The Binance hack of 29 October 2026 drained about $6.3 billion from the exchange’s hot wallets, according to Binance, in the largest crypto theft on record.
Last updated: October 2026
On 29 October 2026, attackers emptied Binance’s online wallets across ten blockchains. According to blockchain analytics firm TRM Labs, most of the funds left in about 20 minutes. Binance therefore paused withdrawals and, on 30 October, pledged to cover all user losses.
TRM Labs and Chainalysis call it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. However, many questions remain open. As of 30 October, Binance had not published a root cause or confirmed who was behind the attack.
What happened in the Binance hack?
Attackers drained Binance’s hot wallets on the evening of 29 October 2026, starting at 20:05 UTC. Hot wallets are the internet-connected wallets an exchange uses to process withdrawals. According to TRM Labs, the funds left ten blockchains, and almost all of them moved in about 20 minutes.
The preparation, however, began at least 36 hours earlier. On 28 October, the attacker’s wallet received three small withdrawals from Tornado Cash, a service that hides where crypto comes from, according to TRM Labs. Shortly after 23:00 UTC on 29 October, a second wave also hit Binance wallets on Avalanche and Polygon.
That evening, Binance founder Changpeng Zhao said on X that the exchange had likely been hacked, according to TechCrunch. Soon after, Binance confirmed a security incident to the outlet and paused withdrawals on several networks.
How much was stolen from Binance?
Binance estimates the impact at about $6.3 billion, while TRM Labs puts it at $6.36 billion and Chainalysis at $6.4 billion. The figures differ because TRM Labs values each asset at the time of transfer. At 30 October prices, for example, the same haul was worth about $6.23 billion, according to the firm.
| Blockchain | Assets taken | Estimated value |
| Ethereum | ETH, USDT and other tokens | $3.79 billion |
| Bitcoin | 18,270 BTC | $1.47 billion |
| Tron | USDT and TRX | $628 million |
| XRP Ledger | 233.46 million XRP | $296 million |
| Solana | Various tokens | $96 million |
| Arbitrum, Optimism and Base | Various tokens | $39 million |
| Avalanche | Various tokens | $28 million |
| Polygon | Various tokens | $10 million |
Source: TRM Labs, on-chain data as of 00:30 UTC, 30 October 2026.
Ethereum alone accounts for almost 60% of the total. That is why most on-chain investigations focus on that network.
How did the hackers get into Binance?
According to Binance, the attackers started from the compromised laptop of a DevOps engineer. From that computer, they sent unauthorised withdrawal requests through internal systems, the exchange told CoinDesk on 30 October. Binance also says it found no evidence that wallet private keys leaked. Later, however, it reported further points of entry without describing them.
TRM Labs adds a technical detail. On Ethereum, the attacker used EIP-7702, a feature introduced in May 2025 that lets a wallet run smart contract code. As a result, Binance’s hot wallet ran an attacker-controlled contract that swept its entire balance in about three and a half minutes.
On the other nine networks, instead, the transfers were ordinary signed transactions. For this reason, TRM Labs believes the hot wallet signing infrastructure was probably compromised, rather than a simple phishing case. As of 30 October, Binance had not published a final root-cause analysis.
Who is behind the Binance hack?
According to TRM Labs and Chainalysis, TraderTraitor, a hacking group linked to North Korea, carried out the Binance hack. TRM Labs says it has high confidence and notes that the FBI previously tied the same group to the Bybit theft. Chainalysis chief executive Jonathan Levin also cited links to earlier attacks, according to CNBC.
The shared signs are threefold: initial funding through Tornado Cash, a long staging period and signatures gathered in advance. Binance, however, has not commented on who the attackers are. The exchange says it is working with law enforcement, according to Al Jazeera.
How much of the stolen crypto has been frozen?
Partners have frozen about $3 billion, according to Binance’s 30 October update. Stablecoin issuers can freeze the tokens they control. In TRM Labs’ first estimate, Tether froze about $1.77 billion in USDT and Circle about $825 million in USDC. Ripple, World Liberty Financial and the Arbitrum Security Council also helped.
The rest is harder to recover. TRM Labs estimates that the attacker still controls about $2.4 billion, including more than 420,000 ETH and 18,270 BTC. The attacker has already swapped part of the USDT for ETH on decentralised exchanges. Other funds went through Aave, a lending protocol in decentralised finance, which froze the affected markets. Next, TRM Labs expects the attacker to use cross-chain bridges and OTC brokers.
Will Binance reimburse its users?
Yes, Binance has pledged to cover all losses with its own funds. According to CoinDesk, the exchange has set aside more than $6.34 billion, about $5 billion of it already held in the affected tokens. It is buying the rest on the market. Binance will also draw on SAFU, its emergency fund for users.
“User funds are safe,” co-founder Yi He wrote on X, according to Axios. As of 30 October, withdrawals remain paused, while deposits still work. Yi He also expects withdrawals to resume by Sunday 1 November, according to Bloomberg.
Sean Farrell, head of digital asset strategy at Fundstrat, said the attack does not appear to pose a solvency risk, according to CNBC. Before the theft, in fact, Binance held about $144 billion in assets, according to DefiLlama data cited by CoinDesk.
How did the Binance hack affect crypto markets?
Bitcoin fell between 4% and 5% after the Binance hack, trading around $77,000 to $78,000 on 30 October, according to CNBC and Al Jazeera. On the same day, Polymarket also reported a breach at a third-party provider, with losses under $3 million, according to CoinDesk.
Axios places the attack in a month of back-to-back cyber incidents dubbed “Black October”. In the same month, for example, INT News covered the French supermarket fridge hack.
The case also shows a limit of centralised exchanges: the more funds they hold, the bigger the target. Star Xu, founder of the OKX exchange, called for shared security standards across the industry, according to CoinDesk.
What is still unknown about the attack?
- How the attackers really got in. Binance points to an engineer’s laptop, but it found further entry points and has not published a final analysis.
- Who did it. The North Korea attribution comes from TRM Labs and Chainalysis, while Binance has not confirmed it.
- How much will be recovered. About $3 billion is frozen, but about $2.4 billion remains with the attacker, according to TRM Labs.
- When withdrawals will resume. The Sunday 1 November date is a forecast by Yi He, not a formal commitment.
Frequently asked questions
About $6.3 billion according to Binance, and $6.36 billion according to TRM Labs. Analytics firms call it the largest crypto theft on record.
Binance says yes. The exchange has set aside more than $6.34 billion of its own funds to cover every loss.
TRM Labs and Chainalysis point to TraderTraitor, a group linked to North Korea. As of 30 October 2026, Binance had not confirmed this.
According to the exchange, through an engineer’s compromised computer. TRM Labs also suspects access to the system that signs transactions.
Co-founder Yi He expects them to resume by Sunday 1 November 2026, according to Bloomberg. Meanwhile, deposits remain open.
Sources
- TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, 29 October 2026
- CoinDesk, Binance arranges $6.34 billion to cover losses from record crypto hack, 30 October 2026
- CoinDesk, Binance loses over $6 billion in the largest crypto hack to date, 29 October 2026
- CNBC, Binance’s $6.3 billion hack: What we know and what comes next, 30 October 2026
- Bloomberg, Binance Estimates $6.3 Billion Hacked in Crypto’s Biggest Heist, 29 October 2026
- TechCrunch, Binance pauses withdrawals as hackers suspected of stealing billions in crypto, 29 October 2026
- Al Jazeera, Binance says $6.3bn stolen in biggest crypto heist in history, 30 October 2026
- Axios, Binance halts trading after biggest-ever crypto hack, 29 October 2026
