The Binance hack disclosed late on October 29, 2026 is the largest crypto theft on record, according to TRM Labs. Roughly $6.3 billion in digital assets was pulled from the exchange’s wallets, most of it within about 20 minutes. Binance says user funds are safe and that it will cover all losses. But withdrawals are paused, a substantial portion of the stolen assets may still be under the attackers’ control, and two analytics firms are pointing at North Korea.
Key Takeaways
- Binance estimates the total impact at about $6.3 billion. TRM Labs puts it at $6.36 billion and Chainalysis at about $6.4 billion.
- Binance says around $3 billion has been frozen on-chain. TechCrunch reported that Tether froze about $1.56 billion and Circle about $800 million tied to the hack.
- Binance plans to cover losses with its SAFU fund and corporate money. Co-CEO Yi He said the exchange expects to restore withdrawals within 48 hours.
- TRM Labs and Chainalysis both link the attack to North Korea, and TRM names the TraderTraitor group. Attribution has not been officially confirmed.
What happened in the Binance hack
According to TRM Labs’ on-chain analysis, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. Most of it left in roughly 20 minutes starting at 20:05 UTC on October 29.
Binance put the estimated impact at around $6.3 billion in a post on X late that evening. As Yahoo Finance reported, the exchange’s initial findings point to a compromised laptop belonging to a DevOps engineer. That access let the attacker reach a “service container” and submit unauthorized withdrawals. Binance said it found no evidence that wallet private keys were exposed.
Richard Teng, whom CryptoNews identifies as Binance co-CEO, pushed back on the idea that this was just a case of stolen credentials. According to CryptoNews, he described a multi-stage attack that went beyond one engineer’s permissions or a single action.
Containment has been partial. Binance said about $3 billion of the affected assets was frozen on-chain with help from blockchain partners. TechCrunch also reported that stablecoin issuers Tether and Circle froze about $1.56 billion and $800 million, respectively, tied to the hack. Arkham data cited by CoinDesk showed the hacker’s wallets at one point held more than $5.7 billion, including nearly $1.5 billion in BTC and $900 million in ETH.
Who is behind the Binance hack?
Attribution isn’t official yet. TRM Labs blames North Korea’s TraderTraitor group, and a Chainalysis spokesperson told CNN the firm has “high confidence” North Korea was responsible. On-chain investigator ZachXBT also claims TraderTraitor is behind the theft, according to CryptoNews. Binance has engaged law enforcement and blockchain intelligence specialists to trace transactions and recover assets.
Background and context: is the SAFU fund big enough?
The previous record belonged to Bybit, which lost about $1.5 billion in February 2025. Al Jazeera notes that attack was carried out by North Korea’s state-backed Lazarus Group. TRM Labs says this theft is roughly four times larger.
Binance’s response leans on its Secure Asset Fund for Users. Co-CEO Yi He wrote on X that “User funds are safe” and “Binance will cover all hacking losses,” Axios reported. The catch is size. CoinDesk notes that SAFU, created in 2018, holds roughly $1 billion in bitcoin, so most of any shortfall would have to come from Binance’s own funds.
Founder Changpeng Zhao, pardoned by President Trump in October 2025 and still the largest shareholder, said on X: “I don’t manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered.” The exchange has faced a theft before. In May 2019, Binance lost 7,000 BTC (about $41 million), and it said at the time that its secure asset fund would cover the loss so users would not be affected. The episode is also a reminder that assets held on any exchange carry custody risk that users don’t control.
Market reaction
Prices fell on the news. CoinGecko data cited by investingLive showed BNB near $694 around 00:15 GMT on October 30, down 8.6% in 24 hours, with bitcoin near $77,700.
| Asset | Price (Oct 30, 10:13 UTC) | 24h change | 7d change |
|---|---|---|---|
| Bitcoin (BTC) | $77,355 | -3.39% | -5.01% |
| Ethereum (ETH) | $2,223.01 | -4.02% | -7.38% |
| BNB | $702.24 | -5.62% | -5.66% |
| XRP | $1.25 | -3.07% | -5.48% |
| Solana (SOL) | $96.34 | -3.73% | -7.46% |
Source: CoinGecko. BNB’s 24-hour range ran from a low of $682.36 to a high of $753.04. The Crypto Fear & Greed Index read 30 (“Fear”) on October 30. Prices can keep swinging sharply while the situation develops.
What to watch next after the Binance hack
Withdrawals come first. According to U.Today, Yi He said on October 30 that Binance expects to restore them within the next 48 hours, while deposits are working as usual. In our view, a smooth restart would lend weight to the exchange’s statement that it can absorb the loss, while delays would likely invite more scrutiny.
Binance has also said it will publish a detailed technical post-mortem once its investigation is complete, along with an updated Proof of Reserves after security remediation. Those documents may shed light on how the attack unfolded and on the state of the exchange’s reserves. Investigators are still working to trace the funds that have not been frozen.
Users should also be cautious with unsolicited messages that claim to come from Binance support or offer refunds, and should never share a seed phrase or password.
FAQ
Are user funds safe after the Binance hack?
Binance says yes and has pledged to cover all losses using SAFU and corporate funds. That is a company pledge, and following through depends on Binance’s own resources. Users can watch for the promised Proof of Reserves update.
Who was behind the Binance hack?
TRM Labs and Chainalysis link it to North Korea, and TRM names the TraderTraitor group. Attribution has not been officially confirmed.
When will Binance withdrawals resume?
Co-CEO Yi He said on October 30 that Binance expects to restore withdrawals within 48 hours. Binance says deposits are working as usual.
Sources
- Binance Hack: Are Funds Safu? What We Know So Far About the Biggest Heist in Crypto History (CryptoNews)
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (www.trmlabs.com)
- Binance says $6.3bn stolen in biggest crypto heist in history (www.aljazeera.com)
- Crypto platform Binance confirms $6.3 bn hack (finance.yahoo.com)
- Binance pauses withdrawals as hackers suspected of stealing billions in crypto (techcrunch.com)
- Binance halts trading after biggest-ever crypto hack (www.axios.com)
- Binance loses over $6 billion in the largest crypto hack to date (www.coindesk.com)
- Binance Reveals When It Will Resume Withdrawals After Historic Hack – U.Today
- Binance halts deposits and withdrawals, pledges to cover all losses from suspected hack (investinglive.com)
- Binance: North Korea suspected in record $6 billion theft from world's largest crypto exchange (www.cnn.com)
- Bitcoin hack: $41m stolen from cryptocurrency exchange Binance (www.aljazeera.com)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
For advertising inquiries, please email . [email protected] or Telegram
