Binance hack: how $6.3B was stolen and who's at risk
The Binance hack is the largest crypto theft on record. How attackers got in, where the money went, who's blamed, and whether other exchanges should worry.
On this page 7 sections ▾
TL;DR
- Binance says customer balances weren't touched and it has set aside more than $6.34 billion of its own money to cover the loss.
- About 44% of the stolen crypto is frozen so far, almost all of it stablecoins; the rest is being swapped and moved to make it harder to trace.
- Analysts blame North Korea's TraderTraitor group, the same unit linked to the 2025 Bybit hack.
The Binance hack is the October 29, 2026 theft of about $6.3 billion in cryptocurrency from Binance's hot wallets, the largest crypto theft on record.
Quick facts
Most of the money left Binance in about 20 minutes, starting at 20:05 UTC, from wallets on 10 or more different blockchains.
The attackers sold some stolen stablecoins at losses of up to 26%, because a token at a discount was worth more to them than one that could be frozen.
If North Korea is behind it, as analysts believe, this one theft would nearly double the roughly $6.5 billion in crypto its hackers are estimated to have stolen in recent years.
Elliptic notes it's more than six times the $1 billion Saddam Hussein reportedly took from Iraq's central bank in 2003.
For your information
This story is still developing. Figures are as of October 30, 2026, and they vary slightly by source: Binance puts the loss at about $6.3 billion, TRM Labs at $6.36 billion and Elliptic at $6.43 billion, depending on which transfers and prices each one counts.
#How was Binance hacked?
Binance's early findings point to a compromised DevOps engineer's laptop, which the attacker used to reach a service container and submit withdrawals Binance never approved. Binance later said it found more points of breach, says it has no evidence that private keys leaked, and has promised a full post-mortem.
On Ethereum, the attacker used a feature called EIP-7702, added in Ethereum's Pectra upgrade, to attach their own code to a Binance hot wallet so it behaved like a sweeper only they controlled. They sent 50 pre-signed authorizations in one go so at least one would be valid, and about three minutes later the wallet emptied 167,464 ETH and 1.615 billion USDT, then kept sweeping new deposits that arrived afterwards.
ELI5: explain it simply▾
THE WORDS
- Hot wallet
- A crypto wallet kept online so an exchange can process withdrawals quickly.
- EIP-7702
- An Ethereum feature that lets a normal wallet run a piece of program code.
- Sweeper
- Code that automatically moves everything in a wallet to another address.
- Pre-signed
- Approved in advance with the wallet's signature, ready to use later.
THE IDEA
Imagine a shop till that can be fitted with an automatic attachment. Normally only the manager can approve one. The attacker got a manager-approved attachment fitted that sends every bill in the till, and every bill added later, straight to their own bag.
did not pass through our normal approval controls
On the other chains, including Bitcoin, Tron and the XRP Ledger, the money left in ordinary signed transfers, which is why TRM Labs and Elliptic both conclude the attacker got Binance's own hot wallet signing system to approve the theft. Teng also said the attacker used a self-destruct mechanism that wiped their tooling and traces.
Did you know
According to Immunefi's Simone Imbrescia, the malicious sweeper contract was only about 130 lines of code. The hard part was never the code, it was reaching a system that could authorize it.
- Attacker funds an operator wallet with small Tornado Cash withdrawals
- Attack code is tested on two wallets, rehearsed on a third, then installed on a Binance hot wallet
- Five Binance XRP wallets send 233.46 million XRP to the attacker
- 18,270 BTC leaves a Bitcoin hot wallet and the Ethereum delegation goes in
- Tether freezes 971.1 million USDT in the main receiving wallet
- Circle freezes 823 million USDC with law enforcement
- A second wave drains Avalanche and Polygon wallets
#Where the stolen crypto went
Binance hack losses by blockchain
Stablecoin issuers moved fast: Tether froze the main attacker wallet 37 minutes after the USDT arrived, Circle froze 823 million USDC three minutes later, and Ripple, World Liberty Financial and the Arbitrum Security Council froze or pulled back more. Elliptic has verified $2.84 billion frozen, about 44% of the total, and 94% of that is stablecoins.
For your information
Freezing only works on tokens with an issuer that can block them, like USDT and USDC. Nothing stolen as native Bitcoin, XRP or Solana has been frozen, because no company controls those coins.
That's why the attacker raced to swap stablecoins into ETH and TRX before the freezes landed, even at a heavy loss, and borrowed 19,762 ETH from the lending platform Aave against stolen USDT before Aave froze those markets. Elliptic estimates the attacker still controls about $3.33 billion in assets nobody can freeze, including 18,270 BTC split across 19 addresses that hasn't reached any service yet.
#How the attackers try to cash out
Stolen crypto is only useful to the attackers once it can't be traced back to the hack, so the next phase is laundering it. That has barely started: as of October 30, Elliptic said almost none of the money had reached a bridge, mixer or exchange, apart from about $1.9 million of TRX, some of it routed through the cross-chain swap service THORChain. The stolen XRP, SOL and NEAR, worth about $445 million, hasn't moved at all.
- Swap what can be frozenAlready under way: stablecoins that their issuers can block were traded for ETH and TRX, which nobody can freeze.
- Scatter it across walletsChainalysis says the funds are cycling through networks of addresses in automated loops, with thousands of transactions in short bursts and "laundering patterns we have not seen before."
- Hop between blockchainsBridges and swap services move value from one blockchain to another, which breaks the trail on any single chain. After the Bybit hack, nearly all the stolen ETH was turned into bitcoin, mostly through THORChain, within about 10 days.
- Run it through mixersMixers pool coins from many users and pay out different coins, so outsiders can't tell whose came from where. Bybit's bitcoin started going into mixers such as Wasabi and CryptoMixer once the swaps were done.
- Cash outThe last step is turning crypto into ordinary money through over-the-counter (OTC) brokers and exchanges, which is what Elliptic expects here. After Bybit, the FBI said it expected the funds to be "further laundered and eventually converted to fiat currency."
ELI5: explain it simply▾
THE WORDS
- Laundering
- Moving stolen money around until it can't be connected to the crime and can be spent openly.
- Bridge
- A service that moves value from one blockchain to another.
- Mixer
- A service that pools coins from many people and pays out different coins to hide who sent what.
- OTC broker
- A dealer who trades large amounts of crypto for regular money privately, off the public exchanges.
THE IDEA
Think of a thief with a truck of marked bank notes. They can't spend them as they are, so they swap them for unmarked notes, split them among many helpers, change them into other currencies abroad, and finally pay a shady money changer to turn them into clean cash. Every swap costs them money and leaves a chance to get caught.
Expect this to take months. Elliptic says Bybit's laundering "took months, and we expect the same here," though it notes this attacker is behaving differently, holding stablecoins longer and using far fewer bridges than after Bybit. Size works against them too: TRM Labs observed after Bybit that mixers typically handle a few million to perhaps $10 million a day, so billions can't disappear quietly. Every hop is another chance to flag the funds, and Elliptic labeled the first Bybit-linked addresses within 18 minutes.
For your information
Why it matters beyond Binance: a UN Panel of Experts report published in March 2024 said about 40% of North Korea's weapons of mass destruction programs are funded by illicit cyber means. If the attribution holds, every frozen or traced dollar is money that doesn't reach those programs.
#Who hacked Binance?
TRM Labs attributes the theft with high confidence to TraderTraitor, the North Korean hacking unit the FBI previously linked to the Bybit hack. The shared playbook includes small Tornado Cash withdrawals to fund an operator wallet, staging well before the theft and pre-obtained signatures fired off in one burst, the same pattern seen in the Bybit hack and the April 2026 KelpDAO hack.
For your information
No government has confirmed the attribution yet. After Bybit, the FBI named North Korea within five days. Elliptic calls North Korea the likely culprit but notes that the on-chain overlap with last month's Bitget exploit is small and that a shared launderer doesn't prove a shared hacker.
#Is money on Binance safe?
Binance says the hack hit its hot wallets, not customer balances, that most user assets sit in cold wallets, and that it has set aside more than $6.34 billion of company funds to cover the losses, about $5 billion of it already held in the stolen tokens. It paused withdrawals to rebuild and retest its systems, aims to restore them by Sunday, and plans a full proof-of-reserves report by Monday.
ELI5: explain it simply▾
THE WORDS
- Cold wallet
- A wallet whose keys are kept offline, so it can't be drained over the internet.
- Proof of reserves
- A public report showing an exchange holds enough crypto to cover what customers own.
THE IDEA
An exchange works like a bank with a cash drawer and a vault. The cash drawer, the hot wallet, holds enough for daily withdrawals and was emptied here. The vault, the cold wallet, holds most customer money offline and wasn't touched, and Binance says it will refill the drawer from its own pocket.
On October 30, Bitcoin fell about 5% to just under $77,000, Ether dropped about 4% and Binance's BNB token lost more than 6%, though a Fundstrat analyst said it doesn't look like a solvency event for Binance.
For your information
Binance has covered a hack before. In May 2019 attackers used phishing and malware to withdraw 7,000 BTC, worth about $41 million then and about 2% of its bitcoin holdings, and Binance said its secure asset fund for users would cover the loss.
Did you know
Binance founder Changpeng Zhao pointed out it's the biggest crypto theft in dollars but not in bitcoin: Mt. Gox lost about 650,000 BTC, compared with the 18,270 BTC taken here.
#Should you worry about other crypto exchanges?
The worry isn't Binance in particular, it's the method. Bybit lost $1.46 billion in February 2025 in a similar way, and Elliptic draws that comparison directly: in both cases the attackers went after the people and systems around the wallets, not the cryptography. Any exchange whose engineers can reach the systems that sign withdrawals faces the same kind of risk.
- Coinbase adjusted how it stores keys offline as a precaution, blocked sends to the attacker's wallets and offered Binance help.
- Kraken said it's studying the incident for lessons for its own defenses.
- OKX CEO Star Xu called for a real-time industry alert system so exchanges can share warnings and temporarily freeze suspected stolen funds during a hack.
If you keep crypto on any exchange
- Turn on the strongest login protection it offers, like a passkey or an authenticator app instead of SMS codes
- Turn on a withdrawal address allowlist so funds can only go to addresses you've approved
- Check whether the exchange publishes proof-of-reserves reports, and how recently
- Treat any "Binance support" message about the hack as a likely scam, and only use the exchange's official site or app
- Know the trade-off of moving long-term holdings to a wallet you control: no exchange can lose it, but losing your keys means losing the funds
Note
None of this is financial advice. It's general account security, and whether to keep funds on an exchange is your call.
#What exchanges are being told to fix
Custody firm Fireblocks sums up the root problem as signing authority that could be reached from engineering machines without a second cryptographic barrier. Its fixes are classic security engineering: take signing and deployment off developer laptops and into isolated environments, require several people to approve any change to wallet permissions, keep hot-wallet keys in MPC or HSM custody, and cap how much a hot wallet holds at once.
How was Binance hacked?
Who hacked Binance?
How much was stolen in the Binance hack?
Were Binance customers' funds stolen?
Can the stolen crypto be recovered?
What this means for you
If you work in IT, this hack is a lesson in least privilege, separation of duties and endpoint security: one engineer's laptop could reach the system that signs withdrawals. Those are core Security+ topics, and CertPrep+ has practice for Security+ (SY0-801) along with 11 other certs if you want to drill them.
Sources