Binance $6.3 Billion Hack: What Is Confirmed, What Is Not, and What It Means for Anyone Who Keeps Crypto on an Exchange

On the evening of Thursday 29 October 2026, in about twenty minutes, an attacker moved roughly $6.3 billion out of Binance wallets across ten blockchains. It is the largest crypto theft on record, about four times the $1.5 billion taken from Bybit in February 2025. Binance says it will absorb the loss and that user funds are safe. The FBI says North Korea did it. Several central questions remain open, starting with how the attacker got in. This article separates what the primary sources establish from what is still claim, as of the early hours of 1 November 2026.

The short version

• Confirmed by Binance: a security incident affecting about $6.3 billion in client assets. It suspended deposits and withdrawals on Thursday, revoked the affected address authorizations, and says it found no evidence that any wallet private key leaked.
• Confirmed by on-chain analysts: TRM Labs counts about $6.36 billion moved from Binance-attributed wallets on ten blockchains, most of it in around 20 minutes. Chainalysis counts about $6.4 billion.
• Confirmed by the FBI: on Saturday 31 October the FBI, with the Secret Service and IRS Criminal Investigation, attributed the attack to TraderTraitor, a North Korean state-linked group, according to NPR's report of the statement. The same unit was named for the Bybit theft.
• Frozen: roughly $2.7 to 2.8 billion according to TRM and Chainalysis, mostly stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial. Binance said about $3 billion.
• Not known: the root cause. Binance first pointed to a compromised DevOps engineer's laptop, then said the investigation had found additional points of breach and that the attack was more complex than one engineer's permissions. A technical post-mortem has been promised, not published.
• Binance's pledge: it says it has replenished about 90% of the stolen assets and will cover the rest. Withdrawals were targeted to restart on Sunday 1 November.

Timeline

Wednesday 28 October, morning. According to TRM, the attacker's operator wallet receives three small withdrawals from Tornado Cash, the first sign of preparation. TRM says preparations began at least 36 hours before the theft.

Thursday 29 October, early. TRM says the operator deployed a first piece of code and tested it on two wallets, then rehearsed the final version on a third wallet and routed the test funds back to itself. About four hours after that rehearsal the same code was installed on a Binance hot wallet.

Thursday 29 October, 20:05 UTC (16:05 New York). The first theft, per TRM, is on the XRP Ledger: between 20:05 and 20:09 UTC five Binance wallets send 233.46 million XRP to a single attacker address. Wallets on Solana and Optimism follow shortly after 20:10. At 20:20 a Binance Bitcoin hot wallet sends 18,270 BTC to an attacker address, which begins splitting it into round pieces inside the same block. Within two minutes a Tron hot wallet sends 612.7 million USDT and 46.4 million TRX. Chainalysis dates the start of the outflows to about 16:20 New York time, which is 20:20 UTC, consistent with the Ethereum sweep described below.

Thursday 29 October, 21:01 to 22:26 UTC. Freezes begin. Per TRM, Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, 37 minutes after the main sweep. Circle froze 823 million USDC at 21:04. Ripple froze RLUSD at 22:01 and World Liberty Financial froze USD1 at 22:10. Chainalysis says freezes began by 17:14 New York time (21:14 UTC).

Thursday 29 October, 23:05 UTC. A second wave, per TRM, reaches Binance wallets on Avalanche and Polygon. The same night Binance says the verified total frozen has reached $2.54 billion.

Friday 30 October. Binance states that the impact is about $6.3 billion with about $3 billion frozen, that it will cover all losses from its SAFU fund and company funds, and that initial findings suggest a compromised DevOps engineer's laptop. TRM and Chainalysis publish attributions to North Korea. Bitcoin hits a six-week low of $76,368 and Ether a two-month low of $2,178, per Al Jazeera. Later that day Binance says it found additional points of breach.

Saturday 31 October. The FBI confirms North Korea responsibility. Binance reports that it has replenished about 90% of the stolen assets, up from about 80% in its previous update, and publishes a new proof of reserves snapshot.

Sunday 1 November. Binance's stated target to begin resuming withdrawals. We could not confirm at the time of writing whether it had happened. A full proof of reserves report was promised by Tuesday 3 November.

What was taken, chain by chain

TRM traced every transfer from Binance-attributed wallets to attacker-controlled addresses and valued each at the price of the asset at the moment it was taken. Its figures, as of 30 October 00:30 UTC:

Total: about $6.36 billion at the time of theft. At prices of 30 October, TRM valued the same assets at about $6.23 billion. Chainalysis rounds to $6.4 billion and Binance to $6.3 billion. Binance has also warned that the figure may continue to increase as it traces more assets. The differences are about valuation date and method, not a disagreement about what happened.

How the attacker moved: what the on-chain record shows

The most detailed public technical account is TRM's. It is an analysis of public blockchain data, not a statement by Binance, and it should be read as such.

Ethereum. The attacker used a mechanism called EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, which lets an ordinary wallet hand control of its behavior to a smart contract by signing an authorization. At 20:20 UTC the operator submitted a single transaction containing 50 authorizations, each signed by the Binance hot wallet, each pointing the wallet to a contract that accepts instructions only from the attacker. Because an authorization is valid only at a specific transaction count and the hot wallet processes a steady flow of withdrawals, preparing signatures for 50 consecutive counts guaranteed that one would still be valid on execution. One matched. Three minutes and 24 seconds later the operator instructed the wallet to send its whole balance out, which moved 167,464 ETH and 63 tokens including 1.615 billion USDT. The delegation stayed in place, and TRM says the attacker swept new arrivals again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.

Everything else. On the other nine chains and on a second Ethereum hot wallet, TRM says funds left through ordinary signed transfers, with no delegation. These wallets use different chains, key types and signing schemes, yet all produced valid signatures for the attacker within about half an hour.

From that pattern TRM draws its central assessment: the most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains. The batch of 50 pre-signed authorizations suggests either that the access was limited in time or that signatures had to be requested through a system. TRM adds, plainly: "Binance has yet to publish a root cause."

Early commentary had suggested the Ethereum authorizations were phished. TRM says that explanation covers Ethereum and leaves the other chains unexplained. We therefore treat "phishing" as unsupported for the incident as a whole.

What Binance says about the cause

Binance's statements, in order:

1. Friday 30 October. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified."
2. Later the same day. Co-CEO Richard Teng said the attack involved a more complex process than the misuse of a single engineer's permissions, according to CNBC. Binance then said further investigation had uncovered "additional points of breach", without specifying them.
3. Friday 30 October. Teng said on X that the investigation "has not attributed responsibility to any individual", per Al Jazeera.

Two readings are worth keeping apart. "No evidence of a private key leak" is a statement about what Binance has found so far, not a proof that no key was exposed. In an interview with Reuters reported by Al Jazeera, former Mt. Gox chief Mark Karpelès said the attackers had probably accessed the keys for at least two Binance wallets. That is the opinion of an outside expert who has not seen Binance's systems, and Binance has not confirmed it. Second, the signing pattern TRM describes is consistent with a compromise of signing infrastructure and does not require a leaked key: an attacker who can get a legitimate signing system to sign never needs to hold the key. We note that as an analytical point, not as a finding about Binance.

Who did it: three layers of attribution

Attribution here rests on three separate sources, and they are not equally strong.

1. TRM Labs. TRM attributes the attack with "high confidence" to TraderTraitor, the North Korean unit the FBI named for the Bybit theft of February 2025. Its reasons are on-chain and off-chain intelligence it does not fully disclose, plus features shared with the Bybit hack and the KelpDAO hack of April 2026: small Tornado Cash withdrawals funding an operator wallet, preparation starting well before the theft, and signatures obtained in advance and executed in one burst. TRM also notes that the laundering so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern after Bybit.

2. Chainalysis. Chainalysis assessed that TraderTraitor was responsible, citing on-chain activity in the hours after the theft, and said the strongest evidence came when it saw funds stolen from Binance commingle in real time with funds from the Bitget theft of September, which had been attributed to North Korean actors. It announced the assessment at 00:30 New York time on 30 October.

3. The FBI. On Saturday the FBI, with the Secret Service and IRS Criminal Investigation, confirmed North Korean responsibility. NPR quotes the statement: "The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages." According to TokenPost, the FBI also published hundreds of related addresses across Ether, Bitcoin and Solana and urged THORChain node operators, RPC node operators, instant-exchange platforms, DeFi services and analytics firms to block transactions involving them. The FBI's own page was not accessible to our tools, so we rely on NPR and TokenPost for the text.

The FBI statement is the strongest of the three. It is still an attribution by a government agency, and North Korea routinely denies involvement in crypto theft, as Al Jazeera notes. Binance, for its part, has said it has not attributed responsibility itself, and says it is working with law enforcement to confirm the identity of those responsible.

The race against the freezes

The most useful lesson in the data is about speed. Here is what the analysts documented.

What was frozen. TRM counts about $2.7 billion frozen on-chain as of 30 October 00:30 UTC: about 1.77 billion USDT frozen by Tether, about 825 million USDC frozen by Circle, 40.5 million RLUSD frozen by Ripple, 27.8 million USD1 frozen by World Liberty Financial, and roughly $30 million in ETH and ARB moved out of the attacker's reach by the Arbitrum Security Council, a group that can take emergency action on that network. Chainalysis counts about $2.8 billion. Binance's own tally on the night was $2.54 billion verified, later "around $3 billion". Counts differ because they were taken at different hours and with different scopes.

What the attacker did in response. Both firms describe an attempt to convert freezable stablecoins into assets no issuer can freeze, at a cost. TRM says about 325 million USDT was sold to market makers through UniswapX and other intent-based contracts for about 122,300 ETH, a price near $2,650 per ETH when ETH traded around $2,300 to $2,350, a discount of more than 10%. A second wallet supplied 60 million USDT to the lending protocol Aave and borrowed about 19,760 ETH against it, after which Aave froze the affected markets. Chainalysis describes the same effort as swapping $325 million in stablecoins for $285 million in ETH over nearly 20 minutes. On Tron, 300 million USDT moved to a wallet that began supplying it to the JustLend lending protocol.

What remains out of reach. TRM estimates that the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets beyond any issuer's reach, as of its 30 October snapshot. Chainalysis describes laundering patterns it says it has not seen before: thousands of automated transactions in a short time, with funds repeatedly circulated among addresses and many addresses first receiving exactly 1 TRX. Both firms expect the funds to keep moving in the coming days toward bridges, swap services and over-the-counter brokers.

What "frozen" means. Ari Redbord of TRM Labs told CNBC that "a freeze stops the money from moving, and recovery follows through legal process", usually through a court order or seizure warrant. Eric Jardine of Chainalysis added that returning frozen assets requires coordination among law enforcement, exchanges and issuers, and that "there is no standard recovery timeline". A frozen balance is not a returned balance. Stablecoins are the most recoverable asset class because the issuer controls the token contract, while recovering Bitcoin and Ether means tracing them to a cooperating exchange.

Binance's response: the claims and the checks

Binance's third update, published on 31 October, makes concrete claims. We list them with the way to check each.

• "More than $6.34 billion" set aside in company funds to cover the loss. This is a Binance statement about its own balance sheet. We have not seen an independent verification.
• "Approximately 80%", then "90%" of the stolen assets replenished. Binance says the replenishment used a partial deployment of its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund, and its own corporate treasury, and that it continues to buy the remaining assets on the market and over the counter. The outstanding 10% consists of less liquid tokens outside the top ten.
• "All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed 100%." This is the claim that matters most to customers, and it is a claim about Binance's own reserves. A new proof of reserves snapshot dated 31 October 00:00 UTC was published. Binance says the full zero-knowledge proof takes 40 to 50 hours to generate and will be complete by Tuesday 3 November, after which users can verify their own balances are at least 1:1 backed. Until then the snapshot is a statement, not a completed proof. Teng had earlier targeted Monday 2 November for a full report, according to TokenPost; the 3 November estimate is from Binance's third update.
• SAFU. Binance says SAFU is held and managed by Nest Clearing and Custody Limited, a recognized clearing house regulated by the Abu Dhabi Global Market's financial regulator, and that it will replenish SAFU to about $1 billion. Al Jazeera puts SAFU at $1 billion before the incident, and an analyst quoted by CNBC puts it at about $1.2 billion. Either way it is a fraction of the loss: the stolen sum is more than six times the fund as Al Jazeera describes it.
• Futures insurance fund. Binance says it released only the excess above the level its risk framework requires, and that the remainder is a regulatory requirement.

Sean Farrell of Fundstrat Global Advisors told CNBC that the incident "does not currently appear to create meaningful solvency risk for Binance", with the key indicators being how fast withdrawals resume and whether outflows stay orderly. That is one analyst's view as of 30 October, and a restart is a test, not a guarantee.

The market reaction

Bitcoin hit $76,368, a six-week low, and Ether fell more than 3% to $2,178, a two-month low, according to Al Jazeera, which cites Reuters for the market reaction. Coinbase, which said it was unaffected, fell about 4.8%. CNBC notes that crypto was already under pressure from higher US interest rates and weaker demand for exchange-traded funds. We caution against attributing the whole move to this one event.

The Europe question

Most of our readers will ask the same thing: does this touch me? The honest answer is that the public record does not say which Binance entities or customer groups were affected.

• CNBC reports that the incident hit Binance's offshore platform and that its regulated US exchange did not suffer a similar issue.
• Binance's own statements describe "client assets" and "user funds" without naming entities.
• As we reported in Binance Halts All EU Services July 1, Binance suspended trading, lending and rewards for European users from 1 July 2026 after failing to obtain a MiCA licence. Anyone in the EU who still has an account should ask which entity holds it and under which terms.

We did not find a Binance statement that says European customers were or were not affected, and we are not going to guess. If you have funds with Binance in any form, read the official announcements and the support channel, not social media.

What this tells us about exchange risk

This section is general information, not financial advice, and we deliberately avoid telling anyone to move funds.

The facts support three points that hold whatever Binance's final accounting turns out to be.

1. Custody concentrates risk. Sean Foley of Macquarie University told Al Jazeera that "any assets held at a centralised exchange are only as safe as the exchange itself, and the larger the exchange's holdings, the larger a target it becomes". Tyler Moore of the University of Tulsa told CNBC there are no built-in protections for when such hacks take place and compared the situation with deposit insurance for bank customers. Others interviewed by CNBC disagreed: Ido Ben-Natan of Blockaid argued that because Binance pledged to cover everything, users should not lose money, and that exchanges can be a reasonable place to keep funds. Experts do disagree, and anyone telling you the answer is obvious is selling something.

2. The protection is the operator's balance sheet, not a rule. NPR notes that Binance is not necessarily bound to repay customers under current regulations, and quotes Amanda Fischer of Better Markets on how weak the regulatory framework for crypto is compared with traditional brokers. The same pattern appeared in the third quarter: in our review of Hacken's Q3 report, operators covered about $410 million for users out of their own funds. That is an observed outcome, not a guarantee, and it depends on an operator being solvent and willing.

3. Proof of reserves answers a narrower question than people think. A proof of reserves tells you whether declared reserves cover declared balances. It says little about how well signing systems and internal access are protected, which is where this incident happened. It is still worth checking, and how to read one is explained in our proof of reserves guide. In this case, Binance's own promised proof is the thing to watch from 3 November.

Practical points that follow from the record

• Expect scams. Large incidents are followed by fake recovery offers and phishing. Binance asks users to rely only on official channels for updates. Nobody legitimate will ask for a seed phrase, password or verification code to "restore" access.
• Know which entity holds your account and which regulator supervises it. It determines which protections, if any, apply.
• Keep only what you need on any exchange. How much that is, is your decision. Our guides on multisig self-custody and on inheritance planning cover the alternative and its own risks, which this year's hardware wallet incidents show are real: see our reconstruction of the Ledger case.

Context: how this compares

Binance is about four times Bybit, per TRM, and about 16 times Bitget. Chainalysis says Binance funds commingled on-chain with Bitget funds, which is why it describes the two as linked. That link is an analytical finding by Chainalysis, not a judicial one. For the Bitget case itself, and why 77% of third-quarter losses passed outside security reviews, see our analysis of Hacken's Q3 report.

Al Jazeera adds the geopolitical frame. The US Treasury sanctioned the Lazarus Group in 2019, saying it was controlled by North Korea's primary intelligence bureau. TRM's policy chief Ari Redbord says that when North Korea steals at this scale, "the money funds weapons proliferation and other destabilising activity". That is an assessment by experts, consistent with UN sanctions context described by Al Jazeera, and not something we can verify independently.

One more fact from the same day, reported by CNBC: the prediction market Polymarket halted trading on its international exchange after a third-party data provider was hacked, with at least $2.7 million drained from user wallets. It is a separate incident on a much smaller scale, and it points to the same theme of third-party components.

What we still do not know

• The root cause. Binance's first explanation (a compromised engineer's laptop) was followed by "additional points of breach". The promised technical post-mortem has not been published.
• Whether a signing system or keys were compromised. TRM's analysis points to the signing infrastructure. Binance says it has no evidence of key leakage. Both can be true, and neither is verified by a third party.
• Which customers and entities were affected, and whether any European accounts were involved.
• Whether Binance's 100% coverage claim holds up. The full proof of reserves is due by 3 November.
• The final loss and recovery. Estimates are $6.3 to 6.4 billion stolen and $2.7 to 3 billion frozen, but freezing is not recovery. About $2.4 billion was, per TRM on 30 October, in assets no issuer can freeze, and it is still moving.
• Whether withdrawals have actually resumed and in what order, at the time you read this.
• Any arrests or charges. There are none that we have found, and attribution to a state actor makes prosecution in the near term unlikely, though we cannot predict it.

Our assessment

The documented core is narrow and serious. A single actor, assessed by the FBI to be a North Korean state-linked unit, obtained the ability to move funds out of Binance wallets on ten blockchains within about half an hour. Whatever the final root cause, the on-chain pattern, with different chains and key types all yielding valid signatures in the same short window, makes it hard to explain as a single phished authorization.

The financial outcome for customers, if Binance's statements hold, is a loss borne by the company rather than by users. That outcome depends on a company's size and willingness, and it is not a feature of the system. A smaller exchange hit by an attack of this kind would not have had $6.34 billion to set aside. That, more than the headline number, is why the incident matters for how people think about counterparty risk.

We will update this article when Binance publishes its post-mortem and the completed proof of reserves, when the FBI or other authorities publish more, or if the loss figures are revised.

Frequently asked questions