Binance hit by record $6.3bn hack: what it means for African crypto users

Updated 31 October, 16:52 GMT: adds Binance’s proof-of-reserves snapshot, co-CEO Richard Teng’s account of the attack and a report of FBI involvement.

Binance, the world’s largest cryptocurrency exchange and one of the most widely used platforms in Africa, has suffered the biggest crypto theft on record. Attackers drained about $6.3bn across 10 blockchains in roughly 20 minutes on Thursday, 29 October. Withdrawals have been frozen since, leaving users in Nigeria, Kenya, South Africa and beyond unable to move their funds.

Binance says customers will not lose money. “Binance will absorb the financial impact of these stolen funds, not our users,” the company said in an announcement on 30 October.

What happened

• How they got in. Binance’s early findings point to a compromised laptop belonging to one of its DevOps engineers. The attackers used it to reach a service container and send withdrawals that looked like they came from a trusted internal system. Binance later said it had found additional points of breach, but no evidence that its wallets’ private keys had leaked. Co-CEO Richard Teng said the attacker used an Ethereum feature (EIP-7702 delegation) that “did not pass through our normal approval controls”, and a “self-destruct mechanism” to remove traces.
• How big it is. Blockchain analysts at TRM Labs put the haul at about $6.36bn, more than four times the $1.5bn taken from the Bybit exchange in February 2025, the previous record.
• Who is blamed. TRM Labs says it has “high confidence” the attack was carried out by TraderTraitor, a hacking group linked to North Korea and associated with the Lazarus Group. Chainalysis has made the same link. Binance and US authorities have not formally confirmed who was responsible. Asked whether North Korea was behind it, US President Donald Trump said: “We don’t know.” A source told Cointelegraph that Binance is working with the FBI to recover funds.

The clean-up so far

• About $3bn frozen. Stablecoin issuers moved quickly: Tether froze about $1.57bn and Circle more than $800m, with about $200m more linked to Ripple, according to figures Binance shared on 30 October.
• Losses covered. Binance says it has set aside more than $6.34bn of company funds. On Saturday it said 90% of the stolen assets had already been replenished, and it is buying the rest, mostly less-liquid tokens. It also plans to top its emergency insurance fund, SAFU, back up to about $1bn.
• Proof of reserves. A snapshot taken at midnight GMT on 31 October shows Binance holding at least 100% of customer balances in major tokens, including bitcoin, ether, USDT, BNB and USDC. A full cryptographic proof, which lets users check their own balances, is expected by 3 November.
• Withdrawals. Deposits kept working, but withdrawals were suspended. Binance says it is on track to restart them on Sunday 1 November, in phases rather than all at once.
• Markets. Bitcoin fell more than 3% on Friday to about $76,400, and Binance’s own BNB token fell about 5%.

Why it matters for Africa

Binance is a household name for crypto users across the continent, from Nigerians trading naira on its peer-to-peer (P2P) market to South Africans and Kenyans holding savings in stablecoins. South African site MyBroadband reported that local users could not withdraw their crypto, and The Kenya Times reported alarm among Kenyan users over the freeze.

Binance Africa told South Africa’s Daily Maverick that “user funds are safe.”

In Nigeria, the hack lands on old tension. The Securities and Exchange Commission said in 2023 that Binance Nigeria Limited was neither registered nor regulated in the country, and warned investors about the risks of unregistered platforms.

What people are saying

Hendrik de Bruin, head of security consulting for Africa at Check Point Software Technologies, told Daily Maverick the attack stood out for how it was done: “The attackers didn’t break the encryption or steal the private keys.” He said companies should limit how much money can move, and how fast, and warned that banks, cloud providers and payment gateways face the same kind of threat.

What users should do

• Expect phased withdrawals from Sunday and allow for delays.
• Turn on two-factor authentication and use a unique password for your exchange account.
• Ignore anyone offering to “recover” Binance funds for a fee. Never share a recovery phrase. Scammers often target users after big hacks.
• Funds in personal wallets whose keys you control were not affected by this breach.

What to watch

• Whether withdrawals restart smoothly on Sunday, and how long the phases take.
• The full cryptographic proof of reserves, expected by 3 November, and Binance’s promised technical report.
• Whether the FBI or other agencies formally name North Korea.
• Where the roughly $3bn not yet frozen ends up, including about 18,270 bitcoin split across 19 wallets.

Sources: Daily Maverick, 30 October; Within Nigeria, 31 October; Arbiterz, 30 October; crypto.news, 31 October; Cointelegraph, live updates, 30 October and 31 October; CoinDesk, 31 October; MyBroadband; The Kenya Times; Binance announcements, 30–31 October.

Top photo: Binance-branded T-shirt and tote bag (illustrative file photo). Photo: Bretwa, Wikimedia Commons, CC BY-SA 4.0