Binance Hack: Over $6 Billion Stolen in Record Crypto Theft

The Binance hack on October 29, 2026, is now the largest crypto theft on record, with more than $6 billion moved out of the exchange’s wallets in a matter of minutes. Blockchain analytics firm TRM Labs puts the total at about $6.36 billion across ten blockchains, while Chainalysis estimates about $6.4 billion. Binance, the world’s largest crypto exchange, has pledged to cover all user losses.

According to TRM, most of the funds left Binance wallets in about 20 minutes, starting at 20:05 UTC. That makes the theft about four times the size of the $1.5 billion Bybit hack in February 2025.

How the Binance hack happened

Binance has linked the theft to a DevOps engineer’s compromised laptop. The access allowed attackers to reach a service container and submit unauthorized withdrawal transactions. The exchange said it had not found evidence that a wallet private key was leaked.

“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual,” Binance said in a statement shared with BleepingComputer. The exchange added that it had “uncovered additional points of breach” and was still gathering the facts.

TRM said it found valid signatures from Binance-controlled keys across different chains, pointing to a compromise of the exchange’s hot-wallet signing infrastructure. On Ethereum, the attackers used EIP-7702, a feature that lets a regular wallet run smart-contract code, to execute attacker-controlled code through a Binance wallet.

Who is behind the Binance hack?

Binance has not attributed the attack to any group. TRM Labs said with “a high degree of confidence” that TraderTraitor, a North Korean state-sponsored hacking unit, is responsible. Chainalysis also assessed that the group was likely behind it. The FBI previously linked the same group to the Bybit hack.

TRM said preparations began at least 36 hours before the theft, with the attackers using the Tornado Cash mixing service to fund their wallets in advance.

How much has been frozen

Estimates of frozen funds vary by source:

• Binance: about $3 billion frozen onchain
• Elliptic: $2.84 billion in verified freezes as of 8 a.m. UTC on October 30, mostly USDT and USDC
• TRM Labs: roughly $2.7 billion, including about $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial, plus 8,426 ETH and 74.6 million ARB frozen by Arbitrum’s Security Council

TRM said the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets that no issuer can freeze.

Freezing is not the same as recovery. Ari Redbord, global head of policy at TRM Labs, told CNBC that “a freeze stops the money from moving, and recovery follows through legal process.”

What Binance is doing for users

“Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe,” the exchange said, adding that it would publish an updated Proof of Reserves once remediation is complete. Binance said it has reserved more than $6.34 billion, including $5 billion already held in the affected tokens.

Binance suspended withdrawals for security checks. Its October 30 update, signed by co-CEOs Yi He and Richard Teng, said deposits and other unaffected services remained operational and outlined a phased restart of withdrawals, subject to completed security checks. Sean Farrell of Fundstrat Global Advisors told CNBC the breach does not currently appear to pose a meaningful solvency risk for the exchange.

As a writer, I think the lesson here is that a single compromised work laptop can still be the first domino, even at the biggest exchange in the industry. For more on crypto and security, see our stories on AI that finds smart contract vulnerabilities, a Plex flaw used to plant a crypto miner and IBM’s 2026 data breach report.

FAQ

How much was stolen in the Binance hack?

TRM Labs estimates about $6.36 billion across ten blockchains, and Chainalysis estimates about $6.4 billion. Binance has cited about $6.3 billion.

Will Binance users lose money?

Binance says it will cover all losses from its SAFU fund and company funds and that user funds are safe.

Who is blamed for the attack?

TRM Labs and Chainalysis attribute it to North Korea’s TraderTraitor group. Binance itself has not attributed the attack.