Binance, the world’s largest cryptocurrency exchange, has suffered the biggest crypto theft in history. Hackers stole an estimated $6.3 billion in digital assets on Thursday, October 29, 2026, in a breach that dwarfs every previous crypto hack — and investigators are pointing the finger at North Korea.
Binance says it will cover all losses and that user funds are safe, while around $3 billion of the stolen crypto has already been frozen. Here is everything we know so far about the Binance cyber attack, how it happened, and what it means for crypto users.
What Happened in the Binance Hack?
On Thursday, October 29, 2026, attackers drained billions of dollars worth of cryptocurrency from wallets held at Binance. The exchange estimated the total impact at around $6.3 billion in stolen assets, making it the largest crypto heist ever recorded.
The previous record was the $1.5 billion hack of rival exchange Bybit in February 2025 — an attack that was also linked to North Korea. The Binance breach is more than four times larger.
According to blockchain analytics firm Arkham Intelligence, the hacker’s wallets at one point held more than $5.7 billion in stolen crypto, including nearly $1.5 billion in Bitcoin (BTC), around $900 million in Ether (ETH), roughly $1.5 billion in USDT and over $800 million in USDC stablecoins.
Blockchain analytics firm Chainalysis later updated its own estimate of the amount stolen to roughly $5.9 billion at the time of the theft.
How Did the Hackers Break Into Binance?
Binance’s initial investigation suggests the attack began with a compromised laptop belonging to a DevOps engineer. In the exchange’s own words, this “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”
Importantly, Binance said it has found no evidence of any wallet private key leak — meaning the attackers did not steal the master keys to the wallets, but instead abused internal systems to push through fake withdrawals.
On-chain data shows the attack moved fast. Etherscan records show 167,464 ETH moving out of a wallet labelled “Binance 14” at 20:24 UTC (4:24 pm ET), followed by 28,005.6 ETH from “Binance 16”, both into the attacker’s wallet. Nearly 15 minutes later, around 195,460 ETH — worth roughly $442 million — was sent onward to a second address.
CoinDesk’s review of Binance’s own reserve data found that the attacker used an Ethereum feature called EIP-7702, which lets a wallet hand control to a piece of software. After getting the Binance 14 wallet to sign that permission, the attacker effectively turned it into a “sweeper” that forwarded incoming funds to their own address.
The wallets emptied in the attack are the same wallets Binance lists in its monthly proof of reserves as evidence that customer crypto is fully backed. On October 1, Binance 14 alone held 1.26 billion USDT and 89,475 ETH, among 37 assets.
$3 Billion Frozen: The Race to Stop the Hackers
As soon as the breach was detected, Binance and its partners launched a frantic effort to freeze the stolen funds before the attackers could cash them out — and around $3 billion has already been frozen.
The breakdown of the frozen funds so far includes:
- Tether froze over $1.57 billion in USDT linked to the hack, according to CEO Paolo Ardoino.
- Circle froze more than $800 million in USDC (around $823 million, according to Binance founder Changpeng Zhao), in coordination with law enforcement.
- Ripple froze roughly $200 million in funds.
- World Liberty Financial, the crypto company linked to US President Donald Trump and his family, worked with custodian BitGo to freeze $27 million in stablecoins and about $2 million worth of its own tokens.
Binance said the frozen amount could still increase as it works with law enforcement agencies, token issuers, blockchain intelligence firms and other industry partners to trace and freeze additional assets.
However, the attackers have been moving fast too. Arkham data shows the wallet linked to the exploit moving assets through decentralized exchange Uniswap, and the exploiter borrowed at least 20,000 wrapped ether (WETH), worth around $44 million, through decentralized lender Aave, using stolen USDT as collateral.
After a major theft, attackers typically try to swap freezable assets like USDT and USDC for cryptocurrencies that no central issuer can block — which is why the race between freezing and laundering is so urgent.
Are Binance User Funds Safe?
Binance has repeatedly reassured customers that their money is safe. Co-CEO Yi He said in a post on X that the platform would cover “all hacking losses”, and Binance said it will pay from its Secure Asset Fund for Users (SAFU) and company funds.
SAFU was established in 2018 to protect customers during security breaches and emergencies, and holds roughly $1 billion in Bitcoin. Binance held roughly $144 billion in assets on its platform before the hack, according to DefiLlama data, so the stolen funds amount to approximately 4% of those holdings.
Founder Changpeng Zhao, who no longer manages the platform but remains its largest shareholder, also weighed in on X: “It does look like a hack on Binance… I don’t manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered.”
There is one caveat worth noting. Because the stolen wallets backed customer balances, Binance’s reserves took a hit: on October 1, Binance held exactly enough ETH to cover customers (a 100% reserve ratio), but the roughly 204,500 ETH taken represents about 5.6% of its ETH reserves, leaving ETH backing near 94%. The exchange’s next reserve snapshot, due on November 1, will show whether it has already replaced the missing assets.
For now, Binance has temporarily suspended deposits and withdrawals while security checks are completed, revoked the affected address authorization, and suspended trading on its Binance Alpha platform as a precaution. Withdrawals will resume once the security issue is fully resolved, the exchange says. Binance.US, a separate exchange, said it was not affected by the incident.
Who Is Behind the Binance Hack?
Multiple blockchain intelligence firms believe the attack was carried out by North Korea. TRM Labs said it has traced the attack to “TraderTraitor,” an elite North Korean hacking group, citing blockchain transactions and other intelligence, and said it has “high confidence” in its assessment.
Blockaid CEO Ido Ben-Natan told CoinDesk that “the tactics and level of sophistication we’ve seen so far are consistent with the kinds of operations we’ve seen from DPRK,” referring to North Korea. Prominent blockchain investigator ZachXBT pointed to the Lazarus Group, the state-backed hacking unit known for stealing cryptocurrency, as the “likely attacker.”
CNN also reported that multiple investigators pointed the finger at North Korea, and said it had requested comment from the FBI and the US Secret Service. It is important to note that this attribution comes from investigators’ analysis, not from an official confirmation by Binance or law enforcement — but if confirmed, it would fit a long pattern of North Korean crypto thefts used to fund the regime.
Market Impact: Bitcoin and Crypto Prices Crash
The news sent shockwaves through crypto markets. Bitcoin dropped 4.8% to below $77,000, briefly falling toward $76,000, while Ether fell 5.7% to around $2,231. BNB, the native token of the Binance-linked BNB Chain, dropped 8% to about $716, and AAVE fell 11%.
More than $1 billion worth of leveraged futures bets were liquidated as prices plunged. Standard Chartered warned that cryptocurrency prices could fall further until more details about the breach emerge and frozen assets are released. By midday Friday in Hong Kong, Bitcoin and Ether had regained some losses but were still trading about 2–3% lower.
Some analysts say the incident could eventually push more traders toward decentralized exchanges, where users hold their own assets rather than trusting a central platform.
A Bad Day for Crypto — Twice
The Binance hack was actually the second major crypto security incident on the same day. Earlier on Thursday, prediction market provider Polymarket announced that one of its third-party providers had been breached, with hackers draining more than $2.6 million from user accounts, forcing Polymarket to temporarily suspend international trading.
The two incidents are unrelated, but together they underline how rough 2026 has been for crypto security. Last year alone, attackers stole $2.9 billion worth of cryptocurrency across nearly 150 attacks, according to TRM Labs.
What Happens Next?
Several things are now being watched closely:
- Withdrawals: When Binance reopens deposits and withdrawals, and whether the reopening goes smoothly.
- Recovery: How much more of the stolen $6.3 billion can be frozen or recovered through law enforcement and industry cooperation.
- Reserves: Binance’s November 1 proof-of-reserves snapshot, which will show whether the missing assets have been replaced.
- Attribution: Whether US authorities formally confirm North Korean involvement, which could trigger sanctions and further action.
- Regulation: Whether the largest hack in history accelerates calls for tougher security and reserve rules for crypto exchanges worldwide.
For crypto users, the incident is a reminder of an old lesson: exchanges can be hacked, no matter how large. Keeping significant holdings in a personal wallet — rather than leaving everything on an exchange — remains the safest practice, and users should be extra cautious about phishing attempts and fake “support” messages that typically surge after a major hack.
FAQs
How much was stolen in the Binance hack?
Binance estimated the total impact at around $6.3 billion, with about $3 billion frozen so far. Chainalysis estimated roughly $5.9 billion stolen at the time of the theft.
Is this the largest crypto hack ever?
Yes. It surpasses the $1.5 billion Bybit hack of February 2025, the previous record.
Are Binance users going to lose their money?
Binance says no — it has pledged to cover all hacking losses from its SAFU emergency fund and company funds, and says user funds are safe.
Who hacked Binance?
Investigators including TRM Labs, Blockaid and ZachXBT believe a North Korean hacking unit (TraderTraitor / Lazarus Group) was behind the attack, though this has not been officially confirmed by law enforcement.
Can I withdraw from Binance right now?
Deposits and withdrawals are temporarily suspended while Binance completes security checks. The exchange says they will resume once the issue is fully resolved.
Disclaimer: This article is based on reports from CoinDesk, CNN and Reuters as of October 30, 2026. Figures for stolen and frozen amounts are still developing and may change as the investigation continues. This is not financial advice.
