On October 29, 2026, Binance—the world’s largest cryptocurrency exchange—suffered the largest heist in crypto history. Hackers drained roughly $6.3 billion in user assets in a coordinated attack that unfolded largely within 20 minutes. Investigators have since attributed the breach with “high confidence” to TraderTraitor, a North Korean state-sponsored hacking unit. Here is what is known so far.
Event Overview: The Largest Crypto Heist on Record
Binance confirmed the breach on October 30, estimating the total impact at approximately $6.3 billion**. Blockchain intelligence firm TRM Labs placed the original outflows at **$6.36 billion, traced across 10 blockchains. The attack dwarfs all previous crypto thefts—it is more than four times the size of the $1.5 billion Bybit hack in February 2025.
The bulk of the theft occurred in a 20-minute window beginning shortly after 20:05 UTC (4:05 p.m. US Eastern Time) on Thursday, October 29. On-chain data shows the main drain was even faster: approximately $2.7 billion left two Binance Ethereum wallets in under 24 seconds.
How the Attack Happened: A Hijacked Signing System
Binance’s preliminary investigation points to a compromised laptop belonging to a DevOps engineer as the entry point. The attacker used that access to reach an internal service container and submit unauthorized withdrawal transactions.
Crucially, Binance stated it found no evidence of leaked wallet private keys. Instead, investigators believe the attackers compromised Binance’s “signing infrastructure” —the system that authorizes transactions—allowing them to issue instructions that emptied affected wallets.
As one Hong Kong crypto lawyer put it: “The attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money”.
TRM Labs noted signs of advance preparation, including transaction signatures obtained before the theft, and referenced the use of EIP-7702 delegation exploits.
Assets and Chains Affected
The stolen funds spanned 9–10 blockchains, with Ethereum bearing the largest share. According to on-chain data:
| Asset | Approximate Amount / Value |
|---|---|
| USDT (Tether) | ~$1.875 billion on Ethereum; ~$1.567 billion frozen by Tether |
| USDC (Circle) | ~$823 million; frozen by Circle |
| ETH (Ethereum) | ~197,540 ETH (~$457 million); the attacker still held ~197,460 ETH (~$436M) after the drain |
| BTC (Bitcoin) | ~18,270 BTC (~$1.44 billion) reportedly not yet laundered by the attacker |
| Other tokens | LINK, AAVE, WBTC, ONDO, RLUSD, USD1, WBETH, and others |
A significant portion of the stolen assets were stablecoins—USDT, USDC, RLUSD, and USD1—which issuers can freeze remotely.
Attribution: North Korea’s TraderTraitor
Multiple blockchain analysis firms have tied the attack to TraderTraitor, a North Korean state-sponsored hacking group also known as the Lazarus Group.
-
TRM Labs attributed the attack with “high confidence” based on on-chain and off-chain intelligence.
-
Chainalysis also assessed TraderTraitor as the likely perpetrator.
-
The same group was blamed by the FBI for the $1.5 billion Bybit hack in February 2025, and the Binance breach shares tactical similarities.
Binance co-CEO Richard Teng said the exchange’s investigation had not yet formally identified the attackers, and North Korea routinely denies involvement in cyberattacks.
Binance’s Response and Recovery Efforts
Binance moved swiftly on multiple fronts:
1. Freezing assets. Working with blockchain partners—including Tether, Circle, Ripple, World Liberty Financial, and Paxos—Binance helped freeze approximately $3 billion** in affected assets on-chain. ZachXBT later reported over **$2.83 billion frozen, including ~1.767B USDT, $823M USDC, and $40.5M RLUSD.
2. Covering losses. Binance pledged to cover all losses from its Secure Asset Fund for Users (SAFU) —a roughly $1 billion Bitcoin reserve—and company funds. Co-founder Yi He stated that Binance’s annual revenue is sufficient to cover the losses and that there are no plans to sell its SpaceX shares.
3. Suspending withdrawals. Deposits were restored relatively quickly, but withdrawals remained paused while Binance overhauled its withdrawal service and related addresses. The exchange estimated withdrawals would resume within 48 hours, though that remained an estimate.
4. Revoking access and involving law enforcement. Binance revoked the affected address authorization and engaged law enforcement and blockchain intelligence firms to trace and recover funds.
5. Proof of Reserves. Binance committed to publishing an updated Proof of Reserves once remediation is complete, followed by a full technical post-mortem. Yi He noted Binance was purchasing assets matching the stolen altcoins through OTC and on-exchange channels to complete the POR.
Market and Industry Impact
The hack rattled markets already on edge.
-
Bitcoin fell from a 24-hour high of $81,890** to as low as **$76,300, a drop of more than 5%, before recovering to around $77,800.
-
BNB dropped approximately 8% , and Ethereum fell around 5.7%.
-
The selloff triggered liquidations of leveraged long positions.
The broader context amplified the damage. The crypto industry was already reeling from the failure of the Clarity Act in Congress—a bill that would have provided comprehensive legal protections for crypto assets in the U.S.. The Binance hack, coming barely a month after Bitget lost $387.5 million in a separate incident, is expected to prolong the industry’s regulatory reckoning and intensify calls for stricter oversight.
What Remains Uncertain
-
Recovery of unrecoverable assets. TRM Labs estimates that $2.4 billion in Bitcoin and Ethereum may never be recovered, as these assets lack the issuer-level freeze capabilities of stablecoins.
-
The final tally. Binance’s $6.3 billion figure is an **estimate of impact**, not a final accounting of unrecoverable losses. The $3 billion frozen is not the same as funds already returned to users.
-
The full technical post-mortem. Binance has promised a detailed report once the investigation concludes.
-
Formal attribution. While TRM and Chainalysis point to North Korea, Binance has not officially confirmed the attacker’s identity, and a criminal finding by authorities remains pending.
Bottom line: The $6.3 billion Binance hack is a watershed moment for crypto security. It exposed a critical vulnerability not in private keys, but in the operational infrastructure that authorizes transactions. How Binance executes its recovery—and how regulators respond—will shape the industry’s path toward mainstream credibility for years to come.