Binance's signing desk lost $6.3 billion in twenty minutes

Binance says about $6.3 billion moved out of wallets it uses to process trades, most of it inside a twenty-minute window. The world’s largest crypto exchange says it will cover the loss. A cover is a balance-sheet promise. It is not the same thing as the coins still being there.

The drain started shortly after 20:00 UTC on Thursday, which was 1:00 a.m. Friday in Pakistan. Reuters, citing blockchain records, put the bulk of the movement inside about twenty minutes. If that figure holds, it is larger than the $1.5 billion taken from Bybit in 2025, the theft that had stood as the public record. Check Point’s chief information security officer, Jayant Dave, called the Binance number the largest crypto theft on record.

The part a treasurer should sit with is not the size. It is which system failed. Binance has said this was not a case of a wallet private key simply leaking. The public account is that the machinery which approves withdrawals was misused.

What the exchange has said

Co-CEO Richard Teng said the first evidence pointed to an engineer’s laptop. From there, he said, an attacker reached a service that submits withdrawals and sent transactions the exchange had not authorized. He said it was not a single action, and that the investigation had not found a leaked wallet private key. He also said the exchange had not attributed the theft to any person.

A later note from Binance on X walked that first picture back a step. The company said it had found more than one point of breach and was still gathering facts. It did not describe those points. Co-CEO Yi He said withdrawals were turned off until the environment was confirmed safe, and thanked token issuers that froze what they could.

Binance.US, the smaller platform for American residents, said it was not affected. Coinbase said the same about itself. The incident the company is describing is on Binance.com.

TRM Labs told reporters the attackers had compromised the signing infrastructure, the system that authorizes a transaction to leave. That is a different failure from a password on a hot wallet, and it is a different failure from a key that was photographed. The people and services allowed to tell the exchange “send this” were the target. This desk will not describe how that access was obtained.

Half of it can be frozen

Binance said about half of the affected assets had been frozen. Tether and Circle said their own freezes together came to about $2.4 billion. World Liberty Financial, the crypto firm tied to the Trump family, said it had worked with partners to freeze stolen funds. A freeze is a property of some tokens. The company that issues a stablecoin can mark an address and refuse to honor the coins sitting there. Bitcoin and ether have no issuer who can do that.

TRM Labs, as reported by Reuters, estimated that about $2.4 billion in bitcoin and ether was already past the point where a freeze helps. Those coins move until they touch a business that is willing and able to stop them, or until someone recovers the keys. The two $2.4 billion figures are not the same pile. One is what two stablecoin issuers say they stopped. The other is what an analytics firm says can no longer be stopped that way.

Yi He thanked the issuers in public. A thank-you is not a return. Frozen stablecoins may come back to the exchange, or they may sit in limbo while lawyers argue. Bitcoin that has already left does not come back because a blog post asked.

The promise to cover it

Binance describes a user-protection reserve, a fund it has put at about $1 billion in bitcoin, meant for a breach. Teng said the loss would be covered by that fund and by the company’s own resources. Yi He said the company would cover the hacking losses. Both statements can be true, and the arithmetic is the story. The reserve, as the company has described it, is much smaller than a $6.3 billion hole. The rest of the promise is the exchange itself.

That is the risk a customer actually holds. An exchange can be good for the money and still take days or weeks to reopen withdrawals. It can also be good for the money only if the rest of the balance sheet survives the week. Binance said in 2024 that it custodies more than $160 billion and has more than 300 million registered users. Scale is not a control. It is why a signing desk is worth attacking.

Bitcoin fell more than 4 percent after the first alerts, and ether and solana dropped with it. A price move is not a finding. It is what happens when a venue that large says the coins moved.

What to change before the next one

Treat the system that approves a withdrawal as the vault, not as an internal tool. A laptop that can reach it is a production credential. It should not be the same machine that reads mail, and it should not be able to finish a large send on its own. Split the authority. Require a second person, on a second device, for any transfer over a ceiling the treasury has written down. Alert on velocity: many withdrawals, new destinations, a burst that does not look like the last thirty days.

“No private key leaked” is not “no theft.” The key can stay in the vault while the service that is allowed to use it is told to open the door. Ask vendors, and ask your own exchange, where that instruction is allowed to come from, and what happens to withdrawals when that answer changes.

Know the cap. A protection fund published at $1 billion does not make a larger balance safe. If the coins you cannot afford to wait on are bigger than that promise, they should not sit in one venue. Stablecoins can be frozen by their issuers. Bitcoin and ether cannot. Size the hot side of the treasury as if the signing desk will be misused once, and as if only the freezable half comes back.

Analytics firms including TRM Labs and Chainalysis have said the theft resembles operations they attribute to North Korean hackers, including the Bybit case and a September theft at Bitget that Check Point put at about $388 million. Chainalysis said it had high confidence in that link. Binance told the BBC it is working with law enforcement and did not confirm who did it. North Korea has denied earlier campaigns of this kind. A resemblance is not a conviction, and it does not change the control. The next exchange in the queue does not get to wait for a name.

This briefing is drawn from Reuters reporting published October 30, 2026, from Binance’s public statements, and from the BBC’s account of those statements. It does not include a method.