Binance Hacked For $6.3 Billion: Everything You Need To Know

The October 29 attack drained assets across 10 blockchains, prompting Binance to suspend withdrawals, while industry partners froze approximately $3 billion. The exchange has committed more than $6.34 billion to cover the losses.

Pablo

Published:

Binance, the world’s largest cryptocurrency exchange, suffered the largest cryptocurrency theft in history after an attacker drained approximately $6.36 billion from its wallets across 10 blockchains on October 29, 2026.

Blockchain activity first raised suspicions around 20:00 UTC when billions of dollars began leaving wallets associated with the world's largest cryptocurrency exchange. Most outflows occurred within about 20 minutes.

The attack affected Binance wallets across Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. The estimated loss makes the incident approximately 4 times larger than the $1.5 billion Bybit hack in February 2025.

Binance initially acknowledged reports of a potential security issue and assured customers that their funds remained safe. The exchange subsequently suspended withdrawals while its security teams investigated the incident.

How Did the Binance Hack Happen?

Binance's initial investigation suggested an attacker may have compromised a DevOps engineer's laptop, accessed an internal service container, and submitted unauthorized withdrawal transactions.

However, the exchange later clarified that the attack involved multiple breach points and a more complex process than compromising a single employee's permissions.

Richard Teng clarified that “the attacker did not simply use one engineer's permissions” and that the attack wasn’t a “single 'one-click' action.”
[https://x.com/_RichardTeng/status/2116072080525656150">

Blockchain analysis firm TRM Labs' independent investigation offered additional technical details. Its analysis suggests that the attacker compromised Binance's hot-wallet signing infrastructure, enabling unauthorized transactions across multiple blockchains. On Ethereum, the attacker exploited EIP-7702, a feature that lets an externally owned wallet delegate execution to smart contract code through a signed authorization. The attacker prepared 50 pre-signed authorizations and used one to turn a Binance hot wallet into a sweeper controlled by the attacker. This allowed the attacker to drain the wallet and repeatedly collect incoming funds.

TRM also identified a preparation phase that started at least 36 hours before the theft, including test transactions and small withdrawals from Tornado Cash. Binance has yet to publish its complete technical post-mortem.

North Korea's TraderTraitor Suspected Behind the Attack

TRM Labs attributed the attack to TraderTraitor, a North Korean hacking group, with high confidence based on onchain and offchain intelligence. The firm identified similarities with previous North Korean-linked attacks, including the February 2025 Bybit exploit and the April 2026 KelpDAO incident.

Blockchain investigator ZachXBT also reported that funds from the Binance exploit and the previous $388 million Bitget exploit converged at the same address after passing through THORChain.

The finding suggests that the same actor may have carried out both attacks. The Bitget incident was also attributed to TraderTraitor.

Tether, Circle and Other Partners Freeze $3 Billion

Stablecoin issuers and blockchain partners moved particularly quickly to restrict the movement of stolen assets. Tether froze approximately $1.77 billion in $USDT, while Circle froze approximately $825 million in $USDC. Ripple also froze approximately $200 million, and World Liberty Financial froze $27.8 million in $USD1.

Arbitrum's Security Council separately intervened to freeze 8,426 $ETH and 74.6 million $ARB, worth approximately $30 million.

Binance reported that about $3 billion of the stolen assets had been frozen by Friday morning. However, the attacker managed to convert some stolen stablecoins into assets that issuers could not directly freeze. The attacker reportedly exchanged approximately $325 million in $USDT for $ETH through market makers and decentralized trading infrastructure, accepting a significant discount. The attacker also supplied $USDT to lending protocols, including Aave, to borrow $ETH, prompting Aave to freeze the affected markets.

TRM estimated that the attacker still controlled more than 420,000 $ETH and 18,270 $BTC, worth approximately $2.4 billion at the time of its assessment.

Binance Commits $6.34 Billion to Cover All Losses

Binance repeatedly assured customers that they would not bear the financial consequences of the incident.

In a Friday update, the exchange announced that it had reserved more than $6.34 billion in company funds to cover the incident. According to the post, approximately $5 billion is already in the exact tokens affected by the hack. Binance said it was purchasing the remaining assets through market and over-the-counter channels to match the stolen token balances and address any shortfalls. The exchange also confirmed that it would use its Secure Asset Fund for Users (SAFU) and company resources to cover losses.

Binance temporarily suspended withdrawals, revoked affected address authorizations, and began a security overhaul. Deposits remain operational, and the exchange expects withdrawals to resume on November 1, 2026. The company also committed to publishing an updated Proof of Reserves after completing remediation.

Crypto Markets Extend Their Decline as Liquidations Reach $1.6 Billion

The Binance incident added further pressure to an already weak cryptocurrency market. Bitcoin fell more than 5% following reports of the attack, briefly trading around $76,500 before recovering toward $77,000. $BNB declined almost 6% over the past 24 hours, while Solana dropped approximately 7% to $93.

According to CoinGlass, approximately 245,721 traders have been liquidated over the past 24 hours, with total liquidations reaching $1.60 billion.

Long positions accounted for approximately $1.35 billion, representing 84.2% of total liquidations, while short positions accounted for $252.35 million. Binance recorded the largest exchange share of liquidations at over 49% of all liquidations. The largest individual liquidation order involved a BTCUSDT long position worth $11.09 million on Binance.

Coin Glass

Market sentiment also deteriorated. CoinMarketCap's Fear and Greed Index fell from ‘46’, indicating Neutral sentiment on October 28, to ‘38’ on October 29 and ‘36’ on October 30, moving deeper into Fear territory.

Cmc Fear and Greed

What Comes Next?

The Binance hack raises difficult questions about the security of cryptocurrency exchanges, particularly their internal signing infrastructure and withdrawal approval systems. Although the exchange has committed sufficient resources to cover the estimated losses, recovering the remaining stolen assets presents a separate challenge. TRM Labs expects the Binance attacker to continue moving funds through cross-chain bridges, swap services, and over-the-counter brokers. Speaking on CNBC’s “Squawk Box Europe” after the Bitget $388 million hack in September 2026, Bitget CEO Gracy Chen stated that she was “not expecting to recover a lot of funds,” citing the limited recovery from previous hacks.

Binance has reiterated that its immediate priority remains completing its security overhaul, publishing a comprehensive account of how the attackers gained access, and restoring withdrawals by November 1st