Security
Binance hit by the largest crypto hack on record: can you still trust exchanges?
Binance confirmed a security incident on October 29, 2026. Estimates put the theft near $6.3B. Cause and attribution are unconfirmed. What is known so far.
On October 29, 2026, Binance confirmed a security incident after users reported funds leaving its wallets. As of October 30, 2026, estimates of the theft sit around $6.3 billion, which would make it the largest crypto theft on record, about four times the Bybit hack of February 2025. Binance says it will cover the losses. The root cause has not been published and no authority has officially named the attackers.
The essentials
- Amount: about $6.3 billion according to TRM Labs and to Binance's own estimate, as reported by CoinDesk. Other counts range from about $5.3 billion to $5.9 billion. All are preliminary.
- Cause and attribution: Binance's preliminary view points to a compromised DevOps engineer's laptop. TRM Labs attributes the theft, with high confidence, to a North Korean group. Neither Binance nor any authority has confirmed this for this incident.
- Freezes: stablecoin issuers and others froze roughly $2.5 to $3 billion. A freeze is not a recovery.
- Trust: the case shows the weak point is the hot wallet and the signing system, not only the reserves figure. It is not a verdict on every exchange.
These are mid-day October 30 figures. The investigation is ongoing, and numbers diverge by source and may change within hours. We separate what is confirmed (on-chain data, public statements by executives), what is assessed (analyses by TRM Labs, Blockaid, ZachXBT) and what is not published (the official root cause and any official attribution).
What happened at Binance?
Binance confirmed a "security incident" on October 29 after users flagged funds leaving its wallets, according to TechCrunch. The exchange paused deposits and withdrawals on several networks "as a precaution", spokesperson Ross O'Leary said. No resumption had been reported at the time of writing on October 30.
The chart below places the main on-chain events of October 29 in time (UTC), as observed by TRM Labs.
Source: TRM Labs, on-chain observations (assessed), verified 2026-10-30.
According to TRM, preparation started at least 36 hours earlier, with an operator wallet funded through Tornado Cash on the morning of October 28. On October 29, XRP left first, then the Bitcoin hot wallet at 20:20 together with an EIP-7702 delegation transaction (50 authorizations). Around 20:23 the Ethereum hot wallet was swept, including 1.615 billion USDT, and further sweeps continued until 23:56.
Markets reacted the same day. CoinDesk reports bitcoin down 4.8%, ether down 5.7%, BNB down 8% and AAVE down 11%, with about $1.4 billion of liquidations in 24 hours. Part of that predates the incident, since bitcoin was already falling. This is a description, not a forecast. ## How much was stolen, and on which blockchains?
TRM Labs counts about $6.36 billion at the prices of each transfer, or about $6.23 billion at current prices. Binance's own estimate is about $6.3 billion (CoinDesk). The chart shows TRM's breakdown across ten blockchains.
Source: TRM Labs (assessed), verified 2026-10-30. Sums to about $6.36 billion.
Ethereum accounts for about $3.79 billion and Bitcoin for 18,270 BTC, about $1.47 billion. These were hot wallets, which are connected to the internet (TechCrunch).
Why do the estimates differ? Methods and dates differ. Chainalysis puts the theft at about $5.9 billion at the time of the theft (CoinDesk). A cumulative on-chain count reaches about $5.57 billion across Ethereum, Bitcoin and Tron, and Glassnode says about $5.3 billion (Bitcoin.com News). Arkham saw wallets linked to the attacker holding more than $5.7 billion at one point. Older or lower figures sometimes include unrelated transfers. For scale, DefiLlama data cited by CoinDesk put Binance's assets near $144 billion, so the theft is roughly 4% of them.
What is frozen and what is lost?
Several issuers acted quickly. According to their executives, Tether froze more than $1.57 billion of USDT (CEO Paolo Ardoino) and Circle more than $800 million of USDC (CEO Jeremy Allaire). TRM counts about $1.77 billion and $825 million on-chain. Binance's co-CEO Yi He announced about $200 million at Ripple, but TRM confirms only 40.5 million RLUSD on-chain. World Liberty Financial froze about $27.8 million of USD1 and the Arbitrum Security Council about $30 million. Aave temporarily froze its Ethereum V3 markets as a precaution; its contracts were not hit.
Source: executive statements via CoinDesk, TRM Labs, verified 2026-10-30.
Binance reported a verified frozen total of $2.54 billion at 23:35 UTC, then about $3 billion (CoinDesk). TRM totals about $2.7 billion. The totals are not reconciled. A freeze blocks funds at the issuer; it does not return them to users.
What remains with the attacker? TRM counted more than 420,000 ETH and 18,270 BTC, about $2.4 billion, out of the reach of stablecoin issuers (00:30 UTC on October 30). TRM also saw early laundering, such as about 325 million USDT sold through UniswapX for about 122,300 ETH at a discount of more than 10%, and assesses that bridges, swap services and OTC brokers are likely next.
How was the attack possible?
Two accounts exist, and neither is final.
Binance (preliminary, stated). The investigation "suggests the incident may involve a compromised DevOps engineer's laptop", which would have given access to a service container and allowed unauthorized withdrawals to be submitted. Binance says there is "no evidence of a leaked wallet private key" and promises a post-mortem once facts are verified (CoinDesk).
TRM Labs (assessed). The most likely cause is that the attacker got Binance's hot-wallet signing system to sign transactions on several chains. On Ethereum, EIP-7702, which lets an account temporarily run a contract's code, was used to execute a sweeper contract, with 50 pre-signed authorizations on consecutive nonces. The nine other chains saw ordinary signed transfers. Blockaid first pointed to a compromise of the signing infrastructure and said it does not believe a key leaked.
In plain terms, a hot wallet holds funds online to serve withdrawals quickly, so it must sign automatically; a cold wallet keeps funds offline. The mechanism above is either Binance's preliminary view or an outside analysis. The official root cause is not published.
Who is behind it?
TRM Labs attributes the theft, with high confidence, to TraderTraitor, a North Korean group, the same one the FBI named for Bybit. ZachXBT calls Lazarus "likely". Blockaid says the tactics are consistent. This is assessed. Neither Binance nor the authorities have confirmed an attribution for this incident at this stage. Treat "North Korea" as a hypothesis from analysts, not a finding.
Is this the largest hack in history?
On the figures available, yes in nominal terms: TRM and CoinDesk describe it as the largest crypto theft ever recorded. The chart uses amounts at the time of each theft.
Source: Decrypt, Fortune (Chainalysis), TRM Labs, The Hacker News, verified 2026-10-30.
Bybit in February 2025 lost about $1.4 billion (Decrypt; Chainalysis via Fortune), or $1.5 billion by TRM's count, from a cold wallet; the FBI attributed it to North Korea. Ronin (a bridge, 2022) lost about $622 million at disclosure and Poly Network (2021) about $611 million, nearly all returned. Coincheck (Japan, 2018) lost about $530 million and repaid about $400 million to users. Binance itself lost about $40 million in May 2019.
Comparisons have limits: amounts are priced at the time of theft, a bridge exploit differs from an exchange hot-wallet theft, and sources disagree on some historical figures (Decrypt also cites $552 million for Ronin).
Will users be reimbursed?
Binance co-CEO Yi He said "Binance will cover all hacking losses" and "User funds are safe", and that the company is working with law enforcement. Founder Changpeng Zhao, no longer an executive but the main shareholder, wrote "It does look like a hack on Binance" and expects user funds to be "fully covered". Binance says it will cover losses with its SAFU fund and company funds.
SAFU is about $1 billion in bitcoin according to CoinDesk, far below $6.3 billion. Coverage therefore depends on Binance's balance sheet, not on SAFU alone. At this date it is a promise that nobody can verify. Precedents exist: in 2019 SAFU repaid users after withdrawals were suspended for about a week (The Hacker News), and Coincheck repaid about $400 million in 2018. Both were far smaller sums.
Binance also warned about scams that use unofficial links and messages.
Can you still trust crypto exchanges?
There is no absolute verdict, and this is not financial advice. An exchange holds your assets, so you carry counterparty risk: you rely on its security, its accounting and its ability to pay.
Proof of reserves is a snapshot, often built with Merkle trees or zero-knowledge proofs. It shows assets covering balances at a given date. It does not show that hot wallets are safe or that liabilities are complete, and it is not a full audit. This incident hit hot wallets and signing systems, which a reserves snapshot does not test.
The wider context matters. Chainalysis reports that more than $3.4 billion was stolen in 2025, with North Korea responsible for about 59% (about $2 billion, a record). Three hacks made up more than two-thirds of the total. Methods included infiltrating IT staff and social engineering. Self-custody has its own risks: 158,000 personal wallet compromises in 2025, about three times 2022. Counterparties reacted too: Wintermute says its Binance exposure is under 20% of its equity and GSR under 5%. The same day, Polymarket briefly paused withdrawals after a third-party provider (DebugBear) was compromised, with about $2 million of user funds affected; no link to Binance has been established (TechCrunch).
Criteria to check, whatever the platform:
- Does it publish proof of reserves, and does it say what the proof covers and omits?
- How much is held in hot versus cold wallets, and who can authorize a signature?
- Does it have an insurance or compensation fund, and is its size disclosed?
- How did it communicate during past incidents, and did it publish a post-mortem?
Security hygiene:
- Keep on an exchange only what you trade.
- Turn on the withdrawal address whitelist.
- Set an anti-phishing code.
- Use a security key or passkey rather than SMS.
- Distrust any message offering "fund recovery"; scams follow incidents like this.
Comparison table
| Criterion | Binance 2026 | Bybit 2025 | Binance 2019 |
|---|---|---|---|
| Amount | About $6.3B (estimates $5.3B to $6.36B) | About $1.4B (Decrypt, Chainalysis); $1.5B (TRM) | About $40M (about 7,000 BTC) |
| Wallet type hit | Hot wallets | Cold wallet | Hot wallet |
| Cause put forward | Compromised DevOps laptop (Binance, preliminary); pre-signed signatures through the signing system (TRM, assessed) | Not specified here | Phishing and virus, according to Binance |
| Attribution | TraderTraitor, North Korea (TRM, assessed); not confirmed | Attributed to North Korea by the FBI | Not specified here |
| Reimbursement | Coverage promised, not verifiable yet | Not specified here | SAFU; withdrawals suspended about a week |
Frequently asked questions
Are Binance users' funds safe?
Binance says user funds are safe and that it will cover all hacking losses. At this date that promise cannot be independently verified, and withdrawals remained paused when we wrote this.
How much was stolen?
About $6.3 billion according to TRM Labs and Binance's own estimate; Chainalysis says about $5.9 billion and other on-chain counts are lower. All figures are preliminary and measured differently.
Who is behind the hack?
TRM Labs attributes it with high confidence to the North Korean group TraderTraitor, and ZachXBT cites Lazarus. Neither Binance nor the authorities have confirmed it for this incident.
Should you withdraw your crypto from Binance?
That is a personal decision and not advice from us. Withdrawals were suspended at the time of writing, so check the criteria above and Binance's official announcements before acting.
Method and limits
This article relies on public reports (mainly TRM Labs, TechCrunch and CoinDesk) and executive statements as of mid-day October 30, 2026. On-chain observations are labelled assessed because they come from third-party analytics firms. Amounts depend on pricing time and method; totals are not reconciled between sources. Nothing here is investment advice or a price forecast. We will revise this article if Binance publishes its post-mortem or an authority names the attackers.
Sources
- TechCrunch: Binance pauses withdrawals as hackers are suspected of stealing billions in crypto (verified 2026-10-30)
- TRM Labs: North Korea steals $6.36 billion from Binance in the largest hack in history (verified 2026-10-30)
- CoinDesk: Potential multi-billion Binance hack hitting crypto markets (verified 2026-10-30)
- CoinDesk: live updates (verified 2026-10-30)
- Bitcoin.com News: Inside the $5.8B Binance hack, what's confirmed and what isn't (verified 2026-10-30)
- Blockaid: Binance hack analysis (verified 2026-10-30)
- Decrypt: Biggest crypto hacks of all time (verified 2026-10-30)
- Fortune: North Korea stole a record amount of crypto (Chainalysis) (verified 2026-10-30)
- The Hacker News: Binance cryptocurrency hacked (2019) (verified 2026-10-30)
Spotted an error in this article? Report it · Our corrections policy
