Binance Hack: $6.3bn Stolen in Largest Crypto Theft on Record

Update, 2 November 2026: Binance restored withdrawals from 06:00 UTC on 1 November, and all 15 affected networks were live again by 12:36 UTC, TechCrunch reported. Data cited by CNBC showed about $4.649bn leaving the exchange against $1.01bn coming in between 06:00 and 15:30 GMT, a net outflow of roughly $3.64bn, or about 2.1% of its estimated $171bn in assets. Founder Changpeng Zhao posted that “98% choose to stay!”

Binance says it has already covered about 95% of losses and will cover the rest, while Circle has frozen more than $1.1bn in USDC linked to the theft. The FBI has attributed the hack to the North Korea-linked TraderTraitor group, also known as Lazarus, and Chainalysis said laundering of the stolen funds is continuing. Reports suggest the breach may have begun on an engineer’s laptop, though Binance has not published a full account.

Binance, the world’s largest cryptocurrency exchange, has lost about $6.3bn to $6.4bn in what blockchain analysts describe as the largest crypto hack on record, with two leading firms attributing the attack to North Korea’s TraderTraitor hacking group. Withdrawals remain suspended while the exchange rebuilds its withdrawal systems, and roughly $3bn of the stolen funds has been frozen.

The theft, which began at 20:05 UTC on Thursday 29 October, is more than four times the size of the $1.46bn Bybit hack in February 2025, which was itself the previous record, according to the blockchain analytics firm Elliptic.

How Much Was Stolen From Binance?

Estimates vary slightly between firms. Elliptic puts the total at $6.43bn, while TRM Labs says an attacker moved about $6.36bn out of Binance wallets on ten blockchains, “most of it in about 20 minutes”. Binance itself has estimated the impact at around $6.3bn. Elliptic’s figure excludes a further $169m that left the exchange after withdrawals were suspended.

The haul included 18,270 bitcoin, and TRM said the attacker now holds more than 420,000 ether alongside the bitcoin. A second wave of withdrawals hit Binance wallets on Avalanche and Polygon shortly after 23:00 UTC, Elliptic said.

Who Is Behind the Hack?

TRM Labs attributes the attack to TraderTraitor, which it calls “North Korea’s elite hacking unit”, based on what it describes as robust on-chain and off-chain intelligence. Elliptic says it believes it is “likely” that the group carried out the theft. No government has yet formally attributed the hack.

TRM said several features matched earlier North Korea-linked heists, including Bybit and the KelpDAO hack in April 2026: small Tornado Cash withdrawals used to fund an operator wallet, staging that began well before the theft, and signatures obtained in advance and then executed in a single burst.

How Did the Attackers Get In?

Binance’s initial investigation suggested the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions”, according to Elliptic. The exchange now says it has found additional points of breach in a complex attack that “was not carried out by one person”.

On Ethereum, the attacker abused EIP-7702, a feature introduced in the 2025 Pectra upgrade that lets an ordinary wallet delegate its behaviour to a smart contract. TRM said the attacker used the delegation to turn a Binance hot wallet into a “sweeper” it controlled, with 50 pre-signed authorisations prepared in advance. Binance co-chief executive Richard Teng said the use of EIP-7702 “did not pass through our normal approval controls”. On the other blockchains, funds were moved in ordinary signed transactions.

How Much Has Been Frozen?

Stablecoin issuers and blockchain operators moved quickly. Elliptic says it has verified $2.85bn of frozen or seized funds, about 44% of the total and close to Binance’s estimate of around $3bn. Stablecoins make up 94% of the frozen funds, almost all of it Tether’s USDT and Circle’s USDC on Ethereum and Tron.

Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen, Elliptic noted, because native assets on those networks have no issuer able to freeze them. The attacker is swapping the remaining tokens into ether and other assets that cannot be frozen, using automated scripts that run around the clock.

Will Binance Customers Lose Money?

Binance has said it will cover all losses using its Secure Asset Fund for Users (SAFU) and company funds, and that it has reserved more than $6.34bn of company money to do so. In a video update on 30 October, Teng said he was hopeful withdrawals would resume before Sunday. Customers should rely only on Binance’s official channels for updates, as large hacks are routinely followed by phishing campaigns that impersonate the affected exchange. Our guides to spotting a phishing email and passkeys and two-factor authentication explain how to protect your accounts.

How Did Crypto Markets React?

Prices fell as the scale of the breach became clear. CNBC reported on Friday that bitcoin was down 4.1% at about $77,446, ether had fallen 4.4% to $2,229.50 and Binance’s own BNB token had dropped about 6% to $701.18. The sell-off adds to weeks of pressure on bitcoin, which slipped below $80,000 earlier this month, as we reported in our report on bitcoin slipping below $80,000 as Strategy paused its buying.

The episode is also likely to sharpen the debate over security at centralised exchanges, and over new Ethereum features such as EIP-7702 that change how wallets can be controlled.

Featured image: Illustrative AI-generated scene created for MediaPavilion; it does not depict a real person or the Binance incident.

Sources

• Elliptic — Inside the $6.4 billion Binance hack (30 October 2026).
• TRM Labs — North Korea steals USD 6.36 billion from Binance in the largest hack in history (30 October 2026).
• CNBC — Bitcoin, ether fall as Binance security scare rattles crypto markets (30 October 2026).
• CoinDesk — Binance uncovers wider breach in $6.3 billion exploit, targets Sunday withdrawal restart (30 October 2026).
• CNBC — Binance sees billions in outflows after hack (2 November 2026).
• BBC News — Binance hack (1 November 2026).
• TechCrunch — Binance resumes withdrawals following $6.3 billion breach (1 November 2026).