The $6.3 Billion Binance Hack: What Happened and How Much Was Stolen

Key facts at a glance

• When: the first wallets were drained at 20:05 UTC on 29 October 2026; the largest sweeps followed at 20:20 UTC (4:20 p.m. in New York).
• How much: Binance puts the total impact at about $6.3 billion. TRM Labs counts $6.36 billion at the prices of the moment each transfer was made.
• Where: hot wallets on ten blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
• Frozen: about $3 billion, mostly stablecoins blocked by Tether and Circle.
• Cause, per Binance: a compromised laptop of a DevOps engineer that gave the attacker access to a service container, which then submitted unauthorised withdrawals. Binance says it found no evidence that wallet private keys leaked.
• Who: TRM Labs attributes the attack "with high confidence" to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group.
• Users: Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds.

What happened on 29 October

The attack had been prepared in advance. According to TRM Labs' on-chain reconstruction, the attacker's operating wallet received three small withdrawals from the Tornado Cash mixer on 28 October. Early on 29 October the attacker deployed the code later used in the theft, tested it on two wallets and rehearsed the final version on a third. About four hours after the rehearsal, the same code was installed on a Binance hot wallet.

Then the money started moving:

Users noticed first. People on social media reported funds draining from Binance wallets, and founder Changpeng Zhao posted on X that "it does look like a hack on Binance", adding that he no longer runs the exchange, as Bitcoin.com News and TechCrunch reported. Binance's first response was that it was "aware of reports of a potential security issue" and that "user funds are completely safe". A spokesperson told TechCrunch that withdrawals were "temporarily suspended on multiple networks following a security incident as a precautionary measure". At about 00:30 GMT on Friday, 30 October, Binance suspended all deposits and withdrawals, AFP reported.

How much was stolen

Binance's own figure, posted on X, is that "the estimated total impact sits at around $6.3B", a number it said "may continue to increase" as more assets are traced, according to NBC News. Independent estimates differ slightly, mainly because of which transfers they count and which prices they use:

TRM Labs' breakdown by blockchain shows that Ethereum and Bitcoin account for more than 80% of the loss:

For scale: according to DefiLlama data cited by CoinDesk, Binance held about $144 billion in assets before the attack, so the loss is roughly 4% of its holdings. The theft is about four times the size of the Bybit hack of 21 February 2025, which the FBI put at about $1.5 billion. For a sense of the wider picture, TRM's 2026 Crypto Crime Report counted $2.87 billion stolen in nearly 150 hacks during the whole of 2025, as Al Jazeera notes. The Binance theft alone is more than twice that.

What Binance says

Binance has published its updates on X. In order:

1. "User funds are safe." The exchange repeated this from its first statement onwards.
2. Losses will be covered. Co-founder and co-CEO Yi He wrote that "Binance will cover all hacking losses" and promised "a full post-mortem once the investigation is complete". Binance said it would pay from its SAFU fund and company funds. SAFU, the Secure Asset Fund for Users, was set up in 2018 and holds roughly $1 billion in bitcoin, according to CoinDesk, so most of the cover would have to come from company money.
3. The cause. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop," the exchange said. That gave the attacker access to "a service container" from which it could "submit unauthorized withdrawal transactions". Binance said it found "no evidence of any private key leaks from wallets". A later update said several factors contributed and that the security team was still tracing the full attack path, as CyberInsider reported.
4. Containment. Binance said it had revoked authorisation for the affected address and was working with law enforcement, token issuers and blockchain intelligence firms. "This figure may continue to increase," it said of the roughly $3 billion frozen so far.
5. Deposits and withdrawals. After the full pause, Yi He said that "deposits remain unaffected and continue to operate as normal", that the team was "working on enhancements to the withdrawal service and related address controls", and that "we expect to begin resuming withdrawal services in the next 48 hours", as quoted by AMBCrypto.
6. Next steps. Binance plans to publish an updated Proof of Reserves after the clean-up and a detailed technical post-mortem.

Changpeng Zhao, who stepped down as CEO in 2023 and remains Binance's largest shareholder, added: "As a shareholder, I expect all user funds will be fully covered."

How much has been frozen

Unlike bitcoin or ether, the biggest stablecoins can be frozen by the companies that issue them. That made the race to freeze the single most important factor in how much the attacker keeps.

TRM put the total at about $2.7 billion as of 00:30 UTC on 30 October; Binance later said about $3 billion had been frozen on-chain. A frozen token cannot be moved, but it is not yet back with Binance: returning it takes a separate process with each issuer and, usually, law enforcement. Aave also froze its affected lending markets after the attacker used them, saying its own contracts were not affected.

What is out of reach is the native coins. TRM estimates the attacker still holds more than 420,000 ETH and the 18,270 BTC, roughly $2.4 billion that no issuer can freeze. The details of how the attacker swapped, borrowed and split those funds are in part two.

Who is behind the attack

Several blockchain investigators point to North Korea:

• TRM Labs assessed "with high confidence" that the attack was carried out by TraderTraitor, the North Korean unit the FBI blamed for the Bybit theft, citing "robust on and off-chain intelligence".
• Chainalysis also linked the theft to TraderTraitor, and investigator ZachXBT named the Lazarus Group as the likely attacker.
• Blockaid CEO Ido Ben-Natan said its findings were consistent with North Korean operations and called it "the biggest crypto hack in history".

The US Justice Department and the FBI did not immediately respond to AFP's request for comment. TRM's Ari Redbord called the attack "unprecedented" and a "watershed", adding that theft on this scale funds North Korea's weapons programmes, which makes it a global security issue. The evidence behind the attribution is covered in part two.

How the markets reacted

Prices fell as the news spread on Thursday. According to CoinDesk, bitcoin dropped 4.8% to below $77,000, ether 5.7%, Binance's own token BNB 8% and AAVE 11%. About $1.4 billion of leveraged positions were liquidated across the market over 24 hours, according to Coinglass data cited by Bitcoin.com News, although not all of that was caused by the hack. By about 04:00 GMT on Friday most of the fall had been recovered: AFP reported bitcoin and ether down 0.8%, and BNB up 2.7% after having fallen nearly 10%.

Sean Foley of Macquarie University told Al Jazeera that a blow to confidence in Binance could weigh on crypto prices and that the attack highlights the risks of keeping funds on centralised exchanges.

Has Binance been hacked before?

Yes, but never on this scale. On 7 May 2019 attackers took about 7,000 BTC, worth about $40.6 million at the time, from a single Binance bitcoin hot wallet, The Hacker News reported. That was about 2% of the exchange's bitcoin, and SAFU covered the whole loss. The 2026 attack is roughly 150 times larger in dollar terms and hit wallets on ten blockchains at once.

The same day as the Binance theft, prediction market Polymarket briefly halted trading after a separate incident involving a compromised third-party company, with losses of a few million dollars. TechCrunch reported it as a separate incident.

What it means for Binance users and crypto players

If you keep crypto on Binance, or move money through it to pay for other services, including crypto casinos, a few practical points apply:

• Expect withdrawal delays. While withdrawals are paused or limited, money on the exchange cannot reach another wallet or service. Avoid planning payments that depend on a Binance withdrawal until the service is fully back.
• Ignore "refund" and "verification" messages. Binance warned users to rely only on its official channels and not to follow unofficial links or requests for account details. Big hacks are always followed by phishing that impersonates the victim.
• Exchange balances are not insured. As NBC News points out, crypto on an exchange is not covered like a bank deposit; refunds depend on the exchange. Binance has promised full cover, but that is a company decision.
• Keep only what you need on any exchange. A self-custody wallet that you control removes the exchange as a point of failure, though it makes you responsible for your own keys and backups.
• Check the network before you send. When withdrawals return, choose the same network on both sides. Our list of USDT casinos shows which networks each casino accepts, and the fast withdrawal casinos page compares payout times.

Whatever happens with exchanges, gambling is for adults only and carries a real risk of loss; our responsible gambling guide lists tools and help lines.

Sources

• TRM Labs: North Korea steals USD 6.36 billion from Binance
• CoinDesk: Binance loses over $6 billion in the largest crypto hack to date
• NBC News: Binance targeted in $6.3 billion crypto heist
• AFP via Yahoo Finance: Binance confirms $6.3 bn hack
• Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history
• TechCrunch: Binance pauses withdrawals
• Bitcoin.com News: inside the Binance hack
• CyberInsider: Binance links the incident to a compromised laptop
• AMBCrypto: Binance to resume withdrawals within 48 hours
• FBI: North Korea responsible for $1.5 billion Bybit hack
• The Hacker News: Binance hot wallet hack of May 2019