Table of contents
20
Read this in 30 seconds: On 29 October 2026, an attacker moved about $6.3 billion out of Binance wallets across ten blockchains, most of it in roughly 20 minutes. That makes it the largest crypto theft on record, about four times the Bybit heist of February 2025. This article was written on 30 October 2026, while the investigation is still open, and every figure below carries its source.
- The amount depends on who counts. Binance says about $6.3 billion, TRM Labs counts $6.36 billion at the time of theft, Chainalysis first said $5.9 billion and Elliptic says $6.43 billion.
- About half has been frozen, but billions are still moving. Binance says nearly $3 billion is frozen, while TRM says the attacker still holds about $2.4 billion that no issuer can freeze, and Elliptic puts it at $3.33 billion.
- The cause is not confirmed. Binance’s early finding points to a compromised DevOps engineer’s laptop, and TRM says the evidence points to the signing system for Binance’s hot wallets.
- Two firms say North Korea, but nobody official has. TRM and Chainalysis attribute it to North Korea with high confidence, Elliptic urges caution, and Binance has not named the attackers.
- Binance says user funds are safe and it will cover the losses. Deposits and withdrawals are suspended while it rebuilds the withdrawal service, and scammers are already exploiting the confusion.
The lesson of the Binance hack is that the attackers did not break the cryptography. They went after the people, laptops and systems around the keys, which is the same pattern as the Bybit theft.
This guide to the Binance hack covers what happened, a minute-by-minute timeline, how much was taken, how it appears to have happened, who was compromised, who is behind it, what is being done to recover the money, and how to stay safe. Treat it as a snapshot. Check Binance’s official channels for updates.
Binance is the world’s largest cryptocurrency exchange. On the evening of 29 October 2026, funds began leaving wallets that belong to it. Binance first said it was “aware of reports of a potential security issue” and told TechCrunch that user funds were safe. It then confirmed a security incident and suspended deposits and withdrawals.
Within hours, blockchain analysts could see the scale. According to TRM Labs, which followed each transfer on-chain, an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. The assets included Ethereum, Bitcoin, XRP, Tron, Solana and several smaller networks.
The previous record was the roughly $1.5 billion Bybit theft in February 2025. This incident is about four times larger.
Two details about the Binance hack frame everything that follows. First, the stolen funds came from Binance’s own wallets, not from individual customer accounts. Second, Binance says it has found no evidence of a wallet private key leak, which fits the view that the attackers got Binance’s systems to sign transactions for them.
All times are UTC and come from TRM Labs’ on-chain tracking unless noted.
| When | What happened |
|---|---|
| 28 October, morning | The attacker’s operator wallet receives three small withdrawals from Tornado Cash, a mixing service |
| Early 29 October | The operator deploys test code and tries it on two wallets, then rehearses the final version on a third |
| 29 October, about 4 hours later | The same code is installed on a Binance hot wallet |
| 20:05 to 20:09 | Five Binance wallets on the XRP Ledger send 233.46 million XRP to one attacker address |
| 20:10 onward | Binance wallets on Solana and Optimism follow |
| 20:20 | A Binance Bitcoin hot wallet sends 18,270 BTC to the attacker, who starts splitting it. The Ethereum hot wallet is taken over with 50 pre-signed authorizations |
| Within two minutes | A Binance hot wallet on Tron sends 612.7 million USDT and 46.4 million TRX |
| 21:01 | Tether freezes 971.1 million USDT in the main receiving wallet, 37 minutes after the main sweep |
| 21:04 | Circle freezes 823 million USDC |
| 22:01 and 22:10 | Ripple freezes 40.5 million RLUSD and World Liberty Financial freezes 27.8 million USD1 |
| 23:05 | A second wave reaches Binance wallets on Avalanche and Polygon |
| 23:35 | Binance says verified frozen funds have reached $2.54 billion |
| 00:08, 30 October | Arbitrum’s Security Council moves 8,426 ETH and 74.6 million ARB out of the attacker’s reach |
The preparation matters as much as the theft in the Binance hack. TRM says staging began at least 36 hours before the money moved, which means this was a planned operation, not an opportunistic raid.
Nobody agrees on one number for the Binance hack yet, and the differences are explained by method, not by confusion.
| Source | Amount stolen | Frozen | Attacker still holds |
|---|---|---|---|
| Binance | About $6.3 billion affected | Nearly $3 billion | Not stated |
| TRM Labs | $6.36 billion at time of theft ($6.23 billion at current prices) | About $2.7 billion | More than 420,000 ETH and 18,270 BTC, about $2.4 billion |
| Chainalysis | About $5.9 billion at time of theft (first estimate); later headline $6.4 billion | Not stated in what we read | Not stated |
| Elliptic | $6.43 billion | $2.84 billion | About $3.33 billion across about 43 wallets |
Several things explain the gaps. Crypto prices moved during the event, so “at the time of theft” and “at current prices” differ. Counting methods differ on which wallets belong to Binance. And freezes kept arriving through the night, so every tally has a timestamp.
The breakdown by blockchain from TRM gives a sense of the scale: Ethereum about $3.79 billion, Bitcoin about $1.47 billion, Tron about $628 million, the XRP Ledger about $296 million and Solana about $96 million, with the rest spread across Arbitrum, Optimism, Base, Avalanche and Polygon.
Here is what is known about the Binance hack, what is the analysts’ reading and what remains unknown.
What Binance has said. According to The Hacker News and SecurityWeek, its initial investigation “suggests” the incident may involve a compromised DevOps engineer’s laptop, which let an attacker reach a service container and submit unauthorised withdrawal transactions. It also said it has found no evidence of a wallet private key leak.
What the chain data shows. On Ethereum, TRM reports that the attacker used a feature called EIP-7702. In plain terms, it lets a wallet hand control of its behaviour to a smart contract by signing an authorisation. The attacker submitted a single transaction with 50 authorisations, each signed by the Binance hot wallet in advance and each pointing the wallet at a contract only the attacker controlled. Because a wallet’s transaction counter keeps moving, preparing 50 consecutive ones guaranteed one would be valid when it executed. Three minutes and 24 seconds later, the operator told the wallet to send its entire balance, including 167,464 ETH and 63 tokens.
Why that is not the whole story. TRM says early signs suggested phishing of the authorisations, but that cannot explain the other nine chains. There, Binance wallets sent funds to the attacker through ordinary, validly signed transfers, using different chains, key types and signing schemes, all within about half an hour. TRM’s assessment is that the attacker most likely gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains.
Elliptic reached a similar view. Rather than stealing Binance’s private keys, it said, the attacker appears to have been able to get Binance’s own systems to sign transactions on their behalf. It compared this to Bybit, where the people and infrastructure around the wallets were compromised, not the cryptography.
What is inference. Elliptic also points to the likely use of social engineering, tricking employees into running malware under the pretext of a coding test or a bogus project, a technique seen in earlier North Korea-linked thefts. That is an analyst’s inference, not something Binance has confirmed for this case.
What is unknown. TRM notes that Binance has yet to publish a root cause. How the laptop was compromised, how the attacker moved from a container to the signing system, and how long they had access are all open.
The compromised assets were Binance’s own hot wallets, which are internet-connected wallets an exchange uses to process customer withdrawals. The people and systems in the chain, according to Binance’s early finding, were a DevOps engineer’s laptop and a service container. TRM’s analysis points further, to the infrastructure that signs transactions for Binance’s wallets on many chains.
What was not reported as compromised in the Binance hack: individual user accounts, passwords or two-factor codes. Binance says user funds are safe and that it will cover all losses from its Secure Asset Fund for Users (SAFU) and its own funds. That is a company statement, so treat it as a commitment to watch, not as a settled fact.
One more incident the same day deserves a separate note. TechCrunch reported that prediction market Polymarket briefly halted trading after a third-party supplier was compromised, and researchers said about $2 million was stolen. TechCrunch described it as what “appears to be” a separate incident, so do not assume a link.
Private blockchain analysts point to North Korea for the Binance hack. Official confirmation is missing.
| Source | Position |
|---|---|
| TRM Labs | Attributes it to TraderTraitor, North Korea’s hacking unit, “with high confidence” |
| Chainalysis | Links it to North Korea with a high degree of confidence, citing Bitget-exploit proceeds mixed with Binance funds |
| Elliptic | Assesses North Korea-linked actors, but urges caution because the laundering speed and method differ from past patterns and no root cause exists |
| ZachXBT | Names the Lazarus Group as the probable attacker, per SecurityWeek |
| Binance | Has not named the attackers and says it is working with law enforcement |
The evidence cited includes small Tornado Cash withdrawals funding an operator wallet, staging well before the theft, and signatures obtained in advance and executed in one burst. These match the Bybit and KelpDAO thefts. The FBI formally attributed Bybit to TraderTraitor, but the sources we read do not show a formal attribution for this case.
Elliptic’s caution is worth taking seriously. Its chief scientist said North Korean launderers typically swap stolen stablecoins into native assets within minutes, while this attacker held USDT for 37 minutes on Ethereum and 46 minutes on Tron.
Recovery after the Binance hack has two tracks: freezing what can be frozen, and tracing what cannot.
What Binance says it is doing. It has suspended deposits and withdrawals, revoked the affected address authorisation, engaged law enforcement and blockchain intelligence partners to trace and recover funds, and promised to cover all losses. It said it expects withdrawals to resume in 48 hours, after completing a security revamp of the withdrawal service and its related addresses. At the time of writing we could not confirm that they have resumed.
What the issuers froze. Per TRM: Tether about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD, World Liberty Financial 27.8 million USD1, and Arbitrum’s Security Council 8,426 ETH and 74.6 million ARB, about $30 million. Tether and Circle gave their own, lower figures to the press (more than 1.567 billion USDT and 800 million USDC), which is another reason totals differ.
What the attacker did to get ahead of the freezes. TRM reports the attacker sold about 325 million USDT through market makers for roughly 122,300 ETH, at more than a 10% discount, supplied 60 million USDT to Aave and borrowed about 19,760 ETH against it, and moved USDT through Tron lending and Uniswap hops. The attacker now holds assets that no issuer can freeze, mainly ETH and Bitcoin.
What happens next. TRM expects the attacker to turn to cross-chain bridges, swap services and over-the-counter brokers. A freeze stops funds from moving, but getting them back needs legal processes, and the frozen stablecoins and the unfrozen ETH and BTC face different paths. Exchanges and compliance teams are being asked to screen deposits against the labelled attacker addresses.
Binance says user funds are safe. If that holds, the main effects of the Binance hack on ordinary users are practical.
This is information, not financial advice. Decisions about your own holdings are yours to make.
These are general security steps after the Binance hack for anyone with crypto on an exchange or in a wallet.
For security and engineering teams, the lessons from the Binance hack come from how the attack worked. None of them needs a billion-dollar treasury.
| Weak point in this incident | Control to test |
|---|---|
| A developer or DevOps laptop was the likely way in | Harden and monitor engineer endpoints, and train for coding-test and project lures |
| A service container allowed withdrawal requests | Least privilege for service identities, tight egress rules, and no standing access to money-moving paths |
| One compromised system produced valid signatures on ten chains | Separate signing infrastructure and approval paths by chain and by wallet tier, as TRM advises |
| Pre-signed authorisations executed in one burst | Reject unexpected EIP-7702 authorisations, and treat a request for many authorisations across a range of transaction counts as an indicator of compromise |
| A single actor moved billions in 20 minutes | Rate and value limits, delays and out-of-band approval for large transfers |
| Recovery depended on issuers freezing fast | Keep a tested, pre-approved method to sign a revocation, and pre-arranged contacts with issuers and law enforcement |
TRM also recommends that treasury teams monitor Ethereum-compatible wallets for EIP-7702 delegations, which appear as code at an address that should have none, and alert on any on a treasury wallet.
The common thread in the Binance hack is that the weak links were the surrounding systems and people. A strong key does not help if a compromised system can ask it to sign.
We do not know the root cause yet, and we will not guess. What we can say is what the pattern means for defenders.
In a Binance hack-style attack, an attacker who reaches a developer laptop, then a service container, then a signing system is walking a path that a good test can walk first. In an AI-assisted VAPT engagement, and in red team operations, we assume an endpoint is compromised and test what that foothold can reach: service accounts, secrets in pipelines, container permissions and the approval paths around money or data. Five lessons from real red team engagements covers how those paths usually look, and the cloud infrastructure testing methodology covers the container side.
Our own limits matter. A pentest cannot promise that a Binance hack-style attack will not happen, and a report does not certify that you are safe. It records what was tested at a point in time, with findings and fix steps, so you can close the gaps you can see.
Honesty about gaps is part of any Binance hack analysis. As of 30 October 2026, the following are unconfirmed.
This article is a snapshot as of 30 October 2026, so use the sources linked here and Binance’s official channels for the latest.
The Binance hack took about $6.3 billion, according to Binance, which makes it the largest crypto theft on record. TRM Labs counts $6.36 billion at the time of theft, Chainalysis first estimated $5.9 billion, and Elliptic says $6.43 billion. The differences come from price moves and counting methods.
Binance’s early finding points to a compromised DevOps engineer’s laptop that let an attacker reach a service container and submit unauthorised withdrawals. TRM Labs says the evidence points to the signing system for Binance’s hot wallets. Binance has not published a root cause.
Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. That is the company’s statement, so verify updates through official Binance channels, and watch for scams that use the hack as bait.
For the Binance hack, TRM Labs and Chainalysis attribute it to North Korea’s TraderTraitor group with high confidence, and ZachXBT names the Lazarus Group. Elliptic urges caution, and Binance has not named the attackers. The sources we read show no formal government attribution for this case.
Part of it may be. About $2.7 to $3 billion has been frozen, mostly stablecoins, but freezing only stops the funds from moving, and recovery needs legal processes. The attacker still holds billions in ETH and Bitcoin that issuers cannot freeze, per TRM and Elliptic.
Use official channels only, never share your seed phrase, ignore unsolicited messages about compensation, turn on hardware-key or authenticator-based login, and review your withdrawal whitelist and connected devices. Take time to verify any message before you act.
The Binance hack is the largest crypto theft on record, and the early evidence says the attackers beat the systems around the keys, not the keys themselves. A compromised laptop, a service container and a signing system appear to have been enough.
Roughly half of the money from the Binance hack is frozen, billions remain in the attacker’s hands, and the root cause is still unpublished. If you hold crypto, stick to official channels and expect scams. If you run security or engineering, test the path from an engineer’s endpoint to anything that moves money, and treat signing infrastructure as the crown jewel it is.
Categories
Related articles
