The Binance hack, confirmed on Thursday 29 October 2026, saw an attacker withdraw an estimated $6.3 billion in digital assets from the exchange, which would make it the largest crypto theft on record. Binance says user funds are safe and that it will cover all losses from its own resources and its SAFU fund. About $3 billion of the stolen assets has been frozen so far, and analysts suspect a North Korean group, though that is not confirmed.
What happened in the Binance hack?
Binance announced the incident on 29 October and suspended withdrawals as a precaution. Founder Changpeng Zhao said the exchange appeared to have been hacked. According to CoinDesk, Binance later put the total impact at about $6.3 billion.
Other estimates differ slightly, which is normal early in an incident:
- Binance: about $6.3 billion in estimated total impact.
- TRM Labs: about $6.36 billion moved out of Binance wallets across 10 blockchains, mostly within roughly 20 minutes, as reported by Fox Business.
- Chainalysis: roughly $5.9 billion at the time of the theft, per CoinDesk.
For scale, the previous record was the roughly $1.5 billion theft from Bybit in 2025, according to Al Jazeera.
How did the attacker get in?
Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer. CoinDesk reports that the attacker used it to reach a service container and submit unauthorised withdrawals. Fox Business adds that later findings showed additional intrusion points.
Two details matter for how readers should interpret this:
- Binance says it has found no evidence that wallet private keys were leaked. The problem, on this account, was access to systems that could authorise transfers, not the cryptography itself.
- Binance has said it plans to publish a detailed technical report. Until then, the description above is a preliminary company account and may change.
The pattern is familiar. Large losses at exchanges and custodians tend to come from operational weaknesses such as compromised employee devices, access controls and signing workflows, rather than from flaws in the underlying blockchains.
Who is behind it, and is that confirmed?
Not officially. TRM Labs attributes the attack to TraderTraitor, a North Korea-linked unit, with high confidence, based on technical similarities to earlier heists. Blockaid said the tactics were consistent with North Korean operations, and ZachXBT named the Lazarus Group as the likely attacker, according to CoinDesk.
Binance has not confirmed an attribution and says it is working with law enforcement. President Trump said the US administration is looking into whether North Korea was involved, and when asked he replied that officials did not yet know, per Fox Business. The Secret Service is working with private partners, including Circle, to freeze and trace funds.
How much has been frozen, and why stablecoin issuers matter
About $3 billion has been frozen on-chain, according to CoinDesk, Al Jazeera and Fox Business. CoinDesk reports that this includes about $2.3 billion in stablecoins: Tether said it froze more than $1.57 billion in USDT and Circle said it froze more than $800 million in USDC.
That split is the most useful structural lesson. Assets with a central issuer can be frozen quickly. Bitcoin and ether cannot. CoinDesk reports the attacker's wallets at one point held more than $5.7 billion, including nearly $1.5 billion in bitcoin and about $900 million in ether, and that the attacker borrowed at least 20,000 WETH (about $44 million) on Aave against stolen USDT and moved funds through Uniswap.
Issuer freeze powers are also a live policy topic. Our earlier piece on the Fed's proposed GENIUS Act rules for stablecoin issuers covers the framework these issuers operate under, and our look at why Circle's reserve income is a point of debate shows how central USDC has become to the market's plumbing.
Who pays, and what did markets do?
Binance says it will cover all losses. It has pointed to its Secure Asset Fund for Users (SAFU), which CoinDesk describes as holding roughly $1 billion in bitcoin, together with company funds. Fox Business reports that Binance reserved more than $6.34 billion to cover losses, including $5 billion already held in the stolen assets, and is buying replacement tokens through market and over-the-counter trades. Co-CEO Yi He said the platform would cover all hacking losses.
Markets reacted on Thursday. Per CoinDesk, bitcoin fell 4.8% to below $77,000, ether dropped 5.7%, BNB fell 8% and AAVE fell 11%. Those are one-day moves and say little about longer-term effects.
It is also worth keeping the promise to cover losses in perspective. It is a commitment by a private company, and its value depends on the company's balance sheet and on how the recovery of frozen funds goes. It is not a deposit guarantee of the kind a regulated bank offers.
What the Binance hack means for exchange risk
This is not a story about one exchange alone. Several questions apply to any institution that holds client assets:
- Key and signing architecture. How many people and devices can influence a transfer, and how are they isolated?
- Hot wallet limits. How much can leave in a short window before controls trigger?
- Segregation and disclosure. Are client assets separate from company assets, and what is published about reserves?
- Incident response. How fast can funds be frozen, and with which partners?
Regulators will likely look at these points too. For the wider rulebook context, see our summary of the SEC's crypto offering proposal as comments closed. Custody and security standards remain a separate and still-developing area.
What to watch
- Binance's technical report and whether it confirms the laptop-based intrusion path and the absence of key leakage.
- Withdrawal status. Binance has said withdrawals will resume once the security issue is resolved. Reports on timing vary, so check the exchange's own announcements.
- Recovery. Whether more of the stolen assets are frozen, and how much of the bitcoin and ether can be traced.
- Attribution. Whether US authorities formally name a group, which affects sanctions and law enforcement steps.
- Reserve disclosures. Whether exchanges respond with more transparency about client assets.
The key uncertainty is that figures and details are still moving. Totals, frozen amounts and the attack path are preliminary, and this article reflects reports available on 31 October 2026.
Sources
- CoinDesk: Binance loses over $6 billion in the largest crypto hack to date
- Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history
- Fox Business: Expert warns of AI hacking bloodbath following massive Binance cryptocurrency theft
This article is for informational purposes only and does not constitute financial, investment, legal or tax advice, or an offer or solicitation to buy or sell any asset or fund interest. Digital assets are highly volatile and you may lose some or all of your capital. Past performance is not indicative of future results.