Yes. On October 29, 2026, attackers took about $6.3 billion in crypto from Binance’s internet-connected hot wallets. Binance confirmed the incident and suspended withdrawals.

How much was stolen from Binance?

Binance cites about $6.3 billion. TRM Labs counted $6.36 billion across 10 networks and Elliptic $6.43 billion across 11. It is the largest crypto theft on record, roughly four times the 2025 Bybit hack.

Blockchain analytics firms TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, a North Korea-linked group. As of October 30, neither Binance nor any government had officially confirmed attribution; the FBI and US Secret Service are involved in the investigation.

How did the hackers get in?

According to Binance, the starting point may have been a compromised engineer’s laptop, among other entry points. From there the attacker reached the infrastructure that signs withdrawals. Binance says no cryptography was broken and no private keys leaked.

How much of the stolen money has been frozen?

About $2.7 billion, mostly stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial, plus ETH and ARB locked on Arbitrum. The rest, mainly ETH and BTC, remains with the attacker.

Binance hacked: how the biggest crypto heist in history happened

Binance was hacked on the evening of October 29, 2026, losing about $6.3 billion in crypto.

It is the largest crypto theft in history, roughly four times the February 2025 Bybit hack, which took $1.5 billion.

Most of the money left in about 20 minutes, from Binance wallets on 10 different blockchains.

Below we explain how the attack happened, who the main suspect is and what has been recovered so far.

Binance hack at a glance

Point	What we know
Date	October 29, 2026, from 20:05 UTC
Amount	About $6.3bn (Binance); $6.36bn (TRM Labs); $6.43bn (Elliptic)
Networks hit	Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon
Target	Hot wallets, the online wallets used to process withdrawals
Suspect	TraderTraitor, a North Korea-linked group (per TRM Labs and Chainalysis)
Frozen	About $2.7bn, mostly stablecoins
Binance’s response	Withdrawals suspended and a pledge to cover 100% of user losses

How the Binance attack unfolded, minute by minute

Preparation began at least 36 hours earlier, according to TRM Labs.

The operator wallet received small withdrawals from Tornado Cash, a service that hides where crypto comes from, starting the morning of October 28.

On the 29th, the attacker deployed and tested the attack code on its own wallets before using it against Binance.

Binance hack timeline on October 29, 2026: from 15:59 UTC, when the sweeper contract was deployed, to 00:10 UTC, when the delegation was cut

Times below are in UTC, based on TRM Labs’ analysis and a thread by analyst Cauê (@caueconomy):

15:59 — the attacker deploys an Ethereum contract built for one purpose: draining wallets.
20:05 — outflows begin on the XRP Ledger: 233 million XRP leave five Binance wallets.
20:10 — wallets on Solana and Optimism are emptied.
20:20 — 18,270 BTC leave a Bitcoin hot wallet, and 612 million USDT leave Tron.
20:20 — on Ethereum, the “Binance 14” hot wallet is linked to the attacker’s contract via EIP-7702.
20:23 — a single transaction empties Binance 14: about 167,000 ETH and 63 tokens, nearly $2.5 billion in one block.
22:15 — Binance pauses withdrawals, 2 hours 10 minutes after the start.
23:05 — a second wave hits wallets on Avalanche and Polygon.
00:10 (Oct 30) — Binance finally cuts Binance 14’s link to the attacker’s contract.

In the meantime, everything arriving in Binance 14 was swept again.

A 200 million USDT deposit vanished in 72 seconds, according to Cauê’s analysis.

How the hackers got into Binance

In its first explanation, Binance said the attack may have started with a compromised engineer’s laptop.

That access reportedly led to an internal service able to submit unauthorized withdrawal transactions.

Co-CEO Richard Teng later said there were other entry points and that more than one person took part in the operation.

No cryptography was broken.

According to Binance, private keys did not leak: the attacker turned the exchange’s own signing infrastructure against it.

The EIP-7702 trick on Ethereum

On Ethereum, the attack was more sophisticated.

EIP-7702, introduced in Ethereum’s Pectra upgrade in May 2025, lets an ordinary wallet run a smart contract’s code with a single signature.

The attacker submitted 50 authorizations at once, each valid for a different position in the wallet’s transaction queue (its nonce).

Because the hot wallet processes withdrawals constantly, the queue kept moving — only one authorization needed to match. One did.

We explain the mechanism in detail, and how to protect your own wallet, in EIP-7702: the feature used in the Binance hack.

Who hacked Binance? The North Korea trail

TRM Labs attributes the attack with high confidence to TraderTraitor, North Korea’s top hacking unit, linked to the Lazarus Group.

Chainalysis reached the same conclusion.

Investigator ZachXBT showed that part of the stolen funds went through THORChain and was commingled, at the same address, with proceeds of the Bitget hack, also attributed to North Korea.

The pattern repeats across Bybit, Bitget and Binance: instead of breaking cryptography, the attacks target people and processes.

As of October 30, no government had officially confirmed attribution. The FBI and US Secret Service are involved in the investigation.

The race to freeze the funds

At 21:01 UTC, Tether froze 971 million USDT. At 21:04 UTC, Circle froze 823 million USDC.

Ripple, World Liberty Financial and the Arbitrum Security Council followed.

In total, about $2.7 billion was frozen, according to TRM Labs.

That is only possible because stablecoins have an issuer that can lock tokens.

The attacker knew it: in under 20 minutes, it swapped $325 million in stablecoins for ETH, accepting a loss of about $40 million to escape the freezes.

On Tron, 300 million USDT were turned into TRX.

ETH and BTC have no issuer, so no one can freeze them directly.

The hacker still holds more than 420,000 ETH and 18,270 BTC, according to TRM Labs.

Chart of funds stolen from Binance by network: Ethereum $3.79bn, Bitcoin $1.47bn, Tron $628M; about 42% frozen and 58% still with the attacker

Market impact: Bitcoin, Aave and Binance’s reserves

Bitcoin fell about 5% after the announcement and traded below $78,000 on Friday (Oct 30), according to CNBC.

On Aave, the attacker deposited 60 million USDT to borrow ETH.

The platform froze new deposits and loans as a precaution, and USDT utilization hit 100%.

According to CryptoQuant, 22,158 net BTC left Binance wallets on Oct 29, the second-largest daily outflow since 2017 — but about 82% of that was the theft itself.

What Binance is doing now

Binance has pledged that users will not bear the loss.

The exchange set aside more than $6.34 billion of its own funds, drawing on its SAFU emergency fund, part of its futures insurance fund and its corporate treasury.

On Saturday (Oct 31), Binance said it had replenished 90% of the affected assets, CNBC reported.

BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed 100%, according to the company.

The remaining 10% are less liquid tokens that will be bought on the market and over the counter.

The next milestone is resuming withdrawals on Sunday (Nov 1), in phases and subject to security checks.

If you hold funds on the exchange, read our guide Binance hacked: what to do now.

What we still don’t know

The response was fast: billions frozen within about an hour and coverage announced the same night.

But it is still unclear how 50 signed authorizations got past Binance’s controls.

It is also unknown whether frozen funds will be returned, or how long that would take.

According to Chainalysis, returning frozen assets requires legal process and can take months or years.

This article will be updated as the investigation progresses.