$6.3 billion gone in minutes: Binance hit by the biggest crypto heist ever

On the evening of October 29, attackers emptied Binance’s internet-connected wallets on ten blockchains, most of it within about 20 minutes.² Binance, the world’s largest crypto exchange, puts the damage at around $6.3 billion, which makes it the biggest crypto theft on record, about four times the $1.5 billion stolen from Bybit in February 2025.^{1, 2} Binance says user funds are safe and that it will cover all losses.¹

Updated October 31, 2026, 23:39 UTC: FBI attribution, asset replenishment and proof-of-reserves timeline.

Too long; didn’t read?

• About $6.3 billion in crypto was taken from Binance’s “hot” wallets on October 29. Blockchain analysts put it at $6.36 billion (TRM Labs) to $6.43 billion (Elliptic).^{1, 2, 3}
• Binance first pointed to a hacked engineer’s laptop and has since found more points of breach. It says no wallet private keys leaked.^{1, 15}
• Around $3 billion has been frozen, almost all of it in stablecoins. The rest is being swapped into assets nobody can freeze.^{1, 3}
• The FBI now attributes the theft to North Korea’s TraderTraitor activity. This October 31 announcement follows the earlier assessments by private blockchain analytics firms.¹⁶
• Binance says withdrawals are expected to resume Sunday, November 1. The arrangements are still awaiting confirmation; this remains a target, not a confirmed reopening.¹⁷

What happened

A “hot” wallet is a wallet connected to the internet that an exchange uses to pay out customer withdrawals.² At 20:05 UTC on October 29, five Binance wallets on the XRP Ledger sent 233 million XRP to a single address. Within minutes, Binance wallets on Solana, Optimism, Bitcoin, Tron and Ethereum followed. At 20:20 UTC a Binance Bitcoin hot wallet sent 18,270 bitcoin, about $1.47 billion, and a Tron wallet sent 612.7 million USDT, a dollar-pegged “stablecoin”.² A second wave hit Binance wallets on Avalanche and Polygon around 23:05 UTC.²

The biggest single loss was on Ethereum. The attackers used EIP-7702, a 2025 Ethereum feature that lets an ordinary wallet hand control to a piece of code. With 50 approvals signed in advance by a Binance hot wallet, they made that wallet obey a “sweeper” program only they could command. Its first sweep moved 167,464 ETH and 1.615 billion USDT, and it kept emptying new funds that arrived over the following hours.²

The theft was planned. TRM Labs found that preparation began at least 36 hours earlier, when the attackers’ wallet was funded through the Tornado Cash mixer, and that the attack code was rehearsed on test wallets about four hours before it was used against Binance.²

How the attackers got in

Binance said its initial investigation “suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions”. It said it found “no evidence of any wallet private key leak” and promised a detailed technical report.¹ Co-CEO Richard Teng later said it was “a more complex attack process”, not a single “one-click” action, and that the investigation “has not attributed responsibility to any individual”.⁴ In a statement posted on X on October 30, Teng said the attacker “used a self-destruct mechanism that destroyed tooling and traces as they went”, and that the Ethereum delegation “did not pass through our normal approval controls”.¹⁴ In a second written update later that day, Binance said its “subsequent investigation has uncovered additional points of breach”, that it has still “found no evidence that wallet private keys were leaked”, and that it expects to share further technical findings within about 48 hours.¹⁵

Analysts reach a similar picture from the blockchain data. Wallets on ten different networks, with different key types, all signed transfers to the attacker within about half an hour. TRM Labs’ assessment is that the attacker gained the ability to make Binance’s own signing system approve transactions of its choosing, rather than stealing the keys themselves.² Elliptic notes the resemblance to the Bybit theft, where hackers compromised a developer’s computer: in both cases “it was the infrastructure and people around the wallets that were compromised, not the cryptography”.³

Who the FBI identifies

On October 31, the FBI attributed the theft of more than $6 billion from Binance to North Korea, identifying the activity as TraderTraitor. It says the group has been converting stolen assets primarily into ether and is expected to continue laundering them through decentralized finance and instant-swap services.¹⁶

The FBI, US Secret Service and IRS Criminal Investigation have asked relevant cryptocurrency infrastructure providers to block transactions involving the listed addresses or funds derived from them. This is now an official US attribution, updating the private-sector assessments reported in our October 30 coverage.¹⁶

The other big hack: Bitget

A month earlier, on September 24, the exchange Bitget saw unauthorized transfers from its hot wallets on seven blockchains.⁹ Its final verified figure is about $388 million. Bitget says the attackers used a zero-day flaw, a weakness nobody had patched yet, in a third-party security product to obtain high-level internal credentials, then sent forged withdrawal commands to its wallet system. It says private keys were not compromised, and it finished reopening withdrawals on October 2.⁸ Bitget’s protection fund covered the loss, and CEO Gracy Chen blamed North Korean hackers.^{9, 10}

The two cases now look connected. Elliptic has confirmed that funds stolen from Binance are being laundered alongside the proceeds of the Bitget exploit, combined in several wallets. On-chain investigator ZachXBT, who first reported the link, said it “indicates the same actor is likely behind both incidents”.^{3, 4} Elliptic adds that only a small share of the Binance funds has been mixed in so far, and that laundering networks can serve more than one client, so the link “does not prove that the same hacker carried out both thefts”.³

Smaller attacks the same month

• Initia, October 23: a flaw in the blockchain network’s software let an attacker create fake balances and move about $2.7 million out before Initia paused the network.¹¹
• Polymarket, October 29: the prediction market briefly halted trading after a third-party company it uses was compromised; security researchers said around $2 million in user funds was stolen.⁶

The October 30 tracing picture

Stablecoins can be frozen by the companies that issue them, and that is where the response focused. Tether froze its first attacker wallet 37 minutes after the main theft, and Circle, Ripple, World Liberty Financial, Paxos and First Digital froze more. Elliptic has verified $2.84 billion frozen on-chain, close to Binance’s figure of about $3 billion.^{1, 3}

Bitcoin and ether have no issuer, so nobody can freeze them. The attackers rushed to swap stablecoins into ether, accepting losses of 12% to 26% to move faster, according to Elliptic.³ In its October 30 update, Elliptic said the attacker controlled around $3.23 billion that no issuer can freeze, including 519,104 ETH and 18,270 bitcoin. The bitcoin has been split across 19 addresses but not yet sent to any service, and on October 30 the attacker began moving funds between blockchains.³ A freeze is not the same as getting money back: returning it needs a legal process, and Chainalysis’s head of research told CNBC that “returning funds can take months or years”.⁵

What it means for Binance users

In its October 31 update, Binance says it has replenished approximately 90% of the affected assets, up from 80%. It says ten major tokens are fully backed and is buying the remaining, less-liquid tokens using company funds and portions of its SAFU and Futures Insurance funds. These are replacement purchases; the figure does not mean 90% of the stolen crypto has been recovered.¹⁷

Binance says it published a proof-of-reserves snapshot taken at 00:00 UTC on October 31. The complete zero-knowledge proof, which would let users verify the stated backing, is expected November 3 UTC. That updates the earlier November 2 timeline. The company still expects withdrawals to resume Sunday, November 1, with specific arrangements to be announced.¹⁷

What you can do

1. Don’t rush. Binance says user funds are safe and that it will cover all losses. Wait for withdrawals to reopen in the official app or website rather than acting on rumours.¹
2. Treat every “Binance” message with suspicion. Binance warned users to “remain cautious of scams” and not to trust “unofficial links, messages, or requests for account information”. Expect fake refund, compensation and “verify your account” emails, texts and calls.⁶ Binance’s own security page says even messages that look official can be spoofed, and suggests checking them with its Binance Verify tool.¹³
3. Turn on Binance’s anti-phishing code. Once it’s set, the code appears in every genuine email from Binance, so an email without it did not come from Binance.¹²
4. Lock down withdrawals and your email. Binance’s withdrawal address whitelist only lets your account send crypto to addresses you approved in advance. Binance also recommends two-factor authentication on the email account linked to Binance.¹²
5. Remember what an exchange is. Coins left on any exchange are held by that company. This time Binance says it will pay, and Bitget covered its loss too, but not every platform can.^{1, 9}

Sources

1. Binance announcement: Security Incident Update (2026-10-30), updated October 30, 2026
2. TRM Labs: North Korea steals USD 6.36 billion from Binance in the largest hack in history
3. Elliptic, updated October 30, 2026, 19:30 UTC: The largest theft in history: North Korea likely behind the $6.4 billion Binance hack
4. Cointelegraph live updates: Binance losses estimated at $6.3B amid major crypto hack
5. CNBC, October 30, 2026: Binance’s $6.3 billion hack: what we know and what comes next
6. TechCrunch, October 29, 2026: Binance pauses withdrawals as hackers suspected of stealing billions in crypto
7. Reuters (via StreetInsider), October 30, 2026: FBI and US Secret Service working with Binance after $6.3 billion hack, source says
8. Bitget: Security incident, what happened, timeline, impact and response
9. BleepingComputer: Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
10. The Hacker News, September 2026: Bitget says suspected North Korean hackers stole $351.6M after backend compromise
11. TokenPost: Initia says MoveVM flaw enabled about $2.7M in transfers
12. Binance support: Securing your trading account
13. Binance support: Account security tips
14. Richard Teng on X, October 30, 2026: statement on the hack, withdrawals and proof of reserves
15. Binance announcement: Security Incident Update #2 (2026-10-30), published October 30, 2026
16. FBI: North Korea Responsible for $6 Billion+ Binance Attack, October 31, 2026
17. Binance: Approximately 90% of affected assets replenished and proof-of-reserves snapshot published, October 31, 2026