Binance Hack: $6.3 Billion Stolen in Record Crypto Heist

Hackers drained an estimated $6.3 billion in cryptocurrency from Binance, the world's largest crypto exchange, on Thursday, Oct. 29, 2026, in what investigators call the largest crypto theft on record. Binance says user funds are safe and it will cover every loss, but withdrawals are paused while it rebuilds its systems, according to its security update. "Binance" drew more than 200,000 U.S. searches on Google Trends in the past day, with "binance hack," "binance hacked" and "bitcoin price" among the top related searches. Here's what happened, who is blamed and what it means for customers and the crypto market.

Not financial advice. This article summarizes official statements and reporting on a developing story. Figures may change as investigators trace the funds.

What happened in the Binance hack

On Oct. 29, an attacker moved roughly $6.36 billion out of Binance wallets on 10 blockchains, most of it in about 20 minutes starting at 20:05 UTC (4:05 p.m. ET), blockchain intelligence firm TRM Labs reported. That is about four times the $1.5 billion stolen from the exchange Bybit in February 2025.

Estimates differ slightly by firm:

Elliptic's analysis says the first transfers hit Binance wallets on the XRP Ledger, followed within about 30 minutes by wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Avalanche. Elliptic called it "almost certainly the largest theft of any kind in history."

How the attackers got in

Binance's first explanation was that the incident "may involve a compromised DevOps engineer's laptop," which let the attacker reach a service container and submit unauthorized withdrawal transactions. The exchange said it found "no evidence of any wallet private key leak."

By Friday, Binance said its investigation had "uncovered additional points of breach," Decrypt reported. Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions" and that the investigation "has not attributed responsibility to any individual."

In a video update, Teng said the attackers used Ethereum's EIP-7702 account-delegation feature to take control of a hot wallet without going through Binance's normal approval controls, and used a "self-destruct mechanism" to erase their tools and traces, CoinDesk reported.

TRM Labs' on-chain analysis adds detail. On Ethereum, the attacker submitted 50 pre-signed authorizations at once so at least one would match the busy wallet's transaction count, then drained the wallet about three and a half minutes later. Wallets on the other chains sent funds through ordinary signed transfers. In TRM's assessment, that points to a compromise of Binance's hot wallet signing infrastructure. A hot wallet is one connected to the internet so it can process withdrawals quickly.

Who is behind it: North Korea suspected

TRM Labs attributes the theft "with high confidence" to TraderTraitor, an elite North Korean hacking unit. Chainalysis reached the same conclusion, saying stolen Binance funds commingled on-chain with funds from last month's theft at the exchange Bitget, which was also attributed to North Korea. Elliptic likewise linked the theft to North Korea-connected actors.

Those are private-sector assessments. Elliptic notes that no government has yet confirmed attribution, and North Korea has long denied involvement in such hacks, the BBC reported.

There is precedent. The FBI publicly named TraderTraitor as responsible for the $1.5 billion Bybit theft in February 2025, and in 2022 it tied North Korea's Lazarus Group to the $620 million Ronin Network theft.

U.S. law enforcement is now involved. The FBI said it is "aware of the incident" and is working with public and private partners "to understand the scope of the activity," Reuters reported. The U.S. Secret Service said its investigators are working "around the clock" to identify, freeze, trace and recover the stolen funds, according to the BBC.

How much has been frozen or recovered

Binance says about $3 billion of affected assets has been frozen on-chain with help from blockchain partners. Independent tallies are a bit lower: Elliptic has verified $2.84 billion, almost all in the stablecoins USDT and USDC, and TRM Labs counts about $2.7 billion.

According to TRM Labs, stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze roughly $2.67 billion, and Arbitrum's Security Council froze ETH and ARB tokens on its network. The attacker tried to outrun the freezes by swapping stablecoins for ether, and now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach, TRM said.

Freezing is not the same as getting money back. "A freeze stops the money from moving, and recovery follows through legal process," Ari Redbord, TRM Labs' global head of policy, told CNBC. Stablecoins are the easiest to recover because issuers can freeze and reissue tokens. Bitcoin and ether have no issuer, so investigators must trace them until they reach an exchange that cooperates. "Returning funds can take months or years," said Eric Jardine, head of research at Chainalysis.

What it means for Binance customers

Binance has made four main promises and changes:

• Losses covered: Binance says it will cover all losses from its SAFU (Secure Asset Fund for Users) emergency reserve and company funds, and that "user funds are safe."
• Withdrawals paused: Withdrawals stay off while the service is rebuilt and tested. Teng said Binance hopes to resume them by Sunday, Nov. 1, about 40 hours after his Friday update, according to the BBC and CoinDesk.
• Deposits working: Deposits were briefly suspended but are now operating normally, Binance says.
• Proof of reserves: Teng said a full proof-of-reserves report would come by Monday, Nov. 2, with an initial view possibly sooner.

Analysts so far do not see the hack threatening Binance's survival. Sean Farrell of Fundstrat Global Advisors told CNBC the breach "does not currently appear to create meaningful solvency risk," while noting that the key test is how quickly withdrawals resume and whether outflows stay orderly.

Is Binance.US affected?

No. Binance.US, the separately operated platform for U.S. residents, said it was not affected and that its services were running normally, the BBC reported.

Practical steps for crypto users

• Check your balance only through Binance's official app or website, and follow official Binance channels for updates, as both Binance and experts cited by the BBC advise.
• Be wary of messages, ads or "support agents" offering to speed up withdrawals or recover funds. Big hacks tend to draw impersonation scams. You can report suspected fraud to the FBI at ic3.gov.
• Remember that crypto on any exchange is not protected by FDIC insurance the way a U.S. bank deposit is.

Bitcoin price and crypto stocks fall

The hack hit already-shaky markets. On Friday, Oct. 30, bitcoin fell 4.1% to about $77,446, ether dropped 4.4% to about $2,230 and Binance's own token, BNB, slid 6% to about $701, CNBC reported.

Crypto-linked stocks fell harder. Coinbase shares dropped about 11% after third-quarter revenue narrowly missed estimates, with the Binance breach adding pressure. Circle fell about 8%, Robinhood 7.9% and Strategy 9%, Proactive reported via Yahoo Finance. A broader tech selloff, led by a plunge in Intel shares after its outlook, weighed on the Nasdaq at the same time. Coinbase CEO Brian Armstrong said his company was blocking transfers to compromised wallets and offering help to Binance.

For the bigger rate backdrop behind this week's market moves, see our explainer on why the Fed held rates at 3.75%-4%.

What happens next

1. Ongoing: Investigators and blockchain firms keep tracing the roughly $3 billion that has not been frozen.
2. By Sunday, Nov. 1: Binance's target to restart withdrawals, if testing passes. (Daylight saving time also ends that morning; see our time change guide.)
3. By Monday, Nov. 2: Binance's promised full proof-of-reserves report.
4. Later: A detailed technical post-mortem from Binance, and any official U.S. attribution.

The bottom line

The Binance hack is the largest crypto theft on record, and private investigators point to North Korea. About half the money is frozen, Binance says it will make customers whole, and the next real test is whether withdrawals reopen smoothly by Sunday. Until then, use only official channels and treat any "recovery" offers as likely scams. For another recent security story, read what a report found about Samsung smart TVs and Log4j.