On October 29, someone moved about $6.3 billion out of Binance's hot wallets, most of it in roughly 20 minutes. It's the largest crypto theft on record, about four times the $1.5 billion Bybit hack from February 2025. The FBI says North Korea did it.
Bitcoin dropped about 5% to around $77,000 and was back near $78,000 by November 1. If you buy every week, that's the least interesting part. The interesting part is that Binance customers couldn't move their coins for about three days and as of November 1 some still couldn't.
If you use Binance.US through ZenDCA
Binance.US is the only Binance that ZenDCA connects to and it's a separate platform from Binance.com. It said on October 29 that it was not affected and that customer funds and services were "secure and operating normally." That's the company's own statement, not an audit. As of November 1, nothing in the reporting contradicts it.
What actually broke
Nobody broke Bitcoin or Ethereum. The money left through Binance's own wallets. TRM Labs thinks the attackers got into the systems Binance uses to sign transactions, which would explain how they got valid signatures on ten different blockchains. Binance first pointed at one engineer's compromised laptop, then co-CEO Richard Teng said it was more complicated than that. As of November 1, Binance hasn't published a root cause.
What happened next is worth knowing if you own stablecoins. Tether, Circle and a few others froze their tokens within hours and about $3 billion was frozen by October 30, nearly all of it stablecoins. Nobody can do that to the 18,270 BTC that went out the door. Bitcoin has no issuer to call.
Binance paid. The next exchange might not be able to.
"Binance will absorb the financial impact of these stolen funds, not our users," the company said. On November 1, Teng said about 95% of the affected assets had been replaced, out of more than $6.34 billion set aside from its SAFU fund, its futures insurance fund and its corporate treasury.
Replaced is not the same as recovered. The freezes left the attackers with everything else. Binance bought new coins with its own money.
And the SAFU fund, the thing everyone points to when they say funds are safe, was worth about $1.2 billion. The hack was five times that. Not many exchanges can write the difference as a check over a weekend.
What this changes if you DCA
Nothing about the buying. Your schedule doesn't care who got robbed and it picked up the October 30 dip without asking you.
It does change how you should think about where the coins end up. Say you've put $100 a week into one exchange for three years and never withdrawn. That's $15,600 of perfectly disciplined buying and all of it depends on one company's security team. DCA handles your price risk. It does nothing for your custody risk.
- Decide what stays on the exchange. Most people never make this decision. They just stop withdrawing and it gets made for them.
- Automate the withdrawal. Pick a threshold and let coins move to your own wallet on a schedule.
- Don't treat self custody as free. Lose your seed phrase and nobody absorbs anything. Send a small test amount first and practice the restore before you trust it.
- Use more than one exchange. When one pauses, your other schedules keep running.
What to watch
- November 3: Binance's full cryptographic proof of reserves is due. Binance published a snapshot first, but this is the part you can actually check.
- Phase two of withdrawals: Bitcoin, ether and the big stablecoins reopened on November 1. The rest had no date at that point.
- The incident report: Binance has promised one once the investigation ends. Read it for the root cause.
- The stolen bitcoin: The FBI expects more laundering through DeFi and instant swap services and it has published wallet addresses.
Binance found $6 billion in a weekend. Plan as if your exchange can't.