10-30-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: Binance says an attacker drained about $6.3 billion from its online wallets on October 29, making it the largest theft in digital asset history. The exchange has suspended deposits and withdrawals, says user funds are safe, and promises to cover all losses from its SAFU insurance fund and company funds. About $3 billion of the stolen assets has already been frozen on-chain by issuers, including Tether and Circle (NASDAQ: CRCL). Blockchain intelligence firms Chainalysis and TRM Labs say they have high confidence that North Korea’s TraderTraitor group was responsible, though no government body has confirmed that.
Key Takeaways:
- Binance says around $6.3 billion was drained from its hot wallets on October 29, 2026.
- The previous record theft was Bybit’s $1.5 billion loss in February 2025.
- Binance blames a compromised DevOps engineer’s laptop and says no private keys were leaked.
- Deposits and withdrawals are suspended; Binance says user funds are safe and all losses will be covered.
- About $3 billion in stolen assets has been frozen on-chain, including over 1.567 billion USDT frozen by Tether and more than $800 million in USDC frozen by Circle.
- Chainalysis and TRM Labs attribute the attack to North Korea’s TraderTraitor group with high confidence; no government confirmation yet.
- Binance has promised an updated proof of reserves once remediation is complete.
Binance, the world’s largest digital asset exchange by trading volume, says an attacker drained an estimated $6.3 billion from its online wallets late Thursday. That amount would make it the largest theft in the industry’s history.
The outflows began at around 20:24 UTC on October 29 and lasted roughly 40 minutes, according to on-chain data. More than 200,000 ETH moved out of two Binance “hot” wallets, along with large amounts of the USDT and USDC stablecoins and smaller quantities of other tokens. Early estimates from outside analysts ranged from $3.3 billion to $5.8 billion before Binance published its own figure.
In an official statement, Binance said its initial investigation suggests the incident “may involve a compromised DevOps engineer’s laptop,” which allowed the attacker to access a service container and submit unauthorized withdrawal transactions. The company said it has found no evidence that any wallet private key was leaked, and promised a detailed technical post-mortem once its investigation is complete.
Deposits and withdrawals remain suspended while security checks continue. Co-founder Yi He said, “user funds are safe,” and that Binance will cover all losses from hacking. The company confirmed the money will come from its SAFU emergency insurance fund and its own corporate funds. An updated proof of reserves will be published once remediation is complete.
Billions already frozen, but by centralized hands
A large share of the stolen assets may never be usable by the attacker. Tether said it froze more than 1.567 billion USDT connected to the theft, while Circle said it froze more than $800 million in USDC and is coordinating with law enforcement. Ripple and World Liberty Financial froze smaller amounts, and Binance says about $3 billion in total has been frozen on-chain so far.
Notably, much of the haul was in stablecoins that issuers can freeze at the address level, so the attacker’s usable proceeds could end up far below the gross figure. The previous record holder, a roughly $1.5 billion theft from the Bybit exchange in February 2025, was almost entirely in ETH, which has no single issuer capable of stepping in.
It’s also worth noting who performed the rescue. The freeze-response relied on a handful of centralized issuers switching off specific wallets, a power that’s welcomed in a crisis, but which sits awkwardly with the industry’s wider decentralization narrative.
Blockchain intelligence firms Chainalysis and TRM Labs both said they have “high confidence” that North Korea’s TraderTraitor group carried out the attack, citing on-chain links between the stolen Binance funds and assets taken in last month’s Bitget exploit. No government or law enforcement agency has confirmed the attribution.
Different era, different outcome for customers
Whatever the final loss turns out to be, it’s a clear contrast with the industry’s early days. When Mt. Gox collapsed in 2014, its customers bore the losses directly (with many still waiting for repayment more than a decade later). Binance’s SAFU insurance fund and balance sheet mean the cost this time is expected to fall on the company and investors rather than users, assuming its promises hold.
That caveat comes with some history attached. In recent years, Binance has paid a $4.3 billion penalty to U.S. authorities, and founder Changpeng “CZ” Zhao pleaded guilty to anti-money-laundering violations before receiving a presidential pardon in 2025. Zhao, who is no longer a Binance executive, commented on this week’s events as a shareholder, saying he expects all user funds will be covered.
Markets, meanwhile, didn’t wait for the answer. Major digital assets traded lower as news of the theft spread, with BTC and ETH both down about 4-5%. Binance’s own BNB token fell more sharply.
Binance says it is working with law enforcement and blockchain intelligence partners to trace and recover the remaining funds.
FAQs:
How much was stolen in the Binance hack?
Binance’s official estimate is around $6.3 billion, making it the largest theft in digital asset history. Outside analysts’ early estimates ranged from $3.3 billion to $5.8 billion.
Are Binance user funds safe?
Binance says yes. The company says all losses will be covered by its SAFU emergency insurance fund and its own corporate funds, and that customer balances will be honored in full.
Who was behind the Binance hack?
Blockchain intelligence firms Chainalysis and TRM Labs say they have high confidence that North Korea’s TraderTraitor group was responsible, based on on-chain links to earlier thefts. No government or law enforcement agency had confirmed the attribution at the time of writing.
How much of the stolen money has been frozen?
Binance says about $3 billion has been frozen on-chain. Tether froze more than 1.567 billion USDT, and Circle froze more than $800 million in USDC, with smaller amounts frozen by Ripple and World Liberty Financial.
How does the Binance hack compare to previous exchange hacks?
It is by far the largest on record. The previous biggest was the roughly $1.5 billion theft from Bybit in February 2025, which U.S. authorities attributed to North Korean hackers.
Are Binance withdrawals open again?
As of October 30, deposits and withdrawals remained suspended while Binance completes security checks. The exchange says updates will come through its official channels.
Watch: Can Blockchain Recover Stolen Crypto? BSV Says Yes
