Binance $6.3B Hack: What Happened and What It Means in 2026

Binance, the world's largest crypto exchange, says a security incident on October 29, 2026 had an estimated impact of about $6.3 billion, making it the largest crypto theft on record. Blockchain analytics firm TRM Labs traced roughly $6.36 billion leaving Binance wallets on ten blockchains, most of it in about 20 minutes, and attributes the attack with high confidence to North Korea's TraderTraitor unit.

Binance says it will cover all losses and that user funds are safe. Withdrawals are paused while it rebuilds the system the attacker abused, and markets have already repriced the risk. Here is what is confirmed so far, how the attack worked, how much has been frozen, and what it means for anyone who keeps crypto on an exchange.

What Binance has confirmed

In its security incident update, Binance said its initial investigation suggests the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The exchange said it had found no evidence of any wallet private key leak and promised a detailed technical post-mortem once the investigation is complete.

The key points from Binance's own statement:

Estimated impact: around $6.3 billion.
Frozen so far: about $3 billion frozen on-chain with the help of blockchain partners.
Who pays: Binance says it will cover all losses from its SAFU fund and company funds, and will publish an updated Proof of Reserves after remediation.
Immediate steps: deposits and withdrawals temporarily suspended, the affected address authorization revoked, and law enforcement plus blockchain intelligence partners engaged to trace and recover funds.

The messaging on deposits has since shifted. According to FinanceFeeds, co-CEO Yi He posted a service update at 04:17 UTC on October 30 saying "deposits remain unaffected and continue to operate as normal" and that Binance expects to "begin resume withdrawal services in the next 48 hours." Binance's main account repeated that withdrawals remain paused during "a security revamp of the withdrawal service and its related addresses." Earlier Binance statements had described both deposits and withdrawals as suspended, and the exchange has not clarified when deposits were restored.

The BBC reports that the incident concerns Binance.com, and that the separate US platform Binance.US says it is not affected. Coinbase also told the BBC it was unaffected and was monitoring the situation.

How the attack unfolded, according to TRM Labs

TRM Labs published the most detailed on-chain reconstruction so far in its report North Korea Steals USD 6.36 Billion From Binance. Its figures reflect what it saw on-chain as of 00:30 UTC on October 30, and it stresses that the story is still developing.

Preparation started more than a day earlier

TRM says preparation began at least 36 hours before the theft. The attacker's operator wallet was funded with three small withdrawals from Tornado Cash starting the morning of October 28. Early on October 29 the operator deployed and tested attack code on two wallets, rehearsed a final version on a third, and about four hours later the same code was installed on a Binance hot wallet.

Twenty minutes, ten chains

The drain began on the XRP Ledger, where five Binance wallets sent 233.46 million XRP to a single attacker address between 20:05 and 20:09 UTC. Binance wallets on Solana and Optimism followed shortly after 20:10 UTC. At 20:20 UTC a Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which immediately began splitting the coins into 1,000 BTC and 100 BTC pieces, a laundering technique known as a peel chain. Within two minutes a Binance hot wallet on Tron sent 612.7 million USDT and 46.4 million TRX. A second wave around 23:05 UTC hit Binance wallets on Avalanche and Polygon.

TRM's breakdown of what left by network:

Ethereum: about $3.79 billion, including 200,630 ETH, 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.
Bitcoin: 18,270 BTC, about $1.47 billion.
Tron: 612.7 million USDT and 46.4 million TRX, about $628 million.
XRP Ledger: 233.46 million XRP, about $296 million.
Solana: 970,500 SOL, about $96 million.
Arbitrum, Optimism and Base: about $39 million combined; Avalanche about $28 million; Polygon about $10 million.

The EIP-7702 twist on Ethereum

The Ethereum leg is the technically novel part. EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets an ordinary wallet hand its behavior to a smart contract by signing an authorization. TRM says the attacker submitted a single transaction at 20:20 UTC containing 50 authorizations, each signed by the Binance hot wallet and each pointing it to a sweeper contract that only the attacker could command.

Because a busy exchange wallet's transaction counter (its nonce) keeps moving, an authorization only works at the exact count the wallet has reached. Pre-signing 50 consecutive counts guaranteed one would match. One did. Three minutes and 24 seconds later, the attacker told the hot wallet to send its entire balance away: 167,464 ETH and 63 tokens, including 1.615 billion USDT, in a single transaction. The delegation then stayed in place, so the attacker swept new deposits again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.

Why TRM thinks signing infrastructure was compromised

Early chatter suggested the Ethereum authorizations were phished. TRM argues that explanation does not cover the other nine chains, where Binance wallets with different key types and signing schemes all sent funds through ordinary signed transfers within about half an hour. In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. That is consistent with Binance's own account of a compromised engineer laptop reaching a service container that could submit withdrawals, and with its statement that no private keys leaked. Binance has not yet published a root cause.

Who is behind it

TRM attributes the attack to TraderTraitor, which it describes as North Korea's elite hacking unit, and which the FBI previously named as responsible for the $1.5 billion Bybit hack in February 2025. TRM points to familiar patterns: small Tornado Cash withdrawals funding an operator wallet, staging well before the theft, and signatures obtained in advance then executed in one burst. It also says the laundering seen so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed Bybit.

According to the BBC, Chainalysis also said it has "high confidence" that the same North Korean group is linked to the hack, and TRM's global head of policy Ari Redbord called it a "watershed moment." CNBC reports that Chainalysis CEO Jonathan Levin assessed the theft as likely carried out by TraderTraitor. Binance did not directly address the North Korea attribution, telling the BBC it is working with law enforcement partners "to confirm the identity of these criminals and bring them to justice."

The freeze race: what stablecoins could and could not stop

This hack is also the biggest real-world test yet of issuer-controlled stablecoins as a security backstop. TRM counts about $2.7 billion frozen on-chain as of 00:30 UTC on October 30:

Tether: about 1.77 billion USDT, starting with 971.1 million USDT frozen in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep.
Circle: about 825 million USDC, including the 823 million USDC frozen at 21:04 UTC in coordination with law enforcement.
Ripple: 40.5 million RLUSD frozen at 22:01 UTC, after the attacker had already sold 48 million of the 88.5 million RLUSD it took.
World Liberty Financial: 27.8 million USD1 frozen at 22:10 UTC.
Arbitrum Security Council: 8,426 ETH and 74.6 million ARB, about $30 million, forcibly moved out of the attacker's wallet at 00:08 UTC.

The attacker raced those freezes. TRM says about 325 million USDT was sold to professional fillers and market makers through UniswapX and other intent-based contracts for about 122,300 ETH, at an implied price near $2,650 per ETH while ETH traded around $2,300 to $2,350, a discount of more than 10%. A second wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH before Aave froze the affected markets, and 300 million USDT on Tron moved toward the JustLend lending protocol.

The result: TRM estimates the attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets beyond any issuer's reach. Even after the freezes, that is more than any previous crypto theft.

Frozen is not the same as recovered

Freezes stop funds from moving, but getting them back is slower. Redbord told CNBC that "a freeze stops the money from moving, and recovery follows through legal process," usually a court order or seizure warrant, after which issuers can burn and reissue tokens to the victim. He called stablecoins "the most recoverable asset class in crypto because the issuer controls the token contract." Bitcoin and ether have no issuer, so investigators have to trace them until they reach a cooperating exchange or service. Chainalysis's Eric Jardine told CNBC there is "no standard recovery timeline" and that returning funds "can take months or years."

Market fallout: prices, liquidations and a rush off exchanges

The sell-off was immediate. CNBC reported on Friday that bitcoin fell 2.8% to $78,489.73, ether dropped 3.8% to $2,242.90, and BNB slid 3.5% to $717.4. Hyperliquid's HYPE token moved the other way, rising 17% to $93.16.

Leverage amplified the move. CoinDesk reported total liquidations of $1.53 billion, citing CoinGlass, with long positions accounting for 83.8% of the total. Bitcoin fell as low as about $76,460. In a separate piece, CoinDesk put bitcoin's share of liquidations at $468 million and ether's at $358 million, and noted that Polymarket had suspended international trading after hackers drained more than $2.6 million from user accounts.

Standard Chartered's Geoffrey Kendrick told CoinDesk he expects more near-term pain: "I suspect the negative price action still has some way to go. Only after assets are unfrozen and more detail of the hack emerges will we find a new base." He also argued the episode could accelerate a structural shift toward decentralized exchanges.

The behavioral shift may matter more than the price move. CoinDesk reports, citing people familiar with the matter, that institutional investors are rushing to withdraw digital assets from centralized exchanges, though the amounts and destinations were not clear. The same report notes CertiK had already recorded $1.28 billion in crypto losses in the third quarter of 2026, up nearly 56% from the prior quarter, before this incident.

For context, flows into US spot bitcoin ETFs were modestly positive going into the hack. BlockBeats, citing Farside Investors, reported a net inflow of $17.2 million on October 29, while US spot ether ETFs saw a net outflow of $105.5 million. The theft began at 20:05 UTC, after the US equity close, so Friday's flow data will be the first ETF read that reflects the news.

Is Binance solvent, and what to watch next

The early read from analysts is that this is a painful loss, not an existential one. Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, told CNBC the incident "does not currently appear to create meaningful solvency risk for Binance." He estimated about $3.3 billion remains unfrozen, and said Binance's SAFU emergency fund, worth approximately $1.2 billion, could cover roughly a third of that, with the rest coming from the exchange's own funds. For scale, the BBC notes Binance said in 2024 that it had more than $160 billion in assets under custody.

Farrell's caveat is the one to track: "the key tell will be how quickly withdrawals resume and whether outflows stay orderly." A shortfall that forced Binance to sell reserves could spill into broader selling.

The milestones that matter over the next few days:

Withdrawals reopening: Binance has guided to within 48 hours of Yi He's 04:17 UTC update on October 30. Slippage beyond that window would be a negative signal.
The post-mortem: Binance has promised a detailed technical write-up. The key question is how an engineer's laptop could reach a service able to sign withdrawals across ten chains.
Proof of Reserves: Binance says it will publish an updated report once remediation is complete.
Laundering path: TRM expects the unfrozen ETH and BTC to move next through bridges, swap services and OTC brokers, and is monitoring the peel chain and consolidation wallets.
Recovery of frozen stablecoins: any court-ordered burn-and-reissue would shrink Binance's net loss.

What this means for investors

The practical lesson is old but newly urgent: assets on an exchange are only as safe as that exchange's operational security. Binance is pledging to make users whole, and analysts currently see no solvency threat, but its customers still cannot withdraw for up to two days. That is the real cost of custodial convenience, even when nothing is ultimately lost. If you are actively trading, keep only what you need on a platform. For long-term holdings, self-custody removes this specific risk, and our guides to the best Bitcoin wallets in 2026 and Ledger vs Trezor cover how to set one up properly, including backups.

Self-custody shifts the burden rather than eliminating it. Exchanges also lose funds through mundane operational failures, as our analysis of CoinDCX's $16M USDT loss from retired wallets showed, and individual wallets are attacked too. If you do use an exchange, compare how each one handles custody and security disclosures, which our Coinbase vs Kraken comparison walks through.

At the market level, the near-term picture is bearish: a record theft, $1.5 billion in liquidations, a bank research desk calling for more downside, and institutions pulling assets from exchanges. The medium-term signals are more mixed. Issuers froze roughly $2.7 billion within hours, which shows both the protective value and the centralized control built into today's dominant stablecoins. And if Binance reopens withdrawals on schedule and publishes a credible post-mortem and reserves report, the episode could end up as a stress test it survived. Until then, the safest assumption is volatility, and the most useful thing any individual can do is check where their own keys live.