Binance hack: $6.3B stolen, what users should know

Binance, the world's biggest crypto exchange, lost about $6.3 billion in a hack on the night of October 29, 2026. Blockchain analytics firm TRM Labs calls it the largest crypto theft on record, roughly four times the $1.5 billion taken from rival exchange Bybit in February 2025. Binance says it will cover every customer loss, and deposits are working, but withdrawals are still paused while it rebuilds its withdrawal system.

Here is what happened, who investigators blame, how much has been frozen, and what it means if you hold crypto on Binance.

What happened at Binance

According to TRM Labs, money began leaving Binance wallets at 20:05 UTC on October 29 (1:35 AM IST on October 30). Most of it moved in about 20 minutes, from wallets on ten blockchains including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger, all sent to addresses controlled by a single attacker. A second, smaller wave hit Binance wallets on Avalanche and Polygon around 23:05 UTC.

The stolen funds came from hot wallets, the internet-connected wallets an exchange uses to pay out customer withdrawals. TRM's breakdown puts about $3.79 billion on Ethereum, 18,270 BTC (about $1.47 billion) on Bitcoin, about $628 million on Tron and 233.46 million XRP (about $296 million) on the XRP Ledger, with smaller amounts on the other networks.

Binance first said it was investigating a potential security issue, then paused withdrawals on several networks. In a security incident update, it said its early investigation pointed to a possibly compromised laptop belonging to a DevOps engineer, which may have let the attacker into a service container and submit unauthorised withdrawals. It said it had found no evidence that any wallet private key had leaked.

By Friday morning the story had changed. "Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach," Binance said, adding that a full root-cause report will follow.

How the attack worked

TRM says the preparation began at least 36 hours before the theft. The attacker funded an operator wallet with three small withdrawals from Tornado Cash, a service that hides where crypto came from, then deployed and rehearsed its attack code on test wallets before installing it on a Binance hot wallet.

On Ethereum, the attacker used EIP-7702, a feature added in Ethereum's Pectra upgrade in May 2025 that lets an ordinary wallet hand control to a smart contract by signing an authorization. The attacker submitted 50 pre-signed authorizations at once, so at least one would match the busy hot wallet's transaction count. One did, turning the wallet into a sweeper only the attacker could control. A single transaction then moved 167,464 ETH and 63 tokens, including 1.615 billion USDT, and the attacker kept sweeping new funds that arrived later.

Wallets on the other nine chains, which use different key types and signing schemes, sent funds through ordinary signed transfers in the same half hour. In TRM's assessment, that points to the attacker being able to make Binance's hot wallet signing system approve transactions of its choosing. Binance co-CEO Richard Teng pushed back on the idea that one employee simply clicked the wrong thing: "To be clear: the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," he wrote on X, adding that the investigation has not blamed any individual.

Who is behind the Binance hack?

Binance has not named a culprit, and neither have law enforcement officials. But TRM attributes the attack, with high confidence, to TraderTraitor, North Korea's elite crypto-hacking unit, which the FBI named as responsible for the Bybit theft. Chainalysis also tied it to North Korea, saying its investigators saw funds stolen from Binance mixing in real time with funds from last month's Bitget exploit, which had been attributed to North Korean actors.

Elliptic co-founder Tom Robinson told WIRED, "We think North Korea is likely responsible," and said that if so, this one theft would almost double everything the regime has stolen in crypto to date. Elliptic has not specifically tied the attack to TraderTraitor, but Robinson pointed to familiar signs: targeting company staff, funding through Tornado Cash and rehearsing in advance, as in Bybit.

How much has been frozen?

Stablecoin issuers can block their own tokens, and they moved fast. TRM says Tether froze 971.1 million USDT in the attacker's main wallet at 21:01 UTC, and Circle froze 823 million USDC three minutes later. Ripple, World Liberty Financial and Arbitrum's Security Council also froze funds. TRM counted about $2.7 billion frozen on-chain by 00:30 UTC on October 30, Chainalysis about $2.8 billion, and Binance's own figure is about $3 billion.

The rest is harder to stop. Before the freezes spread, the attacker sold about 325 million USDT for ETH at a discount of more than 10% and borrowed ETH against USDT on the lending protocol Aave, TRM says. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze. "It can only be stopped when it reaches an exchange or other service," Robinson told WIRED, adding that he does not expect the frozen share to rise much further.

Different firms value the theft slightly differently: about $6.3 billion according to Binance, $6.36 billion according to TRM (pricing each transfer at the moment it was taken) and about $6.4 billion according to Chainalysis.

Is your money on Binance safe?

Binance says user funds are safe and that it will cover all losses from its Secure Asset Fund for Users (SAFU), an emergency reserve, and from company funds. The BBC reported that Binance has set aside more than $6.3 billion, about $5 billion of it already in the exact tokens that were taken, with the rest being bought. Fundstrat's Sean Farrell told CNBC he sees no meaningful solvency risk for the exchange. Binance says it will publish an updated Proof of Reserves and a technical post-mortem once its investigation is done.

CoinDesk notes that Binance's next monthly Proof of Reserves snapshot is due on November 1, which should show whether the stolen assets have been replaced. Its own analysis suggests the hack could have pushed Binance's ETH backing from 100% to about 94% until it is topped up.

Binance.US, which is a separate company, said it was not affected.

When will Binance withdrawals resume?

Deposits and trading are operating normally, Binance says. Withdrawals are paused while it revamps the security of its withdrawal service. Co-CEO Yi He said withdrawals were expected to resume within 48 hours, and a later Binance update on Friday morning said it was on track to resume them within about 45 hours. Binance has not given an exact time, so check its official announcements page and X account rather than third-party posts.

Market reaction

Bitcoin fell below $77,000 on the news, its lowest in more than a month, Bloomberg reported. The BBC said it lost about $3,000 from around $80,000. Binance says it holds about 35% of the crypto exchange market, so any doubt about its health ripples across the whole market.

This is not Binance's first hack or crisis. In 2019 attackers stole 7,000 BTC, then worth about $41 million. In 2023 it agreed to a $4.3 billion settlement with the US Justice Department, after which founder Changpeng Zhao stepped down as CEO.

What Binance users should do now

Do not send money or personal details to anyone offering to "recover" funds or speed up a withdrawal. Big hacks are followed by waves of fake support accounts, phishing emails and look-alike apps. No genuine support agent will ask you to move your funds to a new "safe" wallet.

Use only the official Binance app and website, turn on passkeys or an authenticator app if you haven't, and check that your withdrawal address allowlist is still what you set. If you rely on Binance for trading, expect queues and delays once withdrawals reopen.

For crypto you plan to hold long term, a self-custody hardware wallet removes exchange risk, though it brings its own responsibility for keeping your recovery phrase safe.