Binance hack drained around $6.3 billion from Binance on Thursday, October 29, 2026. Investigators call this Binance hack the biggest cryptocurrency theft in history. Meanwhile, the exchange ranks as the largest crypto platform by trading volume. It confirmed the breach late on Thursday. After that, it paused deposits and withdrawals at once. In addition, it traced the funds with police and blockchain firms.
TRM Labs traced about $6.36 billion across ten blockchains. Most transfers finished in roughly 20 minutes. However, attackers first made small test withdrawals on Wednesday morning. They then launched the main wave on Thursday evening. Arkham Intelligence tracked attacker wallets at one point. Those wallets held more than $5.7 billion. In addition, attacker wallets held nearly $1.5 billion in bitcoin. They held around $900 million in ether. At the same time, they held roughly $1.5 billion in USDT. They held more than $800 million in USDC.
Binance hack: how the attack happened
Binance says a compromised laptop opened the door. A DevOps engineer owned that laptop. However, attackers used that laptop to reach a service container. They then submitted unauthorised withdrawal transactions. The exchange found no sign that private keys leaked. Private keys approve transfers, so that detail matters. Meanwhile, it still investigates the exact attack path. It calls this Binance hack a complex, multi-step operation.
A race then began to freeze the funds. Binance says issuers froze about $3 billion. Issuers froze $2.3 billion in USDT and USDC. Stablecoin issuers can block flagged tokens. However, TRM Labs estimates attackers still control about $2.4 billion. Most of that sum sits in bitcoin. Bitcoin has no central issuer to freeze it. As a result, recovery of that part looks much harder. The exchange expects withdrawals to resume by Sunday morning. It will finish security checks first.
Binance hack: who investigators blame
Several firms blame North Korea for this Binance hack. TRM Labs attributes this Binance hack to TraderTraitor. TraderTraitor works as an elite North Korean hacking unit. TRM Labs bases this claim on strong on-chain and off-chain evidence. Meanwhile, Chainalysis also blames North Korea with high confidence. Singapore firm Pangolin Intelligence reaches the same conclusion. Investigator ZachXBT also links North Korea to the attack. Security firm Blockaid also links North Korea to the attack. A SecurityWeek report on the Binance hack reaches the same conclusion.
United States officials previously named TraderTraitor in other cases. Officials link TraderTraitor to the Lazarus group. Washington says Lazarus works under a North Korean intelligence service. The FBI blamed TraderTraitor for the Bybit hack in February 2025. That Bybit hack cost about $1.5 billion. In contrast, this Binance hack costs more than four times that sum. CNN sought comment from North Korea’s United Nations mission. Pyongyang has denied hacking claims in the past.
Binance says users will be covered
Binance moved fast to reassure customers. Co-CEO Yi He posted a message on X. Yi He promised Binance will cover all hacking losses. The exchange says user funds remain safe. It will pay losses from its own funds. In addition, it will use its Secure Asset Fund for Users. Users know that fund as SAFU, an emergency reserve. The exchange found no sign that customer passwords leaked. It found no sign that customer private keys leaked. As a result, customers should not need to change credentials. The exchange says attackers stole money from its own wallets. It uses those wallets to process customer withdrawals.
That assurance matters because the sums are huge. Binance held 688,572 bitcoins on October 1. It held nearly 3.8 million ether on October 1. Meanwhile, it handles a large share of global crypto trading. A loss of trust could ripple far beyond Binance customers.
Markets fall as bitcoin drops below $77,000
Crypto markets reacted sharply to this Binance hack. Bitcoin fell about 5 percent in early hours. It dropped from around $80,000 to below $77,000. However, it had traded above $86,000 earlier in October. Ether also slid to near $2,231. Traders already feared stretched valuations after a long rally. In addition, this Binance hack added fresh pressure to that market.
This Binance hack also revived a security debate. Exchanges hold huge sums in internet-connected wallets. They need those wallets to process withdrawals. As a result, that need makes exchanges prime targets. Chainalysis says North Korea-linked hackers stole about $1.7 billion in 2022. Investigators say stolen crypto funds North Korea’s weapons programmes. Pyongyang denies that claim.
What happens next
Investigators will now track the remaining funds across blockchains. Bitcoin has no central authority to freeze it. Attackers can move bitcoin to wallets they control. They may launder funds through decentralised trading platforms. TRM Labs says attackers already use that path. Recovery depends on exchanges refusing flagged funds. In addition, recovery depends on police tracing wallets to real people.
Binance faces an immediate test now. It must restore withdrawals on schedule. It must prove its security overhaul closes the gap. Attackers exploited that gap through one compromised laptop. They produced the biggest theft ever in under half an hour. The wider crypto industry faces the same lesson. Even the largest exchange is not immune. Read more technology news on sialnews.com.
