Hackers have stolen approximately $6.3 billion in cryptocurrency from Binance, marking the largest crypto theft on record and raising fresh concerns about the security of centralized exchanges. Blockchain analytics firms have linked the attack to North Korea, while Binance has pledged to cover the losses and is working with industry partners to recover the stolen assets.
The breach occurred on October 29, 2026, when attackers transferred funds from Binance-controlled wallets across 10 blockchain networks to addresses under their control. According to TRM Labs, most of the theft unfolded within approximately 20 minutes.
The incident triggered a broad sell-off across cryptocurrency markets. Bitcoin fell to a six-week low, while Ethereum and Binance’s BNB token also declined. Binance temporarily suspended withdrawals across several networks as it investigated the breach.
Co-CEO Richard Teng sought to reassure customers, saying user funds were safe and the exchange would cover every loss.
North Korea-linked hackers suspected
Blockchain analytics firms TRM Labs and Chainalysis expressed high confidence that North Korea was responsible, identifying its state-linked hacking group TraderTraitor as the likely perpetrator.
TRM said the operation shared similarities with previous attacks attributed to North Korean hackers, particularly the $1.5 billion Bybit hack in February 2025, which the US Federal Bureau of Investigation linked to Pyongyang.
According to the firm’s analysis, the attackers began preparing at least 36 hours before the Binance breach. Their activity included small withdrawals from Tornado Cash, a cryptocurrency mixing service, and several tests of malicious code before the main operation.
North Korea has repeatedly been accused by international authorities of using cyberattacks to generate revenue for the state. However, Pyongyang has consistently denied involvement in such activities.
Binance has not independently confirmed the identity of the attackers, saying its investigation remains ongoing.
North Korea Steals USD 6.36 Billion From Binance (Source: TRM Labs)
How the attackers breached Binance
An initial investigation suggested the attack may have started with a compromised laptop belonging to a Binance engineer, potentially giving hackers access to internal systems used to authorize transactions.
TRM’s findings point to a broader compromise involving Binance’s hot wallet signing infrastructure.
Hot wallets are internet-connected cryptocurrency wallets that exchanges use to process transactions and withdrawals. Their accessibility makes them convenient for trading operations but also exposes them to cybersecurity risks.
On Ethereum, the attackers reportedly exploited EIP-7702, a feature that allows a wallet to delegate transaction execution to smart contract code through a signed authorization.
The hackers prepared 50 authorizations in advance, increasing the chances that one would remain valid when submitted. Once activated, the compromised Binance wallet could execute a contract controlled by the attackers, allowing them to drain its assets.
The operation moved approximately 167,464 ETH and dozens of other tokens from the affected wallet. Additional funds arriving later were also swept into attacker-controlled addresses.
The breach extended across Bitcoin, Tron, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon.
TRM said the simultaneous movement of funds across multiple networks suggested that the attackers may have gained access to Binance’s transaction-signing infrastructure. The exchange has yet to publish a definitive explanation of the incident’s root cause.
Around $2.7 billion in assets frozen
A rapid response from cryptocurrency companies and blockchain networks helped prevent a substantial portion of the stolen assets from moving beyond recovery efforts.
According to TRM, approximately $2.7 billion in assets was frozen following coordinated action by stablecoin issuers and blockchain operators.
Tether accounted for the largest share, freezing approximately $1.77 billion in USDT. Circle blocked around $825 million in USDC, while Ripple froze approximately $40.5 million in RLUSD. World Liberty Financial also froze around $27.8 million in its USD1 stablecoin.
Arbitrum’s Security Council separately intervened to remove approximately $30 million in ETH and ARB tokens from the attacker’s reach.
However, the hackers moved quickly to convert some stablecoins into assets that cannot be directly frozen by centralized issuers. TRM identified large transactions involving decentralized exchanges, market makers and lending protocols, including Aave.
Following these movements and recovery efforts, the attackers were estimated to retain more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion.
An overview of the October 29, 2026 Binance hack in TRM
Crypto markets react to record-breaking theft
The breach added pressure to an already fragile cryptocurrency market as investors reassessed the risks of holding digital assets on centralized exchanges.
Bitcoin dropped to $76,368, its lowest level in six weeks, while Ethereum fell more than 3% to approximately $2,178. Binance’s BNB token declined around 5% over 24 hours to $709.70, according to CoinGecko.
Shares of publicly traded cryptocurrency companies also weakened. Coinbase Global fell 4.8%, while Strategy, a major corporate Bitcoin holder, declined nearly 6% in extended US trading.
Market analysts warned that the incident could further undermine confidence in centralized platforms, particularly as institutional investors continue increasing their exposure to digital assets.
Tim Sun, senior researcher at Hong Kong-based HashKey Group, said the breach could dampen investor risk appetite and prompt market participants to reassess the safety of assets held on centralized exchanges.
The timing is challenging for the industry, which has already faced pressure from elevated US interest rates and softer demand for cryptocurrency investment products.
Bitcoin (BTC) Price Performance on Oct 31, 2026 (Source: CoinGecko)
Binance faces renewed security scrutiny
Binance has approximately 335 million registered users globally and held around $162.8 billion in assets under custody, according to its 2025 annual report.
The exchange also maintains its Secure Asset Fund for Users (SAFU), a reserve designed to protect customers against losses arising from security incidents. The fund holds approximately $1 billion in Bitcoin.
However, the scale of the latest theft significantly exceeds the fund’s value, placing greater attention on Binance’s financial resources and its commitment to compensating affected users.
Teng said the company would use its own funds alongside existing protection mechanisms to cover the losses.
The incident also highlights the growing security challenges facing the cryptocurrency industry. TRM estimated that approximately $2.9 billion in digital assets was stolen across nearly 150 attacks during 2025.
Although the freezing of billions of dollars demonstrates the importance of cooperation between exchanges, stablecoin issuers and blockchain networks, the remaining stolen assets present a significant challenge for investigators.
As the investigation continues, the Binance breach is likely to intensify scrutiny of exchange security standards, wallet management and transaction authorization systems. It also raises broader questions about whether existing safeguards can adequately protect the growing volume of digital assets held by centralized platforms.
