The $6.3 Billion Binance Hack: What Happened, Who Did It, and What It Means

This is a developing story and figures may change. Not financial advice.

On the evening of October 29, 2026, attackers drained billions of dollars from wallets belonging to Binance, the world’s largest cryptocurrency exchange. Binance puts the total impact at around $6.3 billion, making this the largest crypto theft ever recorded, roughly four times the size of the $1.5 billion Bybit hack of February 2025. This article answers the main questions people are asking: what happened, how the attackers got in, who they are, how much can be recovered, what it means for users, and what it says about centralized versus decentralized exchanges.

What happened

According to blockchain analytics firm TRM Labs, the theft began at about 20:05 UTC on October 29. Within roughly 20 minutes, most of an estimated $6.36 billion had left Binance wallets across ten blockchains, including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. A second wave around 23:05 UTC reached wallets on Avalanche and Polygon.
Binance confirmed a security incident, suspended withdrawals on multiple networks, and later suspended deposits and Binance Alpha trading as a precaution. Estimates of the amount stolen differ depending on who is counting and how they value the assets: Binance says about $6.3 billion, TRM says about $6.36 billion at the time of theft, and Chainalysis’s early estimate was about $5.9 billion, with its CEO later citing $6.4 billion.
The breakdown by chain, per TRM, shows Ethereum accounted for about $3.79 billion, Bitcoin about $1.47 billion (18,270 BTC), Tron about $628 million, the XRP Ledger about $296 million, and Solana about $96 million, with smaller amounts elsewhere.

Was it a hack or a weakness in the network?

It was a hack of Binance’s own systems, not a flaw in a blockchain or a smart contract. The picture of exactly how the attackers got in is still emerging.
Binance’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer. That access, the company said, let an unauthorized party reach an internal service container and submit unauthorized withdrawal transactions. Binance said it found no evidence that wallet private keys had leaked.
By Friday morning, the story had become more complicated. Binance said investigators had found additional points of breach beyond the laptop. Co-CEO Richard Teng said the attack was not a single one-click action by one engineer’s permissions but a more complex process, and that the investigation has not assigned responsibility to any individual.
Outside analysts point to the exchange’s signing infrastructure. TRM noted that Binance wallets on different chains, using different key types and signing schemes, all produced valid signatures for the attacker within about half an hour. Its assessment is that the attacker most likely gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing. Blockaid’s CEO described this as key misuse: the attacker abused a signing system without ever extracting the keys themselves.

The Ethereum technique

On Ethereum, TRM describes a particularly sophisticated method. A feature called EIP-7702, introduced in Ethereum’s Pectra upgrade in 2025, lets an ordinary wallet hand control of its behavior to a smart contract by signing an authorization. The attacker submitted one transaction containing 50 pre-signed authorizations, each making a Binance hot wallet run a sweeper contract that only the attacker could command. Because a busy hot wallet’s transaction counter keeps moving, preparing signatures for 50 consecutive counts guaranteed one would still be valid. About three and a half minutes later, the attacker swept the wallet’s entire balance, including 167,464 ETH and 1.615 billion USDT. The delegation stayed in place, so new deposits were swept again in later hours.

Who is behind it

TRM attributes the attack with high confidence to TraderTraitor, North Korea’s elite hacking unit. Chainalysis also assessed it was likely TraderTraitor. The FBI previously named the same group in the Bybit theft. TRM points to shared hallmarks: small Tornado Cash withdrawals funding an operator wallet, preparation starting at least 36 hours in advance, test runs on other wallets, and signatures obtained ahead of time and executed in one burst.
On-chain investigator ZachXBT reported that funds from the Binance attack and an earlier Bitget exploit were commingled in the same address after arriving via THORChain, suggesting the same actor is behind both. Attribution is a judgment by private firms, not an official finding, and Binance itself has not publicly named a culprit.

How much can be recovered

Partly, and quickly. The speed of the response is notable.

• Tether froze roughly $1.57 billion to $1.77 billion in USDT.
• Circle froze more than $800 million in USDC, in coordination with law enforcement.
• Ripple froze about $40.5 million in RLUSD, and World Liberty Financial froze about $27.8 million in USD1.
• Arbitrum’s Security Council used emergency powers to move about $30.5 million in ETH and ARB out of the attacker’s reach.
• First Digital said it froze FDUSD involved in the attack, and Aave froze lending markets after the attacker borrowed about $44.6 million in ETH against USDT collateral.

Binance’s verified figure for frozen assets reached $3 billion as of early Friday, and it says the total could rise as investigators trace more. TRM’s count was about $2.7 billion.
The harder part is what wasn’t frozen. The attacker raced the freezes by selling stablecoins to market makers at steep discounts and borrowing against them. TRM says the attacker still controls over 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond any issuer’s reach, and expects it to move through bridges, swap services and over-the-counter brokers. Past North Korean thefts suggest much of such funds is rarely recovered, though that is an inference from history rather than a prediction.

Will users get their money back?

Binance says yes. It has repeatedly said user funds are safe and that it will cover all losses, and Teng said it would do so using its SAFU emergency fund together with company funds. Binance held roughly $144 billion in assets before the hack, according to DefiLlama, and one Fundstrat analyst said the breach does not currently appear to create meaningful solvency risk.
Still, the promise is a company statement, not an insurance guarantee. Exchange balances are generally not insured the way bank deposits are. As of this writing Binance has not published a detailed compensation process or a final post-mortem, which it has promised once the investigation is complete.

Where services stand

Binance said withdrawals remain paused while it completes a security revamp of its withdrawal service and related addresses, and that it was on track to resume them within about 48 hours of Friday morning’s update. It also said outflows stopped once withdrawals were paused. Deposits, initially suspended, were later described as operating normally. Users should check Binance’s official channels for current status rather than relying on this article.

Market and industry impact

Markets reacted quickly but not catastrophically. Bitcoin fell below $77,000, down nearly 5% over 24 hours, and BNB dropped about 8% to roughly $693. Ether slid to around $2,211. DeFi tokens fell harder, with AAVE down about 11% and UNI about 11%. The Bitcoin Fear and Greed Index dropped to 30, a level of fear not seen since August.
Market makers disclosed exposure to Binance: Wintermute said under 20% of its net equity and GSR said under 5%, and neither expected major disruption. Separately, prediction market Polymarket briefly halted trading the same day after a third-party provider was compromised; it said the issue was fixed and affected users would be reimbursed. There is no indication the two incidents are connected.

Could this happen to other exchanges?

Yes, and that is the central lesson. The largest crypto thefts of recent years, including Bybit in 2025 and now Binance, share a pattern: attackers target the people and signing systems around an exchange rather than breaking the underlying cryptography. TRM’s crime report counted about $2.87 billion stolen across roughly 150 hacking incidents in all of 2025. One incident in October 2026 has now more than doubled that.

Recommendations from TRM and others for exchanges include:

• Separate signing infrastructure and approval paths by chain and wallet tier, so one attacker cannot obtain valid signatures across ten chains.
• Monitor treasury wallets for unexpected EIP-7702 delegations, treat requests for many authorizations as an indicator of compromise, and keep a tested, pre-approved way to sign a revocation.
• Screen counterparties in real time, since market makers bought hundreds of millions in stolen USDT minutes after it was taken.
• Minimize funds held in hot wallets, harden and isolate engineer devices, and require hardware-backed signing and human approval for large transfers.

Centralized vs. decentralized exchanges

The hack has revived the debate. Standard Chartered’s head of digital assets research argued it could accelerate a shift toward decentralized exchanges, noting that the DEX-to-CEX trading ratio among the top ten spot venues already rose to 23.5% in the second quarter of 2026.
The honest answer is that each model carries different risks:

• Centralized exchanges concentrate funds in wallets the company controls, creating a single, very large target. Users depend on the company’s security and its willingness and ability to compensate them. In return they get liquidity, fiat on-ramps, support, and, as this incident showed, the ability of stablecoin issuers and partners to freeze stolen funds.
• Decentralized exchanges and self-custody remove the single honeypot, but shift responsibility to the user. Smart contract bugs, bridge exploits and phishing are real threats, and there is typically no one to reimburse a loss. Binance’s own BNB bridge was exploited for about $100 million in 2022, and bridges in general lost over $2 billion that year.

This attack also blurs the line. It succeeded by compromising people and signing systems, which are weak points in any custody setup, whether corporate or personal.

What Binance users should do

• Stay calm and avoid panic decisions. Withdrawals are paused, and rushed trading during volatility often backfires.
• Use only official channels for updates, and type the website address yourself rather than clicking links in messages.
• Expect scams. Fake compensation forms, wallet migration requests and recovery services typically follow major hacks. Binance will not ask for your password, 2FA codes, seed phrase or API secrets.
• Harden your account. Use an authenticator app or hardware key rather than SMS, set a unique password, enable the anti-phishing code and address whitelist, and delete unneeded API keys.
• Keep records of balances, transactions and official communications in case of disputes.
• Rethink concentration. Hold only what you need for active trading on any exchange, and consider self-custody for long-term holdings, understanding that it carries its own risks.

What to watch next

• Whether Binance resumes withdrawals on schedule and whether outflows remain orderly.
• Binance’s promised post-mortem, including the complete attack path and the additional breach points.
• How much of the $2.4 billion still controlled by the attacker is traced, frozen or laundered.
• Any law enforcement or government statements, including formal attribution.
• Regulatory and industry responses on exchange security standards and custody.

Sources

This article draws on reporting and analysis from TRM Labs, Cointelegraph’s live coverage, TechCrunch, CNBC, NBC News, Al Jazeera, CoinDesk, Axios, and Yahoo Finance/AFP, as published October 29–30, 2026. Figures are estimates from different sources and are likely to be revised as investigations continue.