Binance loses $6.3 billion in largest crypto hack on record

Hackers stole about $6.3 billion in digital assets from Binance, the world's largest cryptocurrency exchange, on Thursday 29 October, the largest crypto theft on record.

Blockchain intelligence firm TRM Labs said an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, most of it within about 20 minutes from 20:05 UTC. That is roughly four times the previous record, the $1.5 billion taken from Bybit in February 2025.

Binance has suspended withdrawals, said about $3 billion of the affected assets has been frozen on-chain, and pledged to cover all losses. "Binance will absorb the financial impact of these stolen funds, not our users," the exchange said in an update signed by co-CEOs Yi He and Richard Teng (crypto.news).

TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-backed hacking unit. Binance has not publicly named the attackers.

How the attack unfolded

According to TRM Labs' analysis of on-chain transfers, preparation began at least 36 hours before the theft. The attacker's operator wallet was funded through the Tornado Cash mixer on the morning of 28 October, and the attack code was tested and rehearsed on attacker-controlled wallets the following day (TRM Labs). All times below are UTC; South African time is UTC+2.

Ten blockchains were affected: Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. TRM said Ethereum accounted for about $3.79 billion of the total and Bitcoin for about $1.47 billion.

How the attackers gained access

The attack targeted Binance's hot wallets, the internet-connected wallets exchanges use to process customer withdrawals, rather than any underlying blockchain.

Binance said its preliminary investigation found that a DevOps engineer's compromised laptop gave an attacker access to a service container, from which unauthorised withdrawal transactions were submitted (NBC News). The exchange later said it had identified additional points of breach, and that it had found no evidence that wallet private keys were leaked.

Co-CEO Richard Teng described a complex operation. "To be clear: the attacker did not simply use one engineer's permissions," he said, adding that a self-destruct mechanism had erased the attacker's tools and traces (CoinCentral).

On Ethereum, TRM said the attacker used EIP-7702, a feature introduced in Ethereum's Pectra upgrade in May 2025 that lets a standard wallet delegate its behaviour to a smart contract. The attacker submitted 50 pre-signed authorisations covering consecutive transaction counts, known as nonces, on a busy Binance hot wallet, ensuring that one would still be valid when executed. That turned the wallet into a sweeper contract controlled only by the attacker.

Three minutes and 24 seconds after the delegation, the wallet transferred 167,464 ETH and 63 tokens, including 1.615 billion USDT, to an attacker address. Because the delegation stayed active, the attacker swept newly arriving funds six more times before midnight UTC, TRM said.

In the same window, Binance wallets on the other nine chains sent funds to the attacker through ordinary signed transfers, despite using different key types and signing schemes. TRM assessed that the attacker most likely gained the ability to make Binance's hot wallet signing system sign transactions of its choosing. Blockaid chief executive Ido Ben-Natan also said compromised signing systems likely enabled the theft.

Binance has said it will publish a detailed technical post-mortem once its investigation is complete.

Attribution to North Korea

TRM Labs said it attributes the attack with high confidence to TraderTraitor, citing on-chain and off-chain intelligence. The FBI previously named the same group as responsible for the Bybit hack. TRM said the Binance attack shared features with earlier North Korea-linked thefts, including Tornado Cash funding, staging well before the theft and signatures obtained in advance, though the laundering seen so far follows a different pattern.

Chainalysis chief executive Jonathan Levin said the hack was "likely done by DPRK group TraderTraitor" (CBC News).

Binance and law enforcement agencies have not publicly confirmed the attribution.

Binance's response

Binance said it has reserved more than $6.34 billion in company funds to cover the losses, drawing on its SAFU emergency fund and corporate treasury. About $5 billion of that is already held in the affected tokens, including USDT, USDC, BTC, ETH and BNB, and the exchange is buying the remainder through market purchases and over-the-counter deals (crypto.news).

Withdrawals remain suspended while Binance rebuilds its withdrawal system, while deposits and other unaffected services continue to operate. The exchange said it aims to begin restoring withdrawals in phases from Sunday 1 November, subject to security checks, and to publish proof-of-reserves results on Monday 2 November.

Binance said it has contained the compromised infrastructure, revoked the affected wallet authorisations and is working with law enforcement and industry partners to recover frozen assets.

Teng has said the attack affected Binance's own hot wallets rather than customer funds. A CoinDesk review of reserve data found the compromised wallets had previously been listed among the assets backing customer balances, and blockchain security firm CertiK said it needed more information to verify Binance's holdings (CoinCentral).

Sean Farrell, head of digital asset strategy at Fundstrat Global Advisors, told CNBC the breach does not currently appear to pose meaningful solvency risk for the exchange (CNBC). Binance holds about $155 billion in assets under management, more than any other exchange, according to CoinMarketCap data cited by Al Jazeera.

Frozen funds and the missing $2.4 billion

Stablecoin issuers began freezing funds within an hour of the main sweep. According to TRM, Tether froze about 1.77 billion USDT, Circle about 825 million USDC, Ripple 40.5 million RLUSD and World Liberty Financial 27.8 million USD1. Arbitrum's Security Council used its emergency powers to move 8,426 ETH and 74.6 million ARB out of an attacker wallet. TRM put the total frozen on-chain at about $2.7 billion as of 00:30 UTC on 30 October; Binance has cited about $3 billion.

The attacker converted some stablecoins before they could be frozen. TRM said about 325 million USDT was sold to market makers for roughly 122,300 ETH, a discount of more than 10% to the market price, and a second wallet borrowed about 19,760 ETH from lending protocol Aave against 60 million USDT.

The attacker still controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion and beyond the reach of any issuer, TRM said. The firm expects those funds to move next through cross-chain bridges, swap services and over-the-counter brokers (TRM Labs).

Market reaction

Bitcoin fell about 5% on 30 October, trading near $77,450 with a session low of $76,460. Coinbase shares fell as much as 12.5% intraday, Robinhood, Riot Platforms and Hut 8 each lost more than 8%, and Strategy fell about 6%. The wider market was also lower, with the Invesco QQQ Trust down 2.83% on the day (CoinCentral).

Aave paused new deposits and borrowing after the attacker's activity on the protocol and reopened its markets on Friday afternoon.

Analysts at Cantor Fitzgerald, TD Cowen and Compass Point said the hack was unlikely to derail the wider crypto market. "We would be buyers on weakness," said Cantor analyst Ramsey El-Assal. TD Cowen's Lance Vitanza said the attack exposed weaknesses at Binance rather than in Bitcoin's technology.

Political response

TRM's global head of policy, Ari Redbord, described the attack as "unprecedented" and said North Korean theft on this scale funds weapons proliferation, making it a global security issue (Al Jazeera).

US President Donald Trump said his administration was looking into the incident. Senator Cynthia Lummis said the CLARITY Act, which stalled in the Senate in September, would have given crypto firms legal cover to freeze suspicious transactions immediately after contact from law enforcement (crypto.news).

Industry recommendations

In its analysis, TRM recommended that exchanges and compliance teams screen incoming deposits against the attacker addresses it has labelled, as funds from the Bitcoin peel chain and Ethereum consolidation wallets are likely to reach exchanges and OTC desks in the coming days.

The firm also advised treasury teams to monitor Ethereum-compatible wallets for unexpected EIP-7702 delegations, to configure signing policies to reject unexpected authorisations, and to separate signing infrastructure and approval paths by chain and wallet tier. In this incident, TRM noted, a single actor obtained valid signatures for wallets on ten chains within hours.

Sean Foley, a crypto markets researcher at Macquarie University in Sydney, told Al Jazeera the attack highlights the risks of holding assets on centralised exchanges and could push more traders toward decentralised alternatives.

Background

Binance has been hacked before. In May 2019 the exchange lost 7,000 BTC, then worth about $40 million, and covered the loss from SAFU, its Secure Asset Fund for Users (The Hacker News). In October 2022, a cross-chain bridge on the Binance-linked BNB Chain was exploited for about $570 million worth of BNB (NBC News).

TRM's 2026 Crypto Crime Report counted $2.87 billion stolen across nearly 150 hacking incidents in all of 2025, less than half the amount taken from Binance on 29 October.

This is a developing story. Figures reflect information available as of 31 October 2026 and may change as investigations continue.