Three minutes and 24 seconds.

That’s how long it took to drain what is believed to be $5.8 billion in crypto overnight from one of the world’s biggest exchanges, Binance.

We don’t know for certain the final number, but things are coming out around what’s going to happen next.

We also don’t know the complete scale of this attack, if its agentic or a state-backed aggressor (like North Korea…).

It’s the old Rumsfeld line about unknown unknowns, “things we don’t know we don’t know.”

For now, here’s what is known and what you should do about it.

Blockchain tracker Arkham counts more than $5.7 billion in the attacker’s wallets, about 4% of the $144 billion Binance held before the hack.

It attacked Binance 14, one of their hot wallets, draining ETH and USDT.

The part tied to the Ethereum drain alone is $2.8 billion to $3.5 billion.

It’s already the largest exchange hack ever.

Previous records included the $1.5 billion North Korea took from Bybit in February 2025.

Ronin Network at $625 million and Poly Network at $611 million...

Tether can blacklist any address through a function built into the USDT contract. Once it does, those tokens can’t move.

Tether boss Paolo Ardoino said it froze more than 1.567 billion USDT. Circle froze about $823 million of USDC, and Binance puts the frozen total at $2.54 billion.

About 700 million USDT got out before the blacklist landed. And there are reports that the attacker used the stablecoins as deposits on Aave to then borrow ETH. It looks like Aave is stuck with frozen USDT while the attacker has more than $1 billion in liquid ETH.

Binance has since said,

“Binance will cover all losses. As a precaution, all deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.”

But therein lies the age old tale of the risks of keeping funds on an exchange.

Right now, no one can move in or out of Binance.

And while funds will be covered, the whole point of having to go through the processes to ensure that comes around is stressful and tedious.

Now, there’s no great need to pick apart this attack. It’s clearly a well designed and thought out attack. And maybe North Korea just added $5 billion or so to their national defence budget.

But as an individual investor, there’s nothing you can do to prevent an exchange like Binance getting hacked. We’ve seen this play out time and time again, and as we’ve said time and time again, no exchange is ever safe from these attacks.

So, what do you do?

Every Binance customer is currently locked out. Is their money safe? We assume it is, but we can’t confirm. And no one can do anything anyway until Binance decides it’s ok.

The way around these things is to never keep your crypto on exchanges like this to start with.

A hardware wallet keeps your keys offline and makes you approve every move on its own screen.

Multisig goes further, because it needs more than one key to sign, say two of three, kept on separate devices. Binance 14 fell to one bad signature.

Of course, self-custody isn’t bulletproof, but offline “cold” hardware wallets are a damn sight better than an exchange hot one.

Also, it’s unlikely a state-backed actor like North Korea’s Lazarus Group is going after an individual.

Billions in one place draws a state-backed hacking team, your stack in a drawer doesn’t.

This has also hit the crypto market. Within the minute of the attack being known, prices of Bitcoin, Ethereum, crypto across the board took a sharp dive lower.

These reactions are great buying opportunities. Bitcoin at a sharp and fast discount. Remember, this was an attack on Binance, not on Bitcoin or Ethereum.

I wouldn’t want to own Binance stock (not that you can), but for BTC or ETH, as much as this attack is a horrible thing, this is another chance to add to your stack.

Just make sure you’re not storing the proceeds on an exchange!

More soon,

Lewis Maguire