Binance Loses $6.3 Billion in Record Crypto Hack, $2.38 Billion Frozen
Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in what Reuters describes as a record theft. Binance reported a security incident on October 29, and stablecoin issuers Tether and Circle moved to freeze tokens worth $2.38 billion, according to Reuters.
A stablecoin is a crypto token designed to hold a steady value, usually one US dollar. The issuer, the company that creates and redeems the tokens, can block transfers of specific tokens on its own systems. That block is the freeze.
The freeze figure and the theft figure are different numbers doing different jobs. A freeze halts movement of the affected balances, but it does not by itself return anything to Binance, and it says nothing about how much of the $6.3 billion is still reachable.
In my view, anyone holding Tether or USDC-linked positions should read the freeze as a restriction on those tokens, not as a recovery of the loss.
Analysts have blamed North Korea for the breach. Attribution in crypto theft typically rests on on-chain tracing, which means following the public record of wallet transfers, along with laundering patterns and overlaps in the infrastructure used. Reuters reports the blame as the view of analysts, not as an official finding.
The attribution carries weight partly because of earlier 2026 figures. In an April report, TRM Labs identified Drift Protocol and KelpDAO as two 2026 crypto hacks it attributed to North Korea. The same report said North Korea stole $577 million across those two attacks and accounted for 76% of all crypto hack value that year.
If the attribution holds, the Binance theft alone would be many times the combined value TRM assigned to North Korea's two earlier attacks. That would sharply change any year-to-date picture of state-linked theft, and it is the main reason the attribution matters beyond this one incident.
For ordinary savers, the exposure runs through custody and withdrawals. A customer of a centralised exchange holds a claim on the exchange's assets, so how much of the stolen value can be frozen, traced or recovered decides whether that claim is impaired. The reported freeze suggests some tokens are contained, but the unfrozen balance and the recovery path have not been established. Anyone with exposure should expect the figures to shift as Binance and the issuers update their positions.
For institutional desks, this is a test of how stablecoin freeze mechanisms perform at scale. Issuer-side freezes can limit onward movement quickly, but they depend on the issuer identifying and blocking specific addresses before funds are dispersed. The $2.38 billion is the scale at which that tool was deployed in this episode. In my view, the gap between it and the $6.3 billion stolen is the number counterparty risk teams will focus on first.
Binance's own description of the incident is the starting point for any further account, and the coming days should clarify how much of the $6.3 billion is contained. Until then, the verified core is narrow: a $6.3 billion theft, a $2.38 billion freeze, and an attribution to North Korea that rests on analyst assessment rather than an official finding.
