The Binance hack is the largest crypto theft on record. Binance says about $6.3 billion in assets were affected after attackers got into its systems on Thursday, October 29. About $3 billion has been frozen on-chain. The exchange has promised to cover all user losses, and withdrawals are expected back within about 48 hours.
Investigators point to North Korea-linked hackers, though that attribution is still preliminary.
Binance hack at a glance
- What happened: Attackers drained Binance wallets across multiple blockchains on October 29, 2026. Binance puts the impact at roughly $6.3 billion.
- How big: About four times the Bybit theft of February 2025, the previous record.
- Who is suspected: Binance says the pattern matches earlier North Korea-linked heists. TRM Labs points the same way.
- Are users safe? Binance says it set aside more than $6.34 billion to replace affected assets. That is a company promise, not an audited fact.
- What is still unknown: The final loss figure, how the attackers got in, and how much can be recovered.
What happened to Binance on October 29?
Attackers moved a huge amount of crypto out of Binance wallets in a very short window.
According to a timeline compiled by BigGo Finance, the first assets left a Binance wallet on the Base network at 20:16 UTC. At 20:24 UTC a main Ethereum sweep moved 167,464 ETH out of a wallet labeled Binance 14. AMBCrypto says the attack targeted Binance’s primary Ethereum hot wallet. Binance suspended deposits and withdrawals at about 22:15 UTC.
TRM Labs estimated that about $6.36 billion in digital assets moved out across 10 blockchains, most of it within roughly 20 minutes. That detail matters. Nobody can manually react inside a 20-minute window. The theft was scripted and pre-staged.
Binance Hack: $6.3 Billion Asset Breakdown
How much cryptocurrency was frozen, and how much remained unfrozen?
Approximately 47.6% of the affected assets had been frozen. The remaining 52.4% represents an estimated amount not yet frozen.
Founder and former CEO Changpeng Zhao was among the first to confirm it publicly, writing that it “does look like a hack on Binance” and that user funds are safe.
How did the attackers get in?
Binance’s explanation has already changed, and that is worth knowing before you repeat any single-cause story.
The first statement said the incident may involve a compromised DevOps engineer’s laptop. That laptop, it said, gave an attacker access to a service container and let them submit unauthorized withdrawals. Later on Friday, AFP reported that the investigation had “uncovered additional points of breach,” contrary to the single-laptop picture.
So the honest answer today is this: a compromised engineer’s machine was the first lead, and more than one entry point now appears to be involved. I cannot confirm the full chain, and nobody outside Binance’s investigators can yet.
Binance’s own post gives some clues. It said several features of the attack match earlier North Korea-linked heists: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst. It framed this as an assessment based on on-chain activity in the hours after the hack, not a final forensic report.
Who is behind the Binance hack?
The leading suspect is the North Korean state-linked group known as TraderTraitor, part of the wider Lazarus umbrella. TRM Labs says the attack appears linked to a North Korean state-sponsored group. The FBI previously named the same group for the Bybit theft.
Here the caution matters. This is attribution from a blockchain intelligence firm and from Binance itself. I did not find an FBI statement on this specific hack. Attribution in crypto theft often hardens over days or weeks, so treat “North Korea” as the working theory, not a verdict.
The pattern is hard to ignore, though. Look at the recent record:
- Bybit, February 21, 2025: about $1.5 billion in Ether. The FBI attributed it to North Korea. Safe{Wallet} confirmed that attackers compromised a developer’s machine to reach Bybit’s account.
- KelpDAO, April 18, 2026: about $292 million. LayerZero said preliminary indicators pointed to TraderTraitor.
- Drift Protocol, April 2026: about $285 million, also linked to North Korea.
In the first half of 2026, one report counted 207 hacks totaling about $972 million, with roughly 66% attributed to North Korea. One company’s single afternoon has now dwarfed that entire half-year.
Is the $6.3 billion figure final?
No. Binance said the figure may continue to increase as teams trace and freeze more assets. Earlier in the day, CoinDesk’s live coverage cited over $5.7 billion affected. The $6.3 billion number came later.
Two terms get mixed up, so here they are:
- Impact: the total value of assets that moved or were affected.
- Net loss: what Binance actually ends up out of pocket after freezes and recoveries.
Those will differ a lot. If the frozen $3 billion is returned, the net loss shrinks sharply.
How much has been frozen, and who froze it?
Roughly half. Binance says about $3 billion was identified and frozen. According to Zhao, Tether froze about $971 million and Circle about $823 million, and he thanked both. Ripple also moved to freeze funds.
This shows why centralized stablecoins matter in a theft. USDT and USDC issuers can blacklist addresses, which is exactly what happened here. Native assets like ETH and BTC cannot be frozen that way. An analyst quoted by CNBC estimated around $3.3 billion remained unfrozen.
As she described it, Binance’s roughly $1.2 billion SAFU emergency fund could cover about a third of that, with the exchange’s own money covering the rest.
Lending protocols felt it too. Aave froze markets across its V3 and V4 deployments as a precaution after the hack.
Are Binance users’ funds safe?
Binance says yes, and it has put numbers behind the claim. The exchange said it would cover all losses, and later said it had set aside more than $6.34 billion of company funds and reserves, about $5 billion of it already held in reserve. Co-founder Yi He said annual revenue alone could cover the losses.
I would treat this as a strong promise, not a guarantee. I could not find an independent audit of those reserves, and the situation is still changing. What I can say is that the structure is familiar. Binance used the same approach in its 2019 hack, when hackers took about 7,000 bitcoin, and paid users back from its own funds.
Regional arms were handled separately. Binance.US said it was not affected. Binance Japan paused deposits and withdrawals as a precaution and reported no impact on customer assets.
When will Binance withdrawals resume?
Binance said deposits are unaffected and that it expects to begin resuming withdrawals within 48 hours while it improves its withdrawal service and address controls. A later update targeted about 45 hours, which one outlet calculated as roughly early on November 1 UTC. Treat that as a target, not a promise.
How did the market react?
Prices dropped, but not in a panic. Bitcoin fell more than 4% to about $77,995 on Friday. Ethereum dropped nearly 6%, and BNB, Binance’s own token, fell nearly 10%.
Sean Foley, a crypto markets researcher at Macquarie University, told Al Jazeera that a hit to confidence in a big exchange could dent prices by rattling retail investors. He added that it highlights the risk of centralized exchanges and could push some traders toward decentralized alternatives.
Has Binance been hacked before?
Yes, twice in ways worth remembering, and both are small next to this one.
In May 2019, hackers took more than 7,000 bitcoin, then worth about $40 million, from a hot wallet holding around 2% of Binance’s bitcoin. Binance covered it from its SAFU fund.
In October 2022, an exploit on the BSC Token Hub bridge produced extra BNB. Reports of the size differ. NBC reported about $570 million worth of BNB was taken, with about $100 million unrecovered. Bloomberg’s early estimate put the stolen tokens at $100 million to $110 million. I cannot reconcile those figures here.
My read on what this means
The pattern across Bybit, KelpDAO, Drift and now Binance is that the biggest losses come from people and processes, not broken math. The 2026 trackers say so directly: social engineering and stolen keys, not smart-contract bugs, cause the biggest losses. Binance’s own early explanation, a compromised engineer’s laptop, fits that. BigGo’s summary says the preliminary investigation points to an operational failure rather than a cryptographic one.
That has a hard implication. You can have audited code and strong cryptography and still lose billions because someone with deployment access opened the wrong file.
Five lessons from the Binance hack
Size does not equal safety. The largest exchange in the world was the biggest victim in history. Do not use “too big to be hacked” as a security plan.
Hot wallets are the soft target. Anything reachable by software that must move money quickly is reachable by an attacker who owns that software. Keep only working balances there.
Check who can freeze what. Stablecoin issuers froze nearly $2 billion within hours. Native coins cannot be frozen that way. Know which of your assets have a recall mechanism.
Attribution is slow, so stay skeptical early. Binance’s own story changed within hours. Wait for forensic reports before accepting any single explanation, including the one in this article.
Self-custody does not erase the lesson, it moves it. If you hold your own keys, your engineer’s laptop is your laptop. Use hardware wallets, separate devices for signing, and treat every signing request as hostile until verified.
