Binance confirms $6.3bn theft, Pakistani traders report stuck USDT

Binance has confirmed a security breach it estimates at $6.3 billion, the largest theft in cryptocurrency history, Minute Mirror reported. Deposits and withdrawals were suspended for 48 hours after the incident on the night of Thursday 29 October, and Pakistani peer-to-peer traders said their USDT transactions were stuck.

Binance's preliminary investigation, released at 11pm US Eastern time on 29 October, said no wallet private keys had leaked. It said a compromised laptop belonging to a DevOps engineer may have allowed an attacker to reach a service container and submit unauthorised withdrawal transactions.

The attacker submitted 50 EIP-7702 authorisations in a single Ethereum transaction against Binance's main hot wallet, known as Binance 14, according to the finding. Control of the wallet was delegated to a malicious Sweeper Contract funded earlier through the crypto mixer Tornado Cash. About $6.36 billion was drained in roughly 20 minutes and moved across 10 blockchains. Analytics linked 55 wallet addresses to the exploit, which at one point held $5.7 billion, including nearly $1.5 billion in bitcoin and $900 million in ether, plus Solana and other tokens.

Blockchain intelligence firms attributed the attack with high confidence to TraderTraitor, a division of North Korea's state-sponsored Lazarus Group, Minute Mirror reported. The same group has been linked to the $1.5 billion Bybit hack in February 2025, which this theft exceeds more than four times.

Markets fell. By 7am UTC on 30 October bitcoin was down 4.5% at $76,664, a six-week low, before recovering to about $77,984. Ether fell 5.2% to $2,190 and BNB 7.1% to $698. More than $1.5 billion in leveraged positions were liquidated in 24 hours, wiping out over 240,000 traders. Lending protocol Aave paused new deposits and borrowing and its AAVE token fell 11.3%. Polymarket reported a separate $2.6 million drain the same night. Coinbase fell 4.8% and Strategy 6%.

In Pakistan, the suspension left merchants unable to move funds. Minute Mirror reported that Pakistan is among the top 10 countries for crypto adoption with more than 20 million users, and that Binance is the most used platform for P2P trading. Thousands of merchants reported stuck USDT transactions and some portfolios fell 5% to 7% overnight. Freelancers paid in USDT and USDC faced delays converting to rupees.

The State Bank of Pakistan and the FIA have been cautious about crypto. Sources told Minute Mirror the hack would give regulators grounds to tighten restrictions and delay a legal framework under discussion in the SBP's digital assets working group. FIA Cybercrime Wing Lahore warned of a rise in fake "Binance Refund" WhatsApp groups targeting Pakistani users.

About $3 billion has been frozen on-chain, including $2.3 billion in stablecoins, according to the report. Independent estimates put the stolen amount at about $5.9 billion, leaving roughly $3.3 billion still moving. Co-founder Yi He said: "All hacking losses will be covered. User funds are safe." Binance said losses would be met from its Secure Asset Fund for Users and corporate treasury, that withdrawals would resume within 48 hours, and that it would publish a technical post-mortem and an updated Proof of Reserves.