Buy a Licensed Company 
Explore VASP Data 
Talk to an Expert 
Dren Hima
Dren Hima is Head of Research at Coincub, leading research across digital asset regulation, licensing, market structure, tokenization and institutional adoption.
Binance Loses $6.3 Billion in Largest Crypto Hack on Record
- Attackers drained about $6.3 billion from Binance hot wallets on 29 October 2026, the largest crypto theft on record. Elliptic and Chainalysis put the figure at about $6.4 billion.
- Binance traced the breach to a compromised DevOps engineer’s laptop, later found additional points of breach, and says it has seen no evidence that private keys leaked.
- About $2.8 billion is frozen, almost all of it USDT and USDC. None of the stolen bitcoin, XRP or SOL has been frozen.
- TRM Labs and Chainalysis attribute the theft with high confidence to North Korea’s TraderTraitor. Binance and governments have not named a culprit.
- The hack lands while the Justice Department is reviewing Binance’s compliance with its 2023 guilty plea and $4.3 billion settlement.
Attackers drained about $6.3 billion from Binance hot wallets on 29 October 2026, by the exchange’s own estimate, in the largest crypto theft on record. Elliptic puts the total at $6.43 billion and Chainalysis at about $6.4 billion. Binance paused withdrawals, said it would cover every user loss and has set aside $6.34 billion to do it.
How much of the money comes back depends on what was taken. About $2.8 billion was frozen within hours, and stablecoins make up 94% of it, according to Elliptic. Bitcoin, XRP and Solana have no issuer that can block an address, and none of the coins stolen on those networks has been frozen.
How the Binance hack unfolded
The first drain hit the XRP Ledger at about 20:05 UTC on 29 October, when 233 million XRP left five Binance wallets. At 20:20 UTC the attacker submitted pre-signed EIP-7702 authorizations to Binance’s main Ethereum hot wallet. Three minutes later, $2.53 billion left that wallet in a single transaction. Most of the money was gone within about 20 minutes, across at least ten blockchains, and a second wave hit Avalanche and Polygon after 23:00 UTC.
EIP-7702 is the account feature added in Ethereum’s Pectra upgrade. The attacker used a wallet funded through Tornado Cash to submit the authorizations, and they let Binance’s hot wallet run attacker-deployed code that swept its assets to attacker addresses. Binance wallets on the other chains sent funds through ordinary signed transfers. TRM Labs reads the pattern as a likely compromise of Binance’s hot wallet signing infrastructure.
What Binance says caused the breach
Binance said its initial investigation points to a compromised laptop belonging to a DevOps engineer. The attacker used it to reach a service container and submit unauthorized withdrawal transactions. Binance said it has found no evidence that wallet private keys leaked.
On 30 October the exchange said investigators had found “additional points of breach.” Co-CEO Richard Teng described “a more complex attack process” than a single action. Binance said it will publish a detailed technical post-mortem once its investigation is complete.
Frozen funds and what the attacker still holds
Tether froze more than $1.57 billion in USDT, chief executive Paolo Ardoino said. Circle’s freeze of more than $800 million in USDC was made in coordination with law enforcement, and Ripple froze about $200 million, according to Binance co-CEO Yi He. World Liberty Financial, working with custodian BitGo, froze about $27 million in stablecoins. The Arbitrum Security Council locked about $30 million in ETH and ARB, and Aave froze markets after the attacker borrowed about 19,760 ETH against stolen USDT.
The attacker converted about $786 million of stablecoins into ETH and TRX before the freezes landed, Elliptic said. It estimates the attacker still controls about $3.33 billion in assets no issuer can freeze, spread across about 43 addresses and including 18,270 BTC and 511,861 ETH.
Who is behind the Binance hack
TRM Labs and Chainalysis both attribute the theft with high confidence to TraderTraitor, a North Korean hacking unit the FBI tied to the $1.5 billion Bybit hack in February 2025. Chainalysis said it watched funds stolen from Binance mix with proceeds from the September exploit of Bitget, which had been attributed to North Korean actors.
Elliptic also names North Korea as the likely culprit, with a caveat. Only about $39,000 of Binance funds reached the address shared with the Bitget proceeds. Elliptic says that points to a shared laundering network and stops short of proving the same hacker.
“Our investigation has not attributed responsibility to any individual,” Teng said on X. No government or law enforcement agency has confirmed the attribution. The Justice Department and the FBI did not immediately respond to requests for comment from AFP.
Binance’s 2023 settlement and the DOJ review
Binance pleaded guilty in 2023 to violating US banking rules, agreed to a $4.3 billion penalty and accepted stronger compliance controls. The agreement requires it to report evidence of misconduct under money laundering, banking and sanctions laws. A breach of the agreement can expose Binance to prosecution for the conduct it settled.
In early October, Tysen Duva, head of the Justice Department’s criminal division, told Bloomberg that officials are reviewing whether Binance has complied with that agreement. Prosecutors in Manhattan are separately investigating whether Binance violated US sanctions on Iran, and in September sought forfeiture of $61 million they said came from Iranian black-market oil sales and was laundered through the exchange. The department has not said Binance breached the settlement, and Binance said at the time that it is “fully committed to cooperating with law enforcement.”
The US Treasury has sanctioned North Korea’s Lazarus Group, the network Elliptic connects to TraderTraitor, since September 2019. If US authorities confirm the attribution, exchanges, OTC desks and bridge operators that handle the stolen funds take on sanctions risk.
Market reaction to the Binance hack
Bitcoin fell about 4.9% to around $76,900 in the hours after the theft, and BNB fell about 8%, Cointelegraph reported. Coinbase and Strategy shares each fell about 8% in early trading on Friday, during a broader tech selloff, according to TheStreet.
Binance is the most visited brand in Coincub Data, with about 21.1 million unique monthly visitors. Its companies hold 21 registrations in the database, level with Coinbase and behind Kraken at 30.
What happens next for Binance users
Withdrawals remain paused, and deposits are working normally. On the morning of 30 October, Binance said it was on track to restart withdrawals within 45 hours, which points to early Sunday, 1 November.
A Binance spokesperson told CoinDesk that $5 billion of the $6.34 billion set aside is already held in the affected tokens. The exchange is buying the rest on public markets and over the counter. Binance will also draw on its Secure Asset Fund for Users, an emergency reserve that has typically held about $1 billion in bitcoin. “Ultimately, all user funds will be verified publicly through our Proof of Reserves,” the spokesperson said.
Chainalysis expects the stolen funds to keep moving over the coming days. The next stage of laundering will likely run through cross-chain bridges, swap services and OTC brokers, according to TRM Labs.
