Crypto from zero to expert after the largest theft in its history
In roughly twenty minutes, starting at 20:05 UTC on October 29, an attacker emptied Binance wallets on ten blockchains and walked away with about $6.36 billion, according to TRM Labs' reconstruction. Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon were among the networks hit, and the total is four times the previous record, the $1.5 billion Bybit lost in February 2025. The FBI attributed the operation to TraderTraitor, a group tied to North Korea, whose government brushed the accusation aside as baseless gossip.
It was not an isolated event. On September 24 Bitget had spotted unauthorized transfers worth around $387.5 million, and in the early hours of November 2 it was Mercado Bitcoin's turn, Brazil's largest exchange, with more than $46 million gone. Three blows in under six weeks reopened questions the market thought had been settled after FTX collapsed: what actually backs a balance held on a platform, who pays when security fails, and what separates a company that absorbs a loss from one that passes it on to customers. Answering them means starting at the very beginning and moving up one level at a time.
At its most basic, a cryptocurrency is a record. Each unit exists as an entry in a public ledger, the blockchain, which is kept not by a single company but by thousands of computers spread around the world. No one can erase a line from that ledger or slip in transactions without the network validating them. What makes someone the owner of a balance is not a contract or an account in their name, but control of a private key, a string of characters that works as the signature authorizing every transfer. The public address is like a mailbox number anyone can see; the private key is the only thing that opens it.
The first experiment to work was Bitcoin. Its founding paper circulated on October 31, 2008, under the pseudonym Satoshi Nakamoto, and the network's first block was produced on January 3, 2009. The system caps supply at 21 million units and halves new issuance every 210,000 blocks, which happens roughly every four years; the latest of these cuts, known as halvings, took place in April 2024. Security rests on mining, a process in which specialized machines race to solve calculations for the right to add the next block. That built-in scarcity is why so many investors treat it as a store of value, even though its price behaves nothing like the steady temperament of a precious metal.
Ethereum, launched in 2015, pushed the idea further. Beyond moving value, its network runs programs called smart contracts, which execute on their own once certain conditions are met. That foundation gave rise to thousands of tokens, decentralized finance applications, digital art marketplaces and lending protocols that operate without intermediaries. In September 2022 the network left mining behind and switched to proof of stake, a mechanism in which transactions are validated by those who lock up coins as collateral. Beyond the two giants lies a universe of alternatives, from projects with serious engineering behind them to so-called memecoins, whose value hinges almost entirely on social media enthusiasm.
For anyone who wants to operate in this world without riding the price swings, there are stablecoins, tokens designed to always be worth one dollar. The two most widely used are USDT, issued by Tether, and Circle's USDC. Their stability depends on the issuer holding equivalent reserves in cash, US Treasury bills and similar assets, and on letting holders redeem each unit for its dollar. In the United States, the GENIUS Act signed in July 2025 turned that one-to-one backing into a legal requirement for the issuers it covers. There is a technical detail that often goes unnoticed and proved decisive in the Binance case: because a company stands behind each of these coins, their contracts allow addresses to be blocked. Bitcoin and ether have no such switch.
The second step concerns where coins are kept. A wallet does not hold coins but the keys that move them. Hot wallets are connected to the internet, like a phone app or a browser extension, and are convenient for daily use. Cold wallets stay offline, like thumb-drive-style hardware devices or a key written on paper, and trade speed for protection. Creating your own wallet generates a seed phrase of 12 or 24 words that can restore it on any device, and whoever obtains that phrase obtains the funds. Hence the motto the community has repeated for years: not your keys, not your coins.
A centralized exchange such as Binance, Bitget, Coinbase or Mercado Bitcoin plays a different role. It acts as currency desk and stock market at once: it takes in traditional money, matches buy and sell orders and safeguards customer assets. But once a user deposits bitcoin there, they no longer control the keys, and what they hold is a balance in the company's database, a claim on those assets. Platforms pool the funds of millions of people in shared wallets and spread the risk across layers: most of it in cold storage, an intermediate share in warm wallets and a smaller slice in hot wallets, which are the ones that let withdrawals be paid instantly. Every exchange lives with the same dilemma, because the more money it keeps online, the faster the service and the bigger the target.
With that foundation, the risks become easier to grasp, starting with the most visible. A cryptocurrency can travel in hours the distance a traditional stock covers in months. As news of the Binance attack spread, bitcoin broke below $80,000 and touched $76,300. A year earlier, on October 10, 2025, the market went through the largest liquidation wave in its history, with close to $19 billion in leveraged positions forcibly closed in a single day. Leverage, which lets traders operate with borrowed money, turns a moderate dip into a total loss for anyone without the margin to ride it out.
The second risk is counterparty risk, and it is worth separating from hacking. A theft is an outside attack that takes assets away; insolvency appears when the company itself does not have what it claims to hold. History offers examples of both. Mt. Gox, which at one point handled most of the world's bitcoin trading, went bankrupt in 2014 after losing hundreds of thousands of its users' coins. FTX imploded in November 2022 when it emerged that client money had ended up funding positions at Alameda Research, a firm linked to its founder, Sam Bankman-Fried. None of the three recent cases fits the second pattern so far: each involved an outside attacker and companies that said they had the resources to cover the shortfall.
The third risk is the one that dominated the past month. Major thefts no longer exploit crude coding errors but people and suppliers. Binance's preliminary investigation pointed to the compromised laptop of one of its engineers, which allegedly gave the intruder a way into the systems where withdrawals are authorized; TRM Labs described a compromise of the hot wallet signing infrastructure and found that the attacker's operator wallet received funds through Tornado Cash from the morning of October 28, a day before the strike. At Bitget, the entry point combined a vulnerability in a third-party security product with stolen internal credentials, which made it possible to alter transaction data so that fraudulent withdrawals cleared authorization checks. At Mercado Bitcoin, the attackers reportedly accessed the private keys of hot wallets and moved funds with plain transfers to newly created addresses.
North Korea has become the most feared actor in the sector. Its units, known by names such as Lazarus or TraderTraitor, blend fake job offers, infected files and months of patience to get inside the computer of someone with sensitive permissions. The same group was blamed for the Bybit theft in 2025. Investigator ZachXBT also found that funds taken from Bitget and from Binance ended up mixed at a single address after passing through THORChain, a protocol for swapping assets across different chains. Before the Bitget attack, according to TRM Labs data cited by the Financial Times, $1.73 billion had already been stolen in 333 incidents during 2026. Add only the three recent cases and the year comfortably exceeds $8 billion.
Some threats are less spectacular and far more common. The days after a hack are a favorite for scammers, who set up fake refund pages and send messages asking for passwords, two-factor codes or seed phrases, information no serious platform ever requests. There are also projects that vanish with investors' money, smart contracts with exploitable flaws and regulatory risk, which can push a platform out of a country overnight.
The fourth level is the one that causes the most confusion: backing and guarantees. A bank deposit in the United States is insured by the FDIC up to $250,000, and most countries have similar schemes for their banking systems. A crypto balance held on an exchange enjoys no equivalent state protection. When a platform promises to cover losses, the guarantee is its own balance sheet: cash, corporate treasury and special funds set up for emergencies. The promise is worth exactly as much as the solvency of whoever makes it.
The best known example is SAFU, the Secure Asset Fund for Users, which Binance created in 2018 by setting aside part of its trading fees. Its policy says that if the fund's value drops below $800 million because of bitcoin price swings, the company will top it back up to $1 billion, though it sets no deadline for replenishing it after an incident. Following the attack, Binance moved 7,499 bitcoin out of the fund, about half of the 15,000 it held and roughly $583 million at the time. The rest of the hole was covered with the futures insurance fund and company treasury. Bitget runs a similar mechanism, its protection fund, and after the September theft it pledged to bring it back to a $300 million baseline.
The other tool is proof of reserves, which became standard after FTX. The platform publishes the addresses where it keeps its assets along with a cryptographic structure, the Merkle tree, which lets each user confirm that their balance is included in total liabilities without exposing anyone else's data. After the theft, Binance released a snapshot showing at least one-to-one backing across ten major cryptocurrencies. The mechanism has limits any advanced investor should know: it captures a single moment rather than ongoing monitoring; it shows that assets exist but does not always rule out debts outside that perimeter; and in most cases it is no substitute for a full audit of the financial statements.
Regulation is moving at very different speeds. In the European Union, the MiCA regulation has applied to crypto-asset service providers since December 30, 2024, and requires, among other things, keeping client assets separate from company assets; in June 2026 Bitget applied to Austria's financial regulator for a license to operate under that regime. In Brazil, the Central Bank published its framework for virtual asset service providers in November 2025, in force since February 2026. In the United States, by contrast, the flagship market structure bill, the CLARITY Act, stalled on September 15, when the Senate voted 49 to 50 on a motion that needed 60 votes, with ethics rules covering President Donald Trump's crypto businesses as the main sticking point. The SEC and the CFTC keep moving under the powers they already hold.
With that map in hand, it becomes possible to assess how companies responded. Binance froze deposits and withdrawals as soon as it detected the attack, as its co-founder Yi He reported on X, and within hours announced it had set aside more than $6.34 billion of its own funds to cover the entire shortfall. Co-CEO Richard Teng summed up the stance in a single line: the company, not its users, will absorb the financial impact. At the same time, its over-the-counter desk began buying back the missing assets to rebuild reserves. On Sunday, November 1, at 6:00 UTC, it reopened withdrawals in phases, starting with 15 coins including bitcoin, ether and solana.
The reopening served as a stress test. By mid-morning that Sunday the platform had processed about $4.56 billion in withdrawals and $1.01 billion in deposits, and net outflows for the day reached $3.64 billion. The company said requests rose at first and then leveled off, and that backing for the affected assets had already been restored to around 95%. The market read it two ways: an exodus of that size reveals distrust, but the fact that the exchange could meet it without cutting service is precisely what an insolvent platform cannot do.
A key piece of the response came not from Binance but from stablecoin issuers. Tether blocked more than 1.567 billion USDT and Circle more than $800 million in USDC linked to the attack, partly within the first hour. World Liberty Financial, the crypto company associated with the Trump family, froze funds in its USD1 coin together with custodian BitGo, and the FBI released Ethereum, Bitcoin and Solana addresses tied to the theft. More than $1 billion, mostly in ether, stayed beyond reach. The paradox is plain to any advocate of decentralization: what rescued a huge share of the loot was precisely that those coins have an issuer with the power to block them.
Bitget had walked the same path a month earlier. Its systems flagged the transfers at 18:31 UTC on September 24, the emergency team was activated within minutes and CEO Gracy Chen guaranteed that the protection fund would cover the loss. The first official figure was $351.6 million, later revised to $387.5 million, the largest exchange theft of 2026 up to that point. Bitcoin withdrawals returned on September 28 at 08:00 UTC, and in the first hour 9,585 requests for about 4,098 BTC were handled; ether, USDT, the remaining tokens and fiat services were brought back between September 29 and October 2. The company also offered a 5% reward to anyone who helped freeze the attacker's funds.
The closest episode for Latin America is Mercado Bitcoin. According to monitoring firm Hypernative, the first abnormal movements appeared around 23:15 on Sunday, Brasília time, and accelerated between 3:19 and 3:53 on Monday, November 2. The exchange suspended deposits and withdrawals, confirmed a cyberattack on one of its systems and maintained that customers suffered no harm and no data leaked. It published the destination addresses on EVM chains, Bitcoin, Solana, Stellar and Tron to aid tracing, and Tether CEO Paolo Ardoino confirmed that 4.5 million USDT had been frozen. The attacker's addresses held 3,680 ETH, 106 BTC and about $8 million in stablecoins spread across 46 wallets. So far there is no public evidence connecting this case to the Binance one.
For the technical reader, the central lesson lies in the signing layer. Large exchanges no longer rely on a single key: they use multisignature schemes, which require several approvals to move funds, or multi-party computation (MPC), which splits a key into shards that never come together in one place, and they protect those shards in dedicated hardware modules. The recent attacks did not break the cryptography; they went after everything surrounding the signer. At Bybit in 2025, signers approved a transaction whose interface had been tampered with; at Bitget, transaction data was manipulated to look legitimate. This is the blind signing problem, in which a person or a system authorizes something it cannot fully verify. The defenses gaining ground are independent simulation of every transaction before approval, policy engines that cap amounts and destinations, allowlists and mandatory delays for large movements.
The other half of the technical game begins after the theft. Attackers try to convert freezable assets into ones that are not as quickly as possible, hop between chains through bridges and swap protocols, and scatter the loot across dozens of addresses. Every minute matters: the speed at which Tether and Circle reacted explains much of what was recovered. For the market, the most telling indicator is not the amount stolen but the net flow that follows. A massive exodus the platform pays out without delay ends up reinforcing trust; one that forces it to limit withdrawals is the classic sign of a run.
For everyday users, the practical takeaways are simpler and just as valuable. It makes sense not to leave more on an exchange than you need for trading and to move what you plan to hold long term into your own wallet, provided you know how to safeguard the seed phrase. Turning on two-factor authentication with a hardware key or an app instead of SMS, setting up withdrawal address allowlists, checking that the platform is licensed in a demanding jurisdiction and publishes proof of reserves regularly, and distrusting any refund message in the days after an incident are habits that remove much of the risk.
The online gambling industry is not far removed from all this either. Many operators accept deposits in cryptocurrencies or stablecoins, and a good share of those flows passes through a centralized exchange at some point, whether to convert into local currency or to manage treasury. A withdrawal freeze like those at Binance or Mercado Bitcoin can lock up funds for days, and an address block can catch legitimate transactions that brushed against suspicious money. Diversifying counterparties, checking the source of funds and reconciling balances daily stop being good practice and become an operational necessity.
These weeks leave a mixed picture. Never had so much been stolen in a single attack, and never had a platform refilled a shortfall of that scale so quickly. What protected customers was not blockchain technology but something far more traditional: equity, reserves and cooperation between companies and authorities. Grasping that difference may well be the step that separates someone who buys crypto from someone who knows what they are buying.
Tags: cryptocurrencies, Binance, exchanges, cybersecurity