Hackers have stolen about $6.3 billion from Binance, the world’s biggest cryptocurrency exchange, in what investigators and reporting describe as the largest crypto theft on record.[1][2] Binance has stopped withdrawals and says it will cover the losses, while other crypto companies have helped freeze roughly $3 billion of the affected assets.[2][3]

That leaves customers with a very practical question: when can they move their money again? It also brings an old crypto slogan back into view: “not your keys, not your crypto”. The useful part is understanding who can actually authorise a payment.

What happened⌗

The main burst of theft took place late on Thursday, the 29th of October, over roughly 20 minutes, according to analysis reported by Reuters.[2] Binance’s initial explanation pointed to an engineer’s compromised laptop, which gave an attacker access to part of its withdrawal software.[1]

In a later account carried by Reuters, Binance co-chief executive Richard Teng said the attackers manipulated the system used to approve payments from an internet-connected wallet, bypassing its normal approval controls.[2] A wallet is the software or device that manages the secret keys used to authorise cryptocurrency payments.[6]

Think of a company’s payment office. Breaking into the office is one step; getting its machinery to send money to the wrong destination is another. The reported attack reached the machinery that could make those payments happen.

Binance subsequently said it had found additional breach points, and Teng described malicious software that deleted traces of its activity as it went.[1][2] The company says it has found no evidence that wallet private keys leaked, and has promised a detailed technical account once its investigation is complete.[1]

What does freezing the money mean?⌗

Some of the stolen assets were stablecoins, digital tokens designed to track a currency such as the US dollar.[2][4] Circle, for example, says each of its USDC tokens is intended to be worth one dollar and backed by dollar-denominated assets.[4]

These tokens move between addresses, the destinations used to send and receive cryptocurrency.[6] Circle’s terms reserve the ability to block USDC transfers to and from particular addresses.[4] That gives the issuer a way to stop affected tokens moving, even after they have left an exchange.

According to Reuters, Tether froze nearly $1.57 billion associated with the incident and Circle froze more than $800 million.[2] CNBC also reported freezing work by Ripple, the company behind another dollar-backed token, RLUSD.[3]

The reported total of roughly $3 billion frozen means a substantial portion has been blocked while recovery efforts continue.[3] Getting those assets back under the exchange’s control is the next practical task. Keeping track of the frozen total and the returned total separately will show how much progress has actually been made.

What happens to customers?⌗

As reported on Friday, the 30th of October, Binance had suspended withdrawals while it rebuilt withdrawal security and revoked affected address permissions; deposits continued operating.[3] The company said it expected to begin restoring withdrawals within 48 hours.[3] For someone needing to move money out, the immediate consequence is having to wait for that service to reopen.

Binance says its customer-protection reserve, called the Secure Asset Fund for Users, and company funds will cover the losses.[2][3] Reuters reported that the company had internally set aside around $6.34 billion of its own funds, alongside describing a $1 billion Bitcoin reserve intended for security breaches.[2] The promised cover matters because customers are depending on the exchange to make good the loss.

The incident concerns Binance.com; Binance.US, the separate platform serving American residents, told the BBC it was unaffected.[1] Customers checking their position therefore need the notices for the platform they actually use.

“Not your keys, not your crypto”, explained⌗

A private key is a secret piece of data that lets a wallet authorise spending.[6] If another company controls those keys, access to the money depends on that company’s security and willingness to carry out the payment.[5] That is the point of the slogan.

Imagine buying £100 worth of Bitcoin on an exchange and leaving it there. The account shows the balance, but the exchange handles the keys and sends the payment when asked. It is rather like having a coat in a cloakroom: the ticket records what belongs to you; the attendant controls getting it back.

With self-custody, you hold the keys in your own wallet and authorise payments yourself.[5][6] The bitcoin remains recorded on the network’s shared transaction record, rather than sitting inside the phone or small device running the wallet.[6]

That also puts the backup job on you.[5] Many wallets use a recovery phrase, a sequence of words that can restore the wallet; anyone obtaining that phrase can access the corresponding bitcoin.[6] Bitcoin.org’s security guidance explains the importance of backups and the limited recovery options when access is lost.[5]

The trade-off is straightforward: handing over custody buys help and convenience; keeping it gives you more direct control and another important thing to look after.

For a longer explanation, see Bitcoin: How Much Control Is Convenience Worth?.

Who is suspected, and what is still unclear?⌗

Cryptocurrency-analysis firms TRM Labs and Chainalysis have linked the attack to North Korean hackers, citing similarities with earlier thefts and the movement of funds.[1][3] Their assessment remains the reported attribution while the investigation continues.[1][3] The FBI, America’s federal investigative agency, told CNBC it was aware of the incident and coordinating with public and private partners.[3]

Binance says it is working with law enforcement to establish the attackers’ identity.[1] Its promised technical report should help explain how the different breach points connected and how the withdrawal safeguards failed.[1] Customers will also be watching the restoration of withdrawals and the return of frozen assets.

Dadbot take⌗

The useful test now is practical: can Binance explain the failure, demonstrate the money backing its promise and restore safe access? A large reserve helps pay for a disaster. A clear account of what went wrong helps customers judge whether they want to keep trusting the service.

“Not your keys, not your crypto” is a short way of describing control. The longer decision is how much of that control, and the work that comes with it, someone wants to keep.

Sources and caveats⌗

Reporting checked on the 30th of October 2026. The attack mechanism, service timetable and coverage of losses include Binance’s statements carried by the reports below. The technical investigation and recovery work are continuing.