Binance Hacked: $6.3 Billion Stolen in Largest Crypto Theft Ever

Update (October 30, 2026, 14:25 Istanbul time): Binance now says its follow-up investigation found “additional points of breach” beyond the compromised laptop and called it “a complex attack.” The exchange says it has begun recovering affected assets, has reserved over $6.34 billion of company funds to cover the incident and remains on track to reopen withdrawals in about 45 hours. Details are in the new section below.

Earlier update (08:25 Istanbul time): Binance confirmed the incident, put the impact at about $6.3 billion and said it will cover all losses. TRM Labs attributes the attack to North Korea’s TraderTraitor group.

Binance was hacked. On October 29, 2026, an attacker drained about $6.3 billion in crypto from Binance hot wallets across ten blockchains, most of it in roughly 20 minutes starting at 20:05 UTC. Binance says the attack may have started on a compromised DevOps engineer’s laptop and that it will cover every loss from its SAFU fund and company funds. At that size, it is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

Binance Hacked: What the Exchange Has Confirmed

In an official announcement published at 02:25 UTC on October 30, Binance said its initial investigation suggests a compromised engineer laptop let the attacker reach a service container and submit unauthorized withdrawal transactions. The company said it found no evidence that any wallet private key leaked and promised a detailed technical post-mortem.

Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.

The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.

— Binance (@binance) October 30, 2026

Binance also said it revoked the affected address authorization, brought in law enforcement and blockchain intelligence partners, and will publish an updated Proof of Reserves once remediation is complete. Earlier in the night, its first statement had only said it was investigating “a potential security issue.”

Binance Hacked: Additional Breach Points and Recovery Plan

In an investigation update posted at 08:47 UTC on October 30, Binance said its first finding, a possibly compromised laptop, was not the full picture: “our subsequent investigation has uncovered additional points of breach.” The company did not say what those points were and said it is still gathering the facts with law enforcement. It repeated that losses will be covered from the SAFU fund and company funds, that outflows stopped once withdrawals were paused and that about $3 billion has been frozen so far.

Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.

This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them.

— Binance (@binance) October 30, 2026

About two hours later, at 10:55 UTC, Binance said it has begun recovering affected assets for users. It has set aside more than $6.34 billion of company funds for the incident, and $5 billion of that is already held in the exact tokens that were stolen. The rest is being bought through market and OTC channels so the reserve matches the missing assets token for token, a step Binance warned may take longer for low-liquidity tokens. The frozen $3 billion is not counted in those figures and is still being recovered with partners and law enforcement. Binance says all user funds will be verified publicly through its Proof of Reserves.

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.

Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted.

— Binance (@binance) October 30, 2026

The incident is also reaching Binance’s regional platforms. Binance TR, the separately licensed Turkish exchange, said on October 30 that it has temporarily stopped crypto withdrawals as a precaution, while Turkish lira deposits and withdrawals, trading and crypto deposits continue normally.

Who Is Behind the Binance Hack?

TRM Labs says, with high confidence, that TraderTraitor, North Korea’s state-backed hacking unit, carried out the attack. The FBI blamed the same group for the Bybit theft. TRM counts about $6.36 billion taken, valued at the moment of each transfer, including about $3.79 billion on Ethereum, 18,270 BTC (about $1.47 billion), around $628 million on Tron and 233.46 million XRP. Reuters also reported the attribution. Binance itself has not named a culprit.

According to TRM, preparation began at least 36 hours earlier with small Tornado Cash withdrawals and test runs of the attack code. On Ethereum, the attacker used an EIP-7702 delegation, backed by 50 pre-signed authorizations, to turn a Binance hot wallet into a sweeper it controlled. Because wallets on nine other chains also signed transfers to the attacker within about half an hour, TRM believes the attacker gained control over Binance’s hot wallet signing system.

How Much Has Been Frozen?

Binance puts the frozen amount at about $3 billion. TRM’s count, as of 00:30 UTC, was about $2.7 billion: roughly 1.77 billion USDT frozen by Tether, about 825 million USDC by Circle, 40.5 million RLUSD by Ripple, 27.8 million USD1 by World Liberty Financial and about $30 million in ETH and ARB moved by Arbitrum’s Security Council. The attacker raced the freezes by selling USDT for ETH at a steep discount and borrowing ETH on Aave, and still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.

Can Binance Users Withdraw Funds?

Not yet. Binance first suspended all deposits and withdrawals. In its latest service update at 04:36 UTC, it said deposits work normally again, while withdrawals stay paused during a “security revamp” of the withdrawal service and its addresses. It expects to resume withdrawals within 48 hours, and in its 08:47 UTC update it said it is still on track to reopen them in about 45 hours. Binance.US says it was not affected.

• Only trust updates from official Binance channels; scammers are already exploiting the incident.
• Never share passwords, 2FA codes or seed phrases, and ignore anyone offering “refunds” or “recovery.”
• Enable two-factor authentication or passkeys and the withdrawal address whitelist.
• Delete API keys you do not use, especially keys with withdrawal permission.

Frequently Asked Questions

Was Binance hacked?

Yes. Binance confirmed a security incident with an estimated impact of about $6.3 billion and later said the attack involved more than one point of breach. It says user funds are safe because the company will cover all losses.

Will Binance users lose money?

Binance says no. It plans to cover losses from its SAFU emergency fund and company funds, and about $3 billion of the stolen assets has been frozen.

When will Binance withdrawals reopen?

Binance said at 08:47 UTC on October 30 that it is on track to resume withdrawals in about 45 hours, which points to early November 1 (UTC). Deposits are already working.

This is a developing story and will be updated as Binance publishes its post-mortem. For background, read how Binance withdrew its MiCA license application in Greece, how Binance responded to money laundering allegations, and how Binance TR launched gold-referenced crypto trading.