The $6.3 billion Binance hack: what happened, and how to protect your crypto

Last updated 2 November 2026. This story is still developing, and Binance has not yet published a root cause.

On the evening of 29 October 2026, attackers drained about $6.3 billion from Binance's hot wallets, most of it in roughly twenty minutes. It is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Here's what is actually known, what isn't, and what you can do to protect your own crypto.

The short version

• How much: Binance says about $6.3 billion. Estimates differ with the pricing method: Chainalysis $5.9 billion, TRM Labs $6.36 billion, Elliptic $6.43 billion.
• Who: the FBI attributed it to North Korea on 31 October. TRM Labs, Chainalysis and Elliptic point to the same unit, TraderTraitor, also blamed for Bybit.
• Frozen: about $3 billion, mostly stablecoins. Elliptic has verified $2.85 billion.
• Customers: Binance says it, not its users, takes the loss. It reported about 95% of the stolen assets replaced by 1 November.
• Now: withdrawals restarted in phases on 1 November, beginning with Bitcoin, then Ethereum and BNB Smart Chain.

Timeline

All times UTC, from TRM Labs' on-chain reconstruction:

• 28 Oct, morning: the attacker's wallet receives three small withdrawals from the mixer Tornado Cash.
• 29 Oct, earlier: attack code is deployed and rehearsed on three wallets.
• 20:05–20:09: five Binance XRP Ledger wallets send 233 million XRP to one address. Solana and Optimism wallets follow.
• 20:20: 18,270 BTC leave a Bitcoin hot wallet. On Ethereum, the attacker submits 50 signed authorizations for a hot wallet. Tron follows within two minutes.
• About 20:23: that Ethereum hot wallet's whole balance is swept out, including 167,464 ETH and 1.6 billion USDT.
• 20:41–23:56: new deposits reaching the compromised wallet are swept six more times.
• 21:01–22:10: Tether, Circle, Ripple and World Liberty Financial freeze stablecoins in the attacker's wallets.
• 23:05: a second wave hits Avalanche and Polygon.
• 31 Oct: the FBI attributes the theft to North Korea.
• 1 Nov: withdrawals begin to reopen.

Where the money came from

Blockchain	Taken (approx.)	Main assets
Ethereum	$3.79B	200,630 ETH, 1.875B USDT, 823M USDC, 88.5M RLUSD
Bitcoin	$1.47B	18,270 BTC
Tron	$628M	612.7M USDT, 46.4M TRX
XRP Ledger	$296M	233.46M XRP
Solana	$96M	970,500 SOL
Arbitrum, Optimism, Base	$39M	including 74.6M ARB
Avalanche	$28M
Polygon	$10M

Source: TRM Labs, at prices when each transfer happened.

How it happened: confirmed versus analysis

What Binance says. Its first finding pointed to a compromised DevOps engineer's laptop and unauthorized access to a service container. It later reported additional points of breach, and co-CEO Richard Teng said this was more complex than misuse of one engineer's permissions. Binance says it has found no evidence of a leaked private key. A full post-mortem is still pending.

What investigators see on-chain. This is analysis, not confirmed by Binance. Elliptic concludes the attacker didn't need to steal keys, because Binance's own systems were induced to sign the transactions. TRM Labs reads the coordinated transfers across chains the same way: the likely compromise is the hot-wallet signing system itself.

The most striking piece is on Ethereum. A 2025 upgrade feature, EIP-7702, lets a normal wallet delegate its behaviour to a smart contract. The attacker got 50 such authorizations signed, one for each upcoming transaction number so that one was sure to be valid, all pointing to a small “sweeper” contract that only obeyed the attacker. Once one took effect, the wallet belonged to the attacker in practice. That's why deposits arriving hours later were still swept.

Not everyone agrees on the details. Former Mt. Gox head Mark Karpelès told Reuters that attackers probably had keys for at least two wallets. Elliptic considers social engineering, such as fake job offers or coding tests that install malware, a likely way in, but that is an assessment and not a finding.

Who did it, and where the money is going

The FBI, TRM Labs (with “high confidence”), Chainalysis and Elliptic all point to North Korea's TraderTraitor. Elliptic estimates that DPRK-linked actors had already stolen more than $6.5 billion in crypto, so this one attack nearly doubles the total. Binance itself has not attributed the attack to anyone.

Stablecoins were the attacker's weak spot, because their issuers can freeze them. Tether froze about 1.77 billion USDT and Circle about 825 million USDC within hours. Bitcoin and Ether have no such issuer. Elliptic estimates the attacker still controls about $3.25 billion that can't be frozen, spread over more than 800 addresses, and has been selling at losses of 12–26% to move quickly. A freeze also isn't a refund: Chainalysis' Eric Jardine told CNBC that returning funds can take months or years.

What it means for Binance customers

Binance says it “will absorb the financial impact of these stolen funds, not our users”. It set aside more than $6.34 billion, drawing on its SAFU emergency fund, part of its Futures insurance fund and its corporate treasury. According to its latest detailed update, BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, and it is still buying the less liquid remainder. It promises a zero-knowledge proof of reserves around 3 November, so users can verify their own balances.

Note that “covered” does not mean “recovered”. Binance replaced the coins with its own money; most of the stolen funds are still out there. Outflows reportedly spiked and then leveled off, and Fundstrat's Sean Farrell told CNBC he saw no meaningful solvency risk. Markets wobbled rather than crashed: Bitcoin touched a six-week low of $76,368 and was back above $78,000 by Monday.

What it teaches

The world's largest exchange had a fund, a security team and lots of attention, and it still lost $6.3 billion in about twenty minutes. Two lessons stand out. An exchange balance is only as safe as the exchange, and bigger holdings are a bigger target. And this attack didn't need a clever bug in a smart contract: it needed access to the machine that says “yes”. Binance could absorb the loss. A smaller exchange could not have.

How to protect your crypto

You can't secure an exchange's servers. You can decide how much you leave there, and how hard you are to fool.

If you're a Binance customer, right now

• Expect scams. Fake “security” messages, compensation pages, “withdrawals reopened” links and recovery services always follow a hack like this. Use only the official app or a website address you type yourself.
• Nobody legitimate will ask for your password, 2FA code or seed phrase, for a fee to release your funds, for remote-access software like AnyDesk, or for a transfer to a “safe wallet”.
• Don't rush. Advisers quoted by Yahoo Finance warn against panic moves to unverified destinations. Hurried moves are how people lose money twice.
• Check your balance with Binance's proof of reserves once the full proof is out.

Harden every exchange account

• Use a unique password and a hardware security key or passkey rather than SMS codes.
• Turn on the withdrawal address whitelist, so funds can only go to addresses you approved earlier.
• Set an anti-phishing code, where offered, so real emails can be told from fake ones.
• Delete old API keys and app connections, and never give an API key withdrawal rights.
• Use a separate email address just for crypto.

Keep on exchanges only what you trade

• Move long-term holdings to a wallet you control, ideally a hardware wallet bought directly from the manufacturer.
• Write your seed phrase on paper or metal. Never photograph it, type it into anything, or store it in the cloud or a password manager.
• Send a small test transaction first, and check the address on the device's own screen.
• For large amounts, consider a multisig wallet that needs several keys, kept in different places.
• Spreading funds across more than one wallet or exchange limits the damage of any single failure.

Be honest about the trade-off, though. Self-custody swaps the risk of an exchange failing for the risk of you making a mistake, and there's no SAFU fund for a lost seed phrase. Make sure someone you trust can reach your funds if something happens to you.

Read what you sign

This hack came down to signatures, and the same trick works at home, on a much smaller scale.

• Avoid blind signing. If your wallet can't show you plainly what a transaction does, don't approve it.
• Be very wary of delegation requests. An EIP-7702 authorization or an unlimited token approval can hand over a wallet without any transfer appearing to happen.
• Review old approvals regularly with a tool such as Revoke.cash.
• Keep a separate “hot” wallet with small amounts for connecting to apps, and never connect the wallet with your savings.

If you work in tech or run a company

TraderTraitor's speciality is people. Be suspicious of unexpected job offers, “take-home coding tests” and repositories you're asked to run. Treat them as potential malware, and run them in a throwaway virtual machine. If your company holds funds, the usual controls matter: signing systems isolated from everyday laptops, several people approving large withdrawals, time delays and limits, and alerts for unusual transactions and delegations.

If you've been scammed

Report it to your local police and, in the US, to the FBI's IC3. Anyone who contacts you promising to recover your crypto for a fee is almost certainly running the next scam.

This is general security information, not financial or investment advice.

Sources

• Binance: Security Incident, Update #3
• TRM Labs: North Korea steals $6.36 billion from Binance
• Elliptic: The largest theft in history
• The Block: Inside the largest crypto hack on record
• The Hacker News: Binance security breach
• CNBC: withdrawals and coverage and what comes next
• Al Jazeera: What we know
• AP via PBS NewsHour: What to know
• Crypto Briefing: Binance stabilizes
• Yahoo Finance: What Binance users should do