Developing story — last updated October 30, 2026. Figures may change as investigators trace and freeze more funds.
The Binance hack of October 29, 2026 is now the largest theft in cryptocurrency history. Binance, the world’s biggest crypto exchange, says attackers took about $6.3 billion in digital assets from its hot wallets across ten blockchains in a single evening. Roughly $3 billion has already been frozen, withdrawals are paused, and Binance says it will cover every customer loss. Here is the full story of the Binance hack — what happened, minute by minute, who is suspected, how it hit crypto prices and what Binance users should do right now.
Binance hack at a glance
- Date: Thursday, October 29, 2026 (main theft between about 20:05 and 21:00 UTC)
- Estimated loss: about $6.3 billion (Binance); $6.36 billion (TRM Labs); $5.9 billion (Chainalysis)
- Frozen so far: about $3 billion, including $2.3 billion+ in USDT and USDC
- Cause (initial): a compromised DevOps engineer’s laptop — Binance found no evidence of a leaked private key
- Suspected attacker: North Korea’s TraderTraitor / Lazarus Group (according to TRM Labs and ZachXBT; not officially confirmed by Binance)
- Customer funds: Binance says it will “cover all losses” with its SAFU fund and company money
- Not affected: Binance.US
What happened: the Binance hack timeline
Blockchain investigators were able to rebuild the attack almost minute by minute from public on-chain data. All times below are UTC.
October 28 — the setup
According to TRM Labs, an “operator” wallet received three small withdrawals from the Tornado Cash mixer on the morning of October 28. That gave the attacker untraceable gas money and shows the operation was planned at least 36 hours in advance.
October 29 — test runs
Early on October 29, the attacker deployed and tested the attack code on two wallets, then rehearsed the final version on a third. About four hours later, the code was installed on a Binance hot wallet.
20:05 to 20:20 — the drain begins
- 20:05–20:09: five Binance XRP wallets sent 233.46 million XRP (about $296 million) to a single attacker address.
- 20:20: a Binance Bitcoin hot wallet sent 18,270 BTC (about $1.47 billion).
- In the same window, the attacker submitted 50 pre-signed EIP-7702 authorizations on Binance’s Ethereum hot wallet. About 3.4 minutes later, the entire wallet was emptied — including 167,464 ETH and 1.615 billion USDT.
- Within two minutes, a Binance Tron hot wallet sent out 612.7 million USDT and 46.4 million TRX.
21:00 to midnight — the freezes
Blockchain researcher Spreek was among the first to raise the alarm on X, and Arkham flagged wallets later labeled “binance-hacker-1029.” Stablecoin issuers moved fast:
- 21:01: Tether began freezing USDT (over $1.57 billion in total).
- 21:04: Circle froze over $800 million in USDC.
- 22:01: Ripple started freezing RLUSD.
- 22:10: World Liberty Financial froze $27 million USD1 and $2 million WLFI.
- 23:05: a second wave hit Binance wallets on Avalanche and Polygon.
Meanwhile, the attacker kept sweeping Ethereum wallets at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56.
October 30 — Binance explains
Just after midnight, the Arbitrum Security Council froze $30.5 million (74.6 million ARB and 8,425 ETH). Binance suspended deposits, withdrawals and Binance Alpha trading. At about 02:25 UTC, Binance said its first findings pointed to a compromised DevOps engineer’s laptop and put the total impact at about $6.3 billion, with roughly $3 billion verified as frozen.
How much was stolen in the Binance hack? (by blockchain)
TRM Labs published this breakdown of the roughly $6.36 billion taken at the time of the theft:
| Blockchain | What was taken | Approx. value |
|---|---|---|
| Ethereum | 200,630 ETH, 1.875B USDT, 823M USDC, 88.5M RLUSD + 185 other tokens | $3.79 billion |
| Bitcoin | 18,270 BTC | $1.47 billion |
| Tron | 612.7M USDT, 46.4M TRX | $628 million |
| XRP Ledger | 233.46M XRP | $296 million |
| Solana | 970,500 SOL | $96 million |
| Arbitrum, Optimism, Base | incl. 74.6M ARB | $39 million |
| Avalanche | various | $28 million |
| Polygon | various | $10 million |
For scale: DefiLlama data showed Binance holding about $144 billion in assets before the hack, so the stolen amount is roughly 4% of the exchange’s reserves.
How did hackers break into Binance?
Binance says its initial investigation shows the incident “may involve a compromised DevOps engineer’s laptop.” That access let the attacker reach a service container inside Binance’s systems and submit unauthorized withdrawal transactions. Crucially, Binance says it found no evidence that any wallet private key leaked.
Blockaid’s Ido Ben-Natan described it as “key misuse”: the attacker did not steal the keys, but got the signing system to sign transactions for them. Because withdrawals were signed across ten different chains at almost the same time, TRM Labs believes the hot-wallet signing infrastructure itself was compromised. Binance has promised a full post-mortem.
Who is behind the Binance hack? North Korea suspected
TRM Labs attributes the attack “with high confidence” to TraderTraitor, a North Korean hacking unit that is part of the wider Lazarus Group. Blockaid and well-known on-chain investigator ZachXBT also pointed to North Korea. Investigators cite the same playbook used in the $1.5 billion Bybit hack of February 2025 and the April 2026 KelpDAO hack:
- Small Tornado Cash withdrawals to fund an operator wallet
- Staging and test runs well before the theft
- Signatures prepared in advance and executed in one fast burst
Binance itself has not publicly named the attacker and says it is working with law enforcement.
Where is the stolen money going?
Instead of the bridge-heavy laundering seen after Bybit, the attacker has so far used large swaps and lending markets:
- Bitcoin peel chain: the 18,270 BTC was split into 1,000 BTC and 100 BTC chunks (reports say about $1.4 billion of bitcoin was spread across 19 wallets).
- Dumping stablecoins: about 325 million USDT was sold through UniswapX and other intent-based contracts for about 122,300 ETH — at 10%+ below market price, to move it before it could be frozen.
- Borrowing: a wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH (around $44 million). Aave froze markets and said suppliers were not at risk. On Tron, 300 million USDT went into JustLend.
- DEX swaps: about 200 million USDT moved through hop wallets and Uniswap, and 48 million RLUSD was sold on decentralized exchanges.
Are Binance users’ funds safe?
Binance says yes. Co-CEO Yi He said on X that Binance will cover “all hacking losses,” and the exchange says it will use its SAFU fund (Secure Asset Fund for Users, created in 2018 and reportedly holding about $1 billion in bitcoin) plus company funds. Founder Changpeng “CZ” Zhao, now Binance’s largest shareholder, posted that “user funds are safe” and that he expects them to be fully covered.
Binance has a track record here: when hackers stole 7,000 BTC in May 2019, SAFU covered the loss in full. This time the hole is far larger, which is why the roughly $3 billion already frozen matters so much.
Waiting to move your coins? See our live guide: Binance withdrawals suspended — when will they resume?
How the Binance hack hit crypto prices
Markets dropped as the news spread late on October 29:
- Bitcoin (BTC): fell about 4.8% to below $77,000
- Ether (ETH): down about 5.7% to around $2,211
- BNB: down about 8% to around $693
- AAVE: down about 11%
- Bitcoin Fear & Greed Index: dropped to 30 (“fear”)
CoinDesk reports that institutional investors are pulling crypto from centralized exchanges as a precaution. Market makers Wintermute and GSR disclosed limited exposure (under 20% and under 5% of net equity). Even before this breach, security firm CertiK counted $1.28 billion in crypto hack losses in Q3 2026.
What Binance users should do right now
- Don’t panic-sell. Binance says customer balances are covered, and withdrawals will resume once the issue is fixed.
- Use only official channels. Check the Binance app, binance.com and Binance’s verified X account for updates.
- Watch for “refund” scams. Fake emails, texts and DMs offering hack compensation will try to steal your login. Binance will never ask for your password, 2FA code or seed phrase.
- Screenshot your balances. Keep a record of your holdings and open orders from before and after October 29.
- Turn on strong security. Use an authenticator app or passkey, an anti-phishing code and withdrawal address whitelisting.
- Think about self-custody. For long-term holdings, a hardware wallet removes exchange risk — “not your keys, not your coins.”
Binance hack vs. other big crypto hacks
At about $6.3 billion, the Binance hack is roughly four times larger than the previous record, the $1.5 billion Bybit theft in 2025. It also dwarfs the Ronin Network ($625 million) and Poly Network ($611 million) attacks. See our full ranking of the biggest crypto hacks in history for the complete list.
The Binance hack is a reminder that even the largest exchange in the world can be breached through one compromised device. We’ll keep this story updated as Binance publishes its post-mortem and more of the stolen funds are traced.
Sources: TRM Labs, CoinDesk, Cointelegraph, TechCrunch.
FAQ
How much money was stolen in the Binance hack?
Binance estimates about $6.3 billion. TRM Labs puts it at $6.36 billion at the time of the theft, and Chainalysis at about $5.9 billion. Around $3 billion has been frozen.
When did the Binance hack happen?
On Thursday, October 29, 2026. The main theft took place between about 20:05 and 21:00 UTC, with more sweeps until midnight.
Who hacked Binance?
Blockchain analysts, including TRM Labs and ZachXBT, link the attack to North Korea’s TraderTraitor / Lazarus Group. Binance has not officially confirmed who was responsible.
Is my money safe on Binance?
Binance says it will cover all losses using its SAFU fund and company funds, and that user funds are safe. Withdrawals are paused until the security issue is resolved.
Is this the biggest crypto hack ever?
Yes. At about $6.3 billion, it is the largest crypto theft on record — about four times bigger than the $1.5 billion Bybit hack in 2025.
Was Binance.US affected?
No. Binance says Binance.US was not affected by the hack.
2 thoughts on “Binance Hack 2026: Full Story of the $6.3 Billion Crypto Heist”