's analysis of the Ethereum transfers describes the same last step from the outside. The attacker appears to have submitted valid signed authorisations that let a Binance hot wallet run code the attacker had deployed, and then swept its contents out. Binance's report names the technique: Ethereum's EIP-7702 mechanism.

The race to freeze

Stablecoin issuers moved within about an hour. Tether said it had frozen more than $1.567 billion of USDT, and Circle said it had frozen more than $800 million of USDC, later put at about $823 million. Ripple and World Liberty Financial also helped freeze funds, without disclosing amounts.

The attacker tried to stay ahead of the freezes. Chainalysis reports that it swapped $325 million of stablecoins for about $285 million of ETH over nearly 20 minutes, then moved a further $175 million through stopover wallets. The first freezes landed at about 22:14 CET.

Binance said about $3 billion was frozen, and Chainalysis counted about $2.8 billion. A freeze stops funds moving, but it doesn't by itself return them.

Who was behind it

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking unit, with high confidence. Chainalysis reached the same view after seeing stolen Binance funds mix on-chain with funds from last month's Bitget theft. The FBI attributed the Bybit theft of February 2025 to the same group, and on 31 October it published an alert saying North Korea was responsible for this theft too.

Chainalysis also reports laundering patterns that suggest automation: thousands of transactions, and many addresses that first receive exactly 1 TRX. Binance has said it is working closely with law enforcement to confirm the identity of those responsible and bring them to justice. North Korea has rejected the FBI's attribution.

How Binance responded

Binance paused withdrawals while it assessed the damage, and later said deposits were unaffected. On 30 October it said it would cover losses from company funds and had set aside over $6.34 billion, with $5 billion already held in the affected tokens. It said it was buying the rest on the market and over the counter.

Its second update set four priorities: restore withdrawals in phases, verify customer reserves, recover frozen assets, and publish a technical report. It targeted about 34 hours for the first reopening and a Proof of Reserves snapshot within 12 hours. By 31 October it said about 90% of affected assets were replenished, by 1 November about 95%, and by 4 November about 98%, with the rest in less liquid tokens it is still buying.

On 1 November Binance said balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed. On 2 November it said the full zero-knowledge proof for its 31 October reserves snapshot was complete, so holders of any of those tokens can check that their own balances are backed at least 1:1, using an open-source verifier. A further snapshot covering more tokens is planned for 4 November. CoinDesk's review of Binance's earlier reserve data found that the wallet emptied in the attack was one Binance had used to show its reserves.

The reopening and the market

Binance began reopening withdrawals at 07:00 CET on 1 November, and all 15 phase-one networks and assets were available by 13:36 CET. In the first nine and a half hours it processed about $4.6 billion in withdrawals against $1.0 billion in deposits, CoinDesk reports. Binance put the net outflow at about $3.64 billion, 2.1% of the $171 billion it held before the attack, and said volumes have since stabilised. CoinDesk's estimate, based on DefiLlama's tracking, was higher at about $6.1 billion over 24 hours, and can include transfers between Binance's own wallets.

On 2 November Binance added five more currencies for fiat withdrawals, bringing the total to 28, including the euro. On 2 November it said the proof for its 31 October reserves snapshot was complete, and that the next phase of withdrawals, adding more networks and assets, was planned for 3 November.

OKX recorded about $450 million of net inflows and Bybit about $134 million over the same period. Bitcoin fell more than 4% to about $78,000 on the night of the attack, and was still around that level on 2 November.

What is still unknown

• How much of the frozen funds will be recovered.
• When the last 2% of affected assets, in less liquid tokens, will be replenished.
• What the full proof for Binance's 4 November snapshot of 44 tokens shows, once it is published.

Timeline (CET)

Where things stand now

As at 16:00 on 6 November:

Binance: Withdrawals reopened in phases from 1 November, with further phases from 3 November and the latest scheduled for 6 November. Binance says about 98% of the affected assets are replenished, with the last 2% in less liquid tokens it is still buying. It also says that balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, which holders of those tokens can verify themselves with its Proof of Reserves tool. A snapshot covering 44 tokens was taken on 4 November, and its full proof was still being generated at the time of writing. These are Binance's statements, and we haven't independently verified them.

ICONOMI: We stayed open throughout, and client withdrawals stayed enabled. The additional AML checks on deposits and withdrawals that we ran during the incident ended on 1 November, and our standard checks continue.

Assets on Binance: As Binance reopened withdrawals on 1 November, we began moving assets back from it, and the first transfers completed successfully. We are continuing as quickly as Binance allows.

Reconciliation: Our reconciliation shows that some of the assets we held on Binance were affected by the incident. Binance has restored them in full, and the restored assets are visible in our balances.

Still open: Binance's post-incident report, the last 2% of its replenishment, the full proof for its 44-token snapshot, and recovery of the frozen funds.

What this means for you. Your balances and portfolios were not changed at any point, so there is nothing different to see in your account, and nothing is required of you.

How the ICONOMI team responded

We have a crisis communication plan with a scenario for an external exchange being hacked. We activated it at 09:16 CET on 30 October. Three things shaped what followed: we kept ICONOMI open, we told clients what we knew as we knew it, and we added monitoring and screening instead of closing anything.

The choices that mattered

We stayed open. Client withdrawals stayed enabled throughout. We prepared contingency measures in case Binance didn't reopen as it said it would, and we didn't need to use them.

We kept trading on Binance running. We monitored developments throughout.

We screened deposits. From the morning of 30 October we used blockchain analytics to flag any incoming funds linked to the incident, our AML team reviewed higher-risk deposits manually, and we ran additional checks on withdrawals.

We kept clients informed. We posted updates on all three days, including a scam warning on the first evening. We held back a full blog post while the facts were still changing. This article sets out what we know so far, and we will update it as things change.

The ICONOMI team

Investing in Crypto - Guide

Learn about the cryptocurrency market, discover Crypto Strategies, and master the art of building your crypto portfolio.

Download