{"id":9966,"date":"2026-10-30T16:02:39","date_gmt":"2026-10-30T16:02:39","guid":{"rendered":"https:\/\/intnews.it\/?p=9966"},"modified":"2026-10-30T16:02:41","modified_gmt":"2026-10-30T16:02:41","slug":"binance-hack","status":"publish","type":"post","link":"https:\/\/intnews.it\/en\/binance-hack\/","title":{"rendered":"Binance hack: what happened in the $6.3 billion crypto theft"},"content":{"rendered":"\n
<\/div>\n\n\n\n

The Binance hack of 29 October 2026 drained about $6.3 billion from the exchange’s hot wallets, according to Binance, in the largest crypto theft on record.<\/p>\n\n\n\n

Last updated: October 2026<\/strong><\/p>\n\n\n\n

On 29 October 2026, attackers emptied Binance’s online wallets across ten blockchains. According to blockchain analytics firm TRM Labs, most of the funds left in about 20 minutes. Binance therefore paused withdrawals and, on 30 October, pledged to cover all user losses.<\/p>\n\n\n\n

TRM Labs and Chainalysis call it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. However, many questions remain open. As of 30 October, Binance had not published a root cause or confirmed who was behind the attack.<\/p>\n\n\n\n

<\/div>\n\n\n\n

What happened in the Binance hack?<\/h2>\n\n\n\n

Attackers drained Binance’s hot wallets on the evening of 29 October 2026, starting at 20:05 UTC. Hot wallets are the internet-connected wallets an exchange uses to process withdrawals. According to TRM Labs, the funds left ten blockchains, and almost all of them moved in about 20 minutes.<\/p>\n\n\n\n

The preparation, however, began at least 36 hours earlier. On 28 October, the attacker’s wallet received three small withdrawals from Tornado Cash, a service that hides where crypto comes from, according to TRM Labs. Shortly after 23:00 UTC on 29 October, a second wave also hit Binance wallets on Avalanche and Polygon.<\/p>\n\n\n\n

That evening, Binance founder Changpeng Zhao said on X that the exchange had likely been hacked, according to TechCrunch. Soon after, Binance confirmed a security incident to the outlet and paused withdrawals on several networks.<\/p>\n\n\n\n

<\/div>\n\n\n\n

How much was stolen from Binance?<\/h2>\n\n\n\n

Binance estimates the impact at about $6.3 billion, while TRM Labs puts it at $6.36 billion and Chainalysis at $6.4 billion. The figures differ because TRM Labs values each asset at the time of transfer. At 30 October prices, for example, the same haul was worth about $6.23 billion, according to the firm.<\/p>\n\n\n\n

Blockchain<\/td>Assets taken<\/td>Estimated value<\/td><\/tr><\/thead>
Ethereum<\/td>ETH, USDT and other tokens<\/td>$3.79 billion<\/td><\/tr>
Bitcoin<\/td>18,270 BTC<\/td>$1.47 billion<\/td><\/tr>
Tron<\/td>USDT and TRX<\/td>$628 million<\/td><\/tr>
XRP Ledger<\/td>233.46 million XRP<\/td>$296 million<\/td><\/tr>
Solana<\/td>Various tokens<\/td>$96 million<\/td><\/tr>
Arbitrum, Optimism and Base<\/td>Various tokens<\/td>$39 million<\/td><\/tr>
Avalanche<\/td>Various tokens<\/td>$28 million<\/td><\/tr>
Polygon<\/td>Various tokens<\/td>$10 million<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Source: TRM Labs, on-chain data as of 00:30 UTC, 30 October 2026.<\/em><\/p>\n\n\n\n

Ethereum alone accounts for almost 60% of the total. That is why most on-chain investigations focus on that network.<\/p>\n\n\n\n

<\/div>\n\n\n\n

How did the hackers get into Binance?<\/h2>\n\n\n\n

According to Binance, the attackers started from the compromised laptop of a DevOps engineer. From that computer, they sent unauthorised withdrawal requests through internal systems, the exchange told CoinDesk on 30 October. Binance also says it found no evidence that wallet private keys leaked. Later, however, it reported further points of entry without describing them.<\/p>\n\n\n\n

TRM Labs adds a technical detail. On Ethereum, the attacker used EIP-7702, a feature introduced in May 2025 that lets a wallet run smart contract code. As a result, Binance’s hot wallet ran an attacker-controlled contract that swept its entire balance in about three and a half minutes.<\/p>\n\n\n\n

On the other nine networks, instead, the transfers were ordinary signed transactions. For this reason, TRM Labs believes the hot wallet signing infrastructure was probably compromised, rather than a simple phishing case. As of 30 October, Binance had not published a final root-cause analysis.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Who is behind the Binance hack?<\/h2>\n\n\n\n

According to TRM Labs and Chainalysis, TraderTraitor, a hacking group linked to North Korea, carried out the Binance hack. TRM Labs says it has high confidence and notes that the FBI previously tied the same group to the Bybit theft. Chainalysis chief executive Jonathan Levin also cited links to earlier attacks, according to CNBC.<\/p>\n\n\n\n

The shared signs are threefold: initial funding through Tornado Cash, a long staging period and signatures gathered in advance. Binance, however, has not commented on who the attackers are. The exchange says it is working with law enforcement, according to Al Jazeera.<\/p>\n\n\n\n

<\/div>\n\n\n\n

How much of the stolen crypto has been frozen?<\/h2>\n\n\n\n

Partners have frozen about $3 billion, according to Binance’s 30 October update. Stablecoin issuers can freeze the tokens they control. In TRM Labs’ first estimate, Tether froze about $1.77 billion in USDT and Circle about $825 million in USDC. Ripple, World Liberty Financial and the Arbitrum Security Council also helped.<\/p>\n\n\n\n

The rest is harder to recover. TRM Labs estimates that the attacker still controls about $2.4 billion, including more than 420,000 ETH and 18,270 BTC. The attacker has already swapped part of the USDT for ETH on decentralised exchanges. Other funds went through Aave, a lending protocol in decentralised finance<\/a>, which froze the affected markets. Next, TRM Labs expects the attacker to use cross-chain bridges and OTC brokers.<\/p>\n\n\n\n

<\/div>\n\n\n\n

Will Binance reimburse its users?<\/h2>\n\n\n\n

Yes, Binance has pledged to cover all losses with its own funds. According to CoinDesk, the exchange has set aside more than $6.34 billion, about $5 billion of it already held in the affected tokens. It is buying the rest on the market. Binance will also draw on SAFU, its emergency fund for users.<\/p>\n\n\n\n

“User funds are safe,” co-founder Yi He wrote on X, according to Axios. As of 30 October, withdrawals remain paused, while deposits still work. Yi He also expects withdrawals to resume by Sunday 1 November, according to Bloomberg.<\/p>\n\n\n\n

Sean Farrell, head of digital asset strategy at Fundstrat, said the attack does not appear to pose a solvency risk, according to CNBC. Before the theft, in fact, Binance held about $144 billion in assets, according to DefiLlama data cited by CoinDesk.<\/p>\n\n\n\n

<\/div>\n\n\n\n

How did the Binance hack affect crypto markets?<\/h2>\n\n\n\n

Bitcoin fell between 4% and 5% after the Binance hack, trading around $77,000 to $78,000 on 30 October, according to CNBC and Al Jazeera. On the same day, Polymarket<\/a> also reported a breach at a third-party provider, with losses under $3 million, according to CoinDesk.<\/p>\n\n\n\n

Axios places the attack in a month of back-to-back cyber incidents dubbed “Black October”. In the same month, for example, INT News covered the French supermarket fridge hack<\/a>.<\/p>\n\n\n\n

The case also shows a limit of centralised exchanges: the more funds they hold, the bigger the target. Star Xu, founder of the OKX exchange, called for shared security standards across the industry, according to CoinDesk.<\/p>\n\n\n\n

<\/div>\n\n\n\n

What is still unknown about the attack?<\/h2>\n\n\n\n