Skip to content
Finance

Binance Hack: $6.3 Billion Hit in Largest Crypto Theft on Record, Withdrawals Paused

Binance says a security incident hit about $6.3 billion in crypto, the largest theft on record per analysts. About $3 billion is frozen, withdrawals are paused and Binance says SAFU and company funds will cover all losses.

Raj ·Founder & Editor
Published in Finance · 6 min read ·
An open steel vault door in a dark server room with gold coins spilling across the floor
An open steel vault door in a dark server room with gold coins spilling across the floor
In this article

    As of 9:30 AM IST, Friday 30 October 2026. This is a developing story: Binance has published only preliminary findings, and the amounts, frozen totals and prices below come from the sources named and may change. Times are converted to IST from UTC and US Eastern time.

    Binance, the world's largest cryptocurrency exchange, says a "security incident" has hit about $6.3 billion of assets, in what blockchain analysts describe as the largest crypto theft on record. Roughly $3 billion has been frozen with the help of stablecoin issuers and other partners, deposits and withdrawals are suspended, and Binance says it will "cover all losses" from its SAFU emergency fund and company money. Crypto prices fell sharply, with BNB down about 8% at one point.

    What happened

    According to blockchain intelligence firm TRM Labs, an attacker began moving funds out of Binance wallets at 20:05 UTC on Thursday, 29 October (1:35 AM IST on Friday), and took most of it in about 20 minutes. Binance wallets on ten blockchains sent their balances to attacker-controlled addresses: Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. A second wave hit Avalanche and Polygon wallets around 23:05 UTC (4:35 AM IST). Arkham's chief executive, quoted by Reuters, put the start at about 4:30 PM US Eastern time (2:00 AM IST).

    TRM's breakdown of the outflows, valued at the time they were taken, includes:

    • Ethereum: about $3.79 billion, including 200,630 ETH, 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.
    • Bitcoin: 18,270 BTC, about $1.47 billion.
    • Tron: 612.7 million USDT and 46.4 million TRX, about $628 million.
    • XRP Ledger: 233.46 million XRP, about $296 million.
    • Solana: 970,500 SOL, about $96 million.

    How big is it?

    The estimates differ slightly. Binance puts the total impact at "around $6.3B". TRM's count is about $6.36 billion, or roughly four times the $1.5 billion Bybit hack of February 2025, which the BBC calls the previous record. According to CNBC, Chainalysis estimated about $5.91 billion at the time of the theft. Arkham found nearly $6 billion across 55 wallet addresses. The differences come mostly from timing and from how each firm prices the stolen tokens.

    How the attack worked (so far)

    In its security incident update, Binance said its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." It added: "We have found no evidence of any wallet private key leak." A full technical post-mortem will follow once the facts are verified.

    TRM's on-chain analysis adds detail but has not been confirmed by Binance. On Ethereum, it says the attacker used EIP-7702, a 2025 Ethereum feature that lets an ordinary wallet hand control to smart-contract code. The attacker submitted 50 authorizations signed in advance by a Binance hot wallet, one for each of 50 consecutive transaction counts, so that one would still be valid however many withdrawals the wallet processed in the meantime. That turned the hot wallet into a "sweeper" controlled by the attacker, which emptied it of 167,464 ETH and 1.615 billion USDT in a single transaction, then swept new funds as they arrived. Because Binance wallets on nine other chains, which use different key types and signing schemes, also produced valid signed transfers to the attacker, TRM's assessment is that Binance's hot-wallet signing system was compromised, rather than individual keys. TRM says preparation began at least 36 hours earlier, with small Tornado Cash withdrawals funding the attacker's wallet.

    Who is behind it?

    Binance has not named anyone, but says it is working with law enforcement "to confirm the identity of these criminals". TRM attributes the attack "with high confidence" to TraderTraitor, a North Korean state hacking unit that the FBI has blamed for the Bybit theft. Investigator ZachXBT said the attacker was "likely Lazarus", the wider North Korean group, and security firm Blockaid said the tactics were consistent with North Korean operations, CoinDesk reported. North Korea has previously denied hacking crypto exchanges. Treat the attribution as an analysts' assessment until officials confirm it.

    Freezes: about $3 billion locked, about $2.4 billion out of reach

    Stablecoin issuers moved within minutes. TRM says Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC (2:31 AM IST) and about 1.77 billion USDT in total, while Circle froze about 825 million USDC. Ripple froze 40.5 million RLUSD, and World Liberty Financial froze 27.8 million USD1. Arbitrum's Security Council used its emergency powers to move 8,426 ETH and 74.6 million ARB out of the attacker's wallet. Binance's own figure for assets frozen rose from $2.54 billion to "~$3 billion"; TRM counted about $2.7 billion on-chain as of 00:30 UTC (6:00 AM IST).

    The attacker raced the freezes. TRM says about 325 million USDT was sold to market makers for roughly 122,300 ETH at a discount of more than 10%, and stolen USDT was posted on the lending protocol Aave to borrow about 19,760 ETH. Aave then froze new deposits and borrowing on its markets as a precaution, saying its contracts were unaffected. By TRM's count, the attacker still controls more than 420,000 ETH and the 18,270 BTC, about $2.4 billion that no issuer can freeze.

    A freeze is not the same as getting money back. TRM's Ari Redbord told CNBC that returning frozen stablecoins usually requires a court order or seizure warrant: "The freeze takes minutes. Returning the money takes longer, but the path exists." Chainalysis's Eric Jardine said recovery "can take months or years".

    Binance's response and user funds

    • Reimbursement: Binance says it "will cover all losses from the SAFU fund and the company's funds" and that "user funds are safe". Co-CEO Yi He wrote on X that "Binance will cover all hacking losses."
    • SAFU: the Secure Asset Fund for Users, set up in 2018, is held in bitcoin and was worth roughly $1 billion, according to CoinDesk. The rest of any shortfall would have to come from Binance's own funds, which it has not quantified.
    • Withdrawals: deposits and withdrawals are suspended, with no restart time. Yi He said withdrawals would resume "as soon as the security scan is complete." Binance also paused trading on its Binance Alpha platform as a precaution, according to Reuters.
    • Other steps: Binance revoked the affected address authorisation and says it will publish an updated Proof of Reserves after remediation.
    • Not affected: Binance.US and Coinbase both said they were not affected.

    Founder Changpeng Zhao, who no longer runs the company but remains a major shareholder, said on X that it "does look like a hack," the BBC reported. Binance has more than 300 million registered users, according to the BBC.

    Market reaction

    Crypto prices fell as the news spread. In a Cointelegraph update at 1:19 AM UTC (6:49 AM IST), citing CoinGecko, BNB was near $693, down about 8.2% over 24 hours. Bitcoin was down 4.8% at about $77,131 and ether down 5.7% at about $2,217. DeFi tokens fell harder: AAVE dropped 11.3% and UNI 10.4%. The Crypto Fear and Greed Index fell to 30, "fear", its lowest since 14 August. Reuters, via CNA, reported that Coinbase shares fell 4.8% and Strategy shares nearly 6% in extended US trading.

    Prices recovered part of that by morning in Asia. The CoinGecko API data we read at about 9:26 AM IST showed:

    AssetPrice (USD)24-hour change
    Bitcoin (BTC)78,013-2.2%
    Ether (ETH)2,231.92-3.2%
    BNB717.72-3.7%

    Analysts quoted by Reuters said the breach could make investors rethink the safety of assets held on centralised exchanges, at a time when crypto was already under pressure from higher US interest rates.

    What to watch

    • When Binance resumes withdrawals, and its technical post-mortem and updated Proof of Reserves.
    • Whether the remaining roughly $2.4 billion in ETH and BTC moves through bridges, mixers or OTC brokers, which TRM expects next.
    • Whether law enforcement confirms the North Korea attribution, and how quickly frozen stablecoins can be returned.

    What users can do

    Binance urged users to rely only on its official channels for updates. Hacks like this are usually followed by phishing messages offering fake "refunds" or "withdrawal unlock" links. Do not share passwords or two-factor codes, and do not send crypto to anyone promising to recover funds.

    Disclaimer: This article is for information only and is not financial advice or a recommendation to buy, sell or hold any cryptocurrency or security. Crypto assets are volatile and you can lose money. Do your own research and consider speaking to a qualified professional before making investment decisions.

    Related reading on HorizonDesk

    Sources

    CybersecurityNorth KoreaBinanceCrypto HackCryptocurrencyBitcoinBNBSAFU
    Follow via RSS

    Written by Raj

    Founder & Editor

    I write HorizonDesk: practical, no-hype articles on technology, money, business and the vehicles we drive. Everything here is something I’ve researched, tested or wanted explained clearly myself.

    More from HorizonDesk

    See all in Finance