Binance Hack: $6.3 Billion Stolen in the Largest Crypto Theft Ever, and What We Know So Far

The Binance hack began on Thursday evening, October 29, 2026, at about 8:05 p.m. UTC (1:35 a.m. on Friday in India), when wallets belonging to Binance, the world's largest crypto exchange by trading volume, began emptying. Within roughly 20 minutes, most of the money was gone. Binance now puts the total estimated impact at about $6.3 billion. Blockchain analysts say it is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

This is a fast-moving story, and early numbers have already changed several times. In this article I've kept every figure tied to the organization that published it, and I've flagged where sources disagree. Here's what's covered:

• what Binance has confirmed, and what it hasn't

• a minute-by-minute timeline built from blockchain analysis

• how one Ethereum feature, EIP-7702, was used to drain about $2.5 billion in minutes

• who froze what, and why roughly half the money is still out of reach

• who investigators blame, and how sure they are

• what Binance users and crypto engineering teams should actually do now

Everything below reflects reporting and statements available by the evening of October 30, 2026, India time.

The Binance hack in numbers

The headline figure depends on who's counting and when. These numbers measure slightly different things, so they shouldn't be mixed up:

The short version: about $6.3 billion left Binance's wallets, roughly $3 billion is frozen, and around $2.4 billion to $3 billion is still in the attacker's hands.

What Binance has confirmed so far

Binance's first statement, posted late on Thursday, said its "initial investigation suggests a compromised DevOps engineer's laptop may have enabled an attacker" to reach a service container and submit unauthorized withdrawal transactions. It added: "We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified."

By Friday, the story had grown more complicated. Binance said on X that its "subsequent investigation has uncovered additional points of breach," without saying what they were. Co-CEO Richard Teng wrote that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action." He also said, "Our investigation has not attributed responsibility to any individual." In a post on X, Binance called it "a complex attack."

Here's where things stand on the main questions, based on Binance's own statements:

• User balances: Binance says "user funds are safe." Teng wrote, "your money is safe, and we're covering every loss." AFP reports that customers' account balances haven't been touched, but they can't move funds off the platform while withdrawals are suspended.

• Loss coverage: Binance says it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds. Binance's website describes SAFU as a $1 billion bitcoin reserve, according to Reuters.

• Deposits: Binance first suspended both deposits and withdrawals. It later said deposits were unaffected and operating normally.

• Withdrawals: These remain suspended during what Teng called "a security revamp of the withdrawal service and its related addresses." At about 09:00 GMT on Friday, Binance said it was on track to resume withdrawals in 45 hours, per AFP. Co-CEO Yi He said separately that withdrawals should resume within 48 hours. Both point to roughly Sunday, November 1, though neither is a guarantee.

• Next steps: Binance says it has revoked the affected address authorization, is working with law enforcement and blockchain intelligence firms, and will publish an updated proof of reserves once remediation is complete.

Binance.US, which operates separately, says it wasn't affected. Coinbase also said it was unaffected and was monitoring developments.

Timeline: how the Binance hack unfolded

This timeline comes mainly from TRM Labs' analysis, published on October 29 with on-chain figures as of 00:30 UTC on October 30, and CoinDesk's reconstruction. All times are UTC. Add 5 hours 30 minutes for India time.

October 28 (morning): The attacker's "operator" wallet received three small withdrawals from Tornado Cash, a crypto mixing service. TRM says preparation began at least 36 hours before the theft.

October 29 (early): The attacker deployed and tested the attack code on two wallets, then rehearsed the final version on a third.

October 29, about 16:00: The attacker deployed a "sweeper" smart contract that only their own wallet could operate, according to CoinDesk.

20:05 to 20:09: Five Binance wallets on the XRP Ledger sent 233.46 million XRP to one attacker address.

After 20:10: Binance wallets on Solana and Optimism began moving funds.

20:20: A Binance bitcoin hot wallet sent 18,270 BTC. In the same minute, one Ethereum transaction delivered 50 pre-signed EIP-7702 authorizations for a Binance hot wallet labeled "Binance 14."

By about 20:22: A Binance Tron hot wallet sent 612.7 million USDT and 46.4 million TRX.

20:24:23: The sweeper contract emptied Binance 14: about 167,464 ETH and 63 tokens, including roughly 1.615 billion USDT. That's about $2.5 billion in one transaction.

21:01 and 21:04: Tether and Circle froze stablecoins in the main receiving wallet, 37 and 40 minutes after the main sweep.

20:41 to 23:56: The attacker ran at least six follow-on sweeps on Ethereum, including customer deposits that Binance's systems kept routing into Binance 14.

About 23:05: A second wave hit Binance wallets on Avalanche and Polygon.

October 30, 00:10:35: Binance 14 revoked the malicious delegation, ending roughly four hours of exposure, according to CoinDesk.

Where the money came from: losses by blockchain

TRM Labs broke the theft down by network. Ethereum alone accounted for well over half:

Blockchain data firm Bitquery counted nine chains and about $6.32 billion, with slightly different per-chain figures. The differences come from how firms count networks and which prices they use, not from conflicting evidence.

How EIP-7702 turned a Binance wallet against itself

The most technically interesting part of the Binance hack happened on Ethereum. It used EIP-7702, a feature added in Ethereum's Pectra upgrade in May 2025.

In simple terms, EIP-7702 lets an ordinary wallet temporarily run smart-contract code. (If you're new to how blockchains secure data, our guide to SHA-256 and how hashing works covers the basics.) The wallet owner signs an "authorization" that points the wallet at a contract. It was designed for convenience, such as bundling several transfers into one transaction. But as CoinDesk explains, an authorization sets which code runs, not who gets paid or how much. And it stays valid until it's replaced or cancelled on-chain.

Here's how the attacker used it, according to TRM Labs, CoinDesk and the security firm Blockaid:

1. Fifty signatures, one target. The attacker had 50 valid EIP-7702 authorizations signed by Binance 14, each pointing the wallet at the attacker's sweeper contract.

2. A nonce trick. Every Ethereum transaction carries a sequence number called a nonce. The 50 authorizations covered 50 consecutive nonces, from 18,914,775 to 18,914,824. That guaranteed one would match the wallet's current nonce whatever it was. The network accepted nonce 18,914,809 and ignored the other 49.

3. The sweep. About three and a half minutes later, the attacker called the sweeper through Binance 14 and moved the wallet's entire balance out.

4. A trap for new deposits. Because the delegation stayed active, every new deposit Binance routed into that wallet could be swept again. The attacker did this several times over the next few hours.

5. A second wallet pulled in. TRM says the attacker also used Binance 14's delegated code to direct a separate Binance smart account, pulling 823 million USDC.

So how did the attacker get 50 signatures from Binance's own wallet if no private key leaked? Binance hasn't said. TRM Labs points out that the other nine chains don't use EIP-7702, and the transfers there were ordinary signed transactions from multiple wallets with different key types and signing schemes, all within about half an hour. TRM's assessment is that the evidence "points to a compromise of Binance's hot wallet signing infrastructure."

Jayant Dave of Check Point, quoted by FinanceFeeds, put it simply: "The attackers didn't break the encryption or steal the private keys." Instead, he said, they "took over the system that tells the keys what to sign." That would fit with Binance's statement that it found no evidence of a key leak, but it's an outside expert's interpretation, not a confirmed finding. Only Binance's promised post-mortem can settle it.

Who froze what

Stablecoins are the reason about half the money is frozen. Issuers like Tether and Circle can block their tokens at specific addresses. Native coins like bitcoin and ether have no central issuer, so nobody can freeze them on-chain.

Don't add these to Binance's $3 billion figure. Binance's total already includes them, and early figures changed through the night. In an early post on X, Binance founder Changpeng Zhao gave Tether's freeze as about $971 million. TRM's data shows Tether's first freeze was 971.1 million USDT at 21:01 UTC, and later freezes raised the total.

One detail shows how hard the attacker worked against the freezes. TRM says they sold about 325 million USDT through UniswapX and other intent-based trading systems for about 122,300 ETH. That's a price of about $2,650 per ETH when the market was around $2,300 to $2,350. They paid a premium of more than 10% just to turn freezable stablecoins into unfreezable ether.

Who's behind the Binance hack: North Korea's TraderTraitor

Several blockchain analysis firms have pointed at North Korea:

• TRM Labs attributes the attack "with high confidence" to TraderTraitor, a North Korean hacking unit, "based on robust on- and off-chain intelligence."

• Chainalysis said it had a "high degree of confidence" in the same attribution.

• Elliptic also linked the theft to North Korea-linked hackers, according to CoinDesk and Yahoo Finance.

TRM's reasoning includes patterns it saw in the February 2025 Bybit hack, which the FBI attributed to TraderTraitor, and in the April 2026 KelpDAO hack: small Tornado Cash withdrawals to fund an operator wallet, staging well before the theft, and pre-obtained signatures executed in one burst. TRM also noted a difference. The laundering so far has relied on big swaps and lending, rather than the bridge-heavy pattern seen after Bybit.

Some caveats are important. These are attributions by private firms, not a government finding. Binance says it hasn't identified the attackers and hasn't attributed responsibility to any individual. North Korea routinely denies involvement in such attacks, Reuters notes. AFP reports that TraderTraitor is believed to be part of the Lazarus Group.

If the attribution holds, it fits a long pattern. TRM's Ari Redbord said North Korea has stolen about $6 billion from crypto over five years, according to Inc. By TRM's count, hackers stole about $2.9 billion across nearly 150 incidents in 2025. This single attack is larger than that whole year.

Can the stolen money be recovered?

Freezing and recovering are two different things. TRM's Ari Redbord said recovery requires a separate legal process, potentially involving court orders and coordination with token issuers.

For the money that isn't frozen, the outlook is harder. Patrick Tan of ChainArgos told Reuters that bitcoin and ether can only be stopped if the attacker sends them to an exchange or broker willing to freeze them, or if law enforcement gets the private keys. As of Friday morning, Arkham's data showed the attacker's entity holding about 18,270 BTC, 488,364 ETH, 663.6 million TRX and 970,551 SOL.

The attacker had started moving funds. Arkham saw $38.82 million in ETH sent to a new address early on Friday, and Bitquery saw Tron funds split into dozens of small lots. TRM expects the next stage to involve cross-chain bridges, swap services and over-the-counter brokers. Chainalysis told Reuters it had seen "unprecedented" laundering patterns, with thousands of transactions suggesting automation. It also said funds stolen from the exchange Bitget last month were being mixed with the Binance proceeds.

Can Binance cover a $6.3 billion loss?

This is the question every Binance user is asking. Here's what's known:

• The SAFU fund holds about $1 billion in bitcoin, according to Binance's website as cited by Reuters and CoinDesk.

• About $3 billion is frozen. If it's eventually returned, that would cover close to half of the impact.

• Changpeng Zhao said he no longer manages Binance.com, but as a shareholder he expects all user funds to be fully covered. Inc. reports he called the remaining gap of roughly $2 billion "(still painful, but) manageable."

• Fundstrat's Sean Farrell told CNBC the breach didn't currently appear to be a significant solvency threat, partly depending on recovering frozen assets and Binance absorbing the rest.

• Binance's 2025 annual report listed about $162.8 billion in assets under custody and 335 million registered users, according to Electronic Payments International.

CoinDesk compared the stolen amounts with Binance's October 1 proof-of-reserves report. That report showed Binance holding 100% of customers' ETH. By CoinDesk's estimate, the roughly 204,500 ETH taken was about 5.6% of Binance's ETH reserves, which would leave ETH backing near 94% until it's replaced. That's CoinDesk's own calculation, not a Binance figure. Binance's next reserve snapshot is scheduled for November 1, and it should show whether the stolen assets have been replaced.

Market reaction to the Binance hack

The news hit crypto prices during Asian trading on Friday:

• Bitcoin fell more than 3% to $76,368, its lowest level in six weeks, according to Reuters.

• Ether fell more than 3% to $2,178, a two-month low.

• BNB, Binance's own token, fell about 5% over 24 hours to $709.70, per CoinGecko data cited by Reuters.

• Crypto stocks fell too. Shares of Circle, Coinbase, Robinhood and Strategy each lost 8% to 14% by mid-morning in New York on Friday, according to Yahoo Finance.

Tim Sun, a researcher at HashKey Group, told Reuters the incident may dampen risk appetite and lead investors to reassess the safety of assets held on centralized exchanges.

Watch the news report

This short news report summarizes the breach, the freezes and the market reaction. It also explains why freezing stolen crypto is very different from returning it to users.

What Binance users should do now

You can't change what happened, but you can avoid making it worse:

1. Check which exchange you use. Binance.US is a separate company and says it wasn't affected. Don't assume an incident at Binance.com applies to your account, or the reverse.

2. Use only official channels. Binance has urged users to avoid unofficial links and to get information only from its verified accounts. Big hacks are always followed by fake "refund" pages, fake support agents and phishing emails. Genuine support staff won't ask for your password, 2FA codes or seed phrase.

3. Ignore "recovery" offers. Anyone promising to get your funds out early, or to recover them for a fee, is almost certainly running a scam.

4. Plan around the pause. If a payment, trade or business process depends on withdrawing from Binance, treat it as on hold until Binance officially announces that withdrawals have resumed. A new freeze announcement doesn't mean withdrawals are back.

5. Watch the proof of reserves. Binance's November 1 snapshot and its promised post-mortem are the two documents that will show whether the gap has been filled and what really went wrong.

6. Remember the old rule. Crypto kept on any exchange is held by that exchange. For long-term holdings, many people use a hardware wallet bought directly from the manufacturer's official site.

Lessons from the Binance hack for engineering teams

The full attack path isn't public yet, so it's too early for confident conclusions. But the confirmed details already point to useful checks, several of them taken directly from TRM Labs' recommendations:

• Monitor EIP-7702 delegations on treasury wallets. A hot wallet's code changing from empty to a delegation pointer should page someone immediately. Keep a pre-approved way to revoke a delegation fast. Here, the malicious delegation stayed active for about four hours.

• Treat bulk authorizations as a red flag. A request for many authorizations across a range of nonces is a strong sign of compromise.

• Separate signing paths. TRM recommends separating signing infrastructure and approval paths by chain and wallet tier. In this case, a single compromise appears to have reached wallets on ten chains.

• Protect developer endpoints like production. Binance's first clue was a DevOps engineer's laptop. Whatever the final story, the lesson is the same: what matters is what a compromised laptop can reach and authorize. We covered similar risks in our look at AI agents as insider threats and in our breakdown of GhostAction phishing and OAuth exploits, where stolen developer credentials were the way in.

• Stop routing deposits into a compromised wallet. Binance's systems kept sending customer deposits to Binance 14 after it had been drained, and the attacker swept them again.

Blockaid says its automated monitoring flagged the drain less than two minutes after the sweep, and that the malicious delegation was visible on-chain 3 minutes and 24 seconds before it. That's a vendor's own claim, but it makes the key point. In an attack this fast, only automated detection with a pre-authorized response can react in time.

What we still don't know about the Binance hack

Several big questions remain open as of October 30:

• How the attacker got valid signatures from Binance's wallets without, as Binance says, leaking private keys

• What the "additional points of breach" are, and whether an insider was involved. Teng says the investigation hasn't attributed responsibility to any individual.

• The final loss. Binance says the $6.3 billion figure may still rise.

• When withdrawals will fully resume, beyond Binance's 45-hour and 48-hour estimates

• Whether frozen stablecoins will be returned, which depends on legal processes and the issuers

For a security-engineering view of the same incident, TrickyWorld has a detailed breakdown of why the Binance figures shouldn't be mixed up and what the paused transfers mean. Note that it was written before Binance said deposits were working again.

My take

Three things stand out to me.

First, this attack didn't break cryptography. If the analysts are right, the attackers took over the machinery that decides what Binance's keys sign. In crypto, the weakest point is rarely the math. It's the people, laptops and systems around the keys.

Second, the stablecoin freezes changed the outcome. Within about 40 minutes of the main sweep, Tether and Circle had frozen about $1.8 billion, and Elliptic says stablecoins make up nearly all of the frozen funds. Without centralized issuers able to freeze tokens, very little of the stolen money would be locked today. That's a striking point, given how often decentralization is sold as crypto's main feature.

Third, Binance's response so far has been fast and public: frozen funds, a loss-coverage pledge, a withdrawal timeline and a promised post-mortem. Whether that rebuilds trust depends on what comes next. Withdrawals need to resume as promised, the proof of reserves needs to show the gap filled, and the post-mortem needs to explain exactly how 50 signatures were obtained.

The bottom line

The Binance hack is the largest crypto theft on record. About $6.3 billion left Binance's hot wallets across ten blockchains, most of it in about 20 minutes, through an attack that analysts attribute with high confidence to North Korea's TraderTraitor group. About $3 billion is frozen, mainly stablecoins. Binance says user funds are safe, that it will cover every loss with SAFU and company funds, and that withdrawals should resume within about two days. Until Binance publishes its post-mortem and November proof of reserves, treat every other detail as provisional. We'll update this article as confirmed information arrives.

Sources:

• North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, TRM Labs, October 29, 2026

• Here's how an Ethereum upgrade helped drain part of Binance's $6 billion loss, CoinDesk, October 30, 2026

• Binance says customer money is safe after huge hack drains key reserve wallets, CoinDesk, October 30, 2026

• Explainer: Gone in 20 minutes: How the biggest heist in crypto history unfolded, Reuters via Investing.com, October 30, 2026

• Binance finds "additional points of breach" in $6.3B hack, Decrypt, October 30, 2026

• Binance hack: 11 keys signed, no leak says Teng, FinanceFeeds

• Binance's $6.3 billion hack: North Korea linked to record theft, CCN via Yahoo Finance

• Binance hit by record $6.3 billion crypto hack, likely linked to North Korea, Yahoo Finance

• Crypto platform Binance confirms "complex" $6.3 bn hack, AFP via Yahoo Finance

• Binance Just Suffered a $6.3 Billion Hack, the Largest in Crypto History, Inc.

• Binance hacked for an estimated $6.3 billion in record crypto theft, Engadget, citing The New York Times

• Binance hack: $6.3B drained on 9 chains, Bitquery

• Binance $5.5B hack: Blockaid detects the biggest theft in crypto history, Blockaid

• Binance reveals when it will resume withdrawals after historic hack, U.Today

• Binance security breach halts deposits and withdrawals, TrickyWorld, October 30, 2026

• Electronic Payments International and International Business Times reports, via Yahoo Finance, October 30, 2026