By asahifile 
The largest crypto theft on record took about twenty minutes. Binance says roughly 6.3 billion dollars left wallets it uses to process customer transactions shortly after 20:00 GMT on Thursday; by Friday it said it had located about 3 billion. Four numbers published in the first day do not reconcile with each other, and the space between them is what customers are actually being asked to accept.
Analysts call it the biggest known theft of any kind; Elliptic said it is almost certainly the largest single theft ever recorded.
6.3 billion in twenty minutes is 5.25 million a second
The timeline is the first number worth holding on to: the bulk of the drain happened in roughly 20 minutes, according to blockchain records cited by Reuters, which works out to 315 million dollars a minute, or 5.25 million dollars a second. For scale, the Bybit heist of 2025 that the FBI attributed to Pyongyang took 1.5 billion; this is 4.2 times larger.
The entry point is the second thing that changed. Binance first described a compromised laptop belonging to an engineer. It then said the investigation had uncovered additional points of breach and a self-destruct mechanism that erased tooling as the attackers moved. TRM Labs describes the compromise as reaching Binance’s signing infrastructure — the systems that authorise transactions — which is a different failure from a single stolen laptop, and a more uncomfortable one for an exchange that markets its custody.
Half frozen, and a quarter of it already out of reach
About 3 billion of the 6.3 billion has been located or frozen, which is 47.6 percent. That leaves 3.3 billion unaccounted for. Most of what was recovered was stablecoin: Tether froze close to 1.57 billion, Circle more than 800 million, and World Liberty Financial 27 million in stablecoins plus about 2 million of its own tokens — together roughly 2.4 billion.
TRM’s estimate is the one to watch. It says about 2.4 billion dollars of bitcoin and ether is already beyond reach, and that some of the proceeds were posted as collateral to borrow more ether. If that holds, then 73 percent of the 3.3 billion that is not frozen is gone, not merely missing. Three different numbers — 6.3 billion taken, 3.3 billion not frozen, 2.4 billion unrecoverable — describe the same hole.
The attribution gap
Three analysis firms moved faster than the exchange. TRM attributed the attack to North Korea’s elite hacking unit. Chainalysis said it had high confidence in a North Korean link. Elliptic said it believed Pyongyang was behind it. Binance, in the same period, said its investigation had not attributed responsibility to any individual.
That divergence is not a detail. Attribution is cheap and recovery is not: funds can only be returned if a counterparty — an issuer, an exchange, a custodian — freezes them, and counterparties act on evidence they can defend. A victim that declines to name a state while three firms do is signalling how much of its case it can prove.
Covering it: 6.34 billion, a 1 billion fund, and 2 percent
Reuters reports that Binance set aside about 6.34 billion dollars of company funds to cover the loss — 100.6 percent of the gross figure. Its published safety net is separate and much smaller: a secure asset fund holding about 1 billion dollars in bitcoin. Co-founder Yi He said the 3 billion located so far is roughly 2 percent of total user assets and public reserves, which implies something near 150 billion dollars of customer assets, consistent with the 160 billion the company reported under custody in 2024, and puts the gross loss at about 4.2 percent of user assets.
On an accounting basis that is survivable. The risk sits in timing and liquidity, and the promises moved while the story did: withdrawals were first expected back within 48 hours, then within about 34, and deposits were described as unaffected while withdrawals were halted. “Your money is safe and we’re covering every loss,” co-CEO Richard Teng wrote. Crypto traders have heard a version of that sentence from FTX in 2022, which is why the proof-of-reserves snapshot now promised for Monday matters more than the statement.
What to watch
- On-chain movement of the 2.4 billion in bitcoin and ether: mixing, bridges, or conversion into assets no issuer can freeze.
- Whether the stablecoin freezes convert into actual customer repayments, and on what timetable.
- The proof-of-reserves snapshot due Monday, and whether it covers liabilities rather than only assets.
- Whether the 34-hour withdrawal window holds; queues are where a solvency story becomes a bank-run story.
- Any regulatory response from the Secret Service and FBI, which are already involved, and from the exchanges that custody the frozen stablecoins.
Sources: BBC News; Associated Press; Reuters, 30 October; Reuters, how the heist unfolded. Percentages and rates are our own calculations from those reports.