The suspected drain of Binance hot wallets on Thursday has become the largest crypto theft on record, and it has put a familiar set of questions back in front of the market. How safe are exchange reserves, what happens once the coins leave the building, and how much of a haul can still be clawed back once the trail goes cold? Binance now estimates the total impact at about $6.3 billion. Roughly $3 billion has been frozen on-chain with blockchain partners, according to co-CEO Richard Teng. The exchange says customer balances are safe and that it will cover all losses from its Secure Asset Fund for Users and company funds. Withdrawals were temporarily suspended while the withdrawal service was rebuilt. A laptop, not a leaked private key Teng’s first formal account points to a compromised DevOps engineer’s laptop. That access, he said, let an attacker reach a service container and submit unauthorised withdrawal transactions. The attack was more complex than a single engineer’s permissions or a one-click action, and Binance says it has found no evidence so far of a wallet private key leak. A detailed technical post-mortem is promised once every fact is verified, along with an updated proof of reserves after remediation. That framing matters. It suggests the failure sat in the operational layer that signs withdrawals, not in the cold storage that most exchanges advertise as their main defence. Hot wallets exist to pay customer withdrawals, and they are by design online. CoinDesk’s review of Binance’s 1 October proof of reserves found that Binance 14, one of the wallets emptied in the attack, was among the addresses used to back customer assets. For ether in particular, Binance had been holding about a 100% reserve ratio, so the roughly 204,500 ETH taken would leave ETH backing near 94% until the gap is filled. Stablecoin issuers moved fast. Tether, Circle, Ripple and World Liberty Financial have frozen large sums linked to the receiving addresses, with earlier tallies putting Tether and Circle alone near $1.8 billion to $2.4 billion. Bitcoin and ether have no equivalent off switch. Those coins have to be chased through the places attackers eventually try to spend them. What hackers do with the money? The first hours after a large exchange heist follow a fairly consistent script. Move first, explain later. On-chain researchers say funds often start moving before a public alert. In 2025, Global Ledger found that in about 76% of hacks the coins were already in motion before the market knew. First hops can happen in seconds. Break the trail. Attackers split large balances into smaller pieces, swap tokens on decentralised exchanges, and hop across chains using bridges. Global Ledger reported that more than $2 billion of stolen crypto was routed through bridges in 2025 — nearly half of total losses and about three times the amount sent through mixers. Tornado Cash and other mixers still feature heavily as a privacy layer, especially on Ethereum. Park, then cash out. Some funds sit unspent. Others enter DeFi as collateral — CoinDesk noted that in this case the exploiter borrowed wrapped ether on Aave using stolen USDT. The endgame is usually fiat: peer-to-peer platforms, over-the-counter brokers and informal “laundromat” networks that settle off-chain. After the February 2025 Bybit hack of about $1.5 billion, Bybit’s chief executive said nearly 28% of the stolen crypto had “gone dark” via mixers, then bridges, then P2P and OTC desks. TRM Labs has also tied North Korean operators to professionalised OTC intermediaries that absorb stolen assets at scale. Stablecoins are the easiest piece to interrupt, because issuers can blacklist addresses. Recovering bitcoin and ether is slower. Ari Redbord of TRM Labs told CNBC that a freeze stops movement, but returning funds needs a court order or seizure warrant and coordination with issuers and exchanges. Eric Jardine of Chainalysis said a technical freeze can be quick, while returning money can take months or years. Why the market is still uneasy? For Binance customers, the immediate risk is not a vanished balance. The exchange has pledged to make users whole, and Fundstrat’s Sean Farrell has said the episode does not currently look like a solvency crisis, provided frozen stablecoins return and withdrawals resume in an orderly way. SAFU holds roughly $1 billion in bitcoin, which would only partly cover any unfrozen gap; the rest would come from Binance’s own reserves. The broader worry is structural. If the world’s largest exchange can lose multibillion-dollar reserve wallets through a compromised laptop and a withdrawal service, every other venue’s operational security is suddenly back under the microscope. Two analytics firms have linked the attack to North Korea’s TraderTraitor unit; Binance has not confirmed that attribution. Bitcoin fell more than 4% on the first alerts, and BNB sold off sharply. The next tests are practical: when withdrawals reopen, whether outflows stay calm, and whether the 1 November proof of reserves shows the missing assets replaced. Until then, the Binance case is a reminder that in crypto theft the hard part is not always getting the coins — it is turning them into money that cannot be frozen, and that race starts the moment the first transaction hits the chain. The post Binance’s $6.3B hack raises fresh crypto security fears appeared first on Invezz
