31 Oct 2026 4 min read

Binance's $6.3 Billion Breach: Crypto's Biggest Heist

Attackers drained about $6.3 billion from Binance's hot wallets on the night of October 29, 2026 — more than four times the previous record for a crypto theft. Binance says it will absorb every dollar of the loss, and that customer balances are untouched.

The world's largest crypto exchange disclosed the breach in a security incident update published early on October 30. Withdrawals are frozen while it investigates; deposits and trading continue. Roughly $3 billion of the stolen assets has already been frozen on-chain.

The previous record was the $1.5 billion Bybit hack in February 2025. This one is in a different league.

How the attack unfolded

Binance says its hot wallets were compromised at about 20:05 UTC on October 29. According to blockchain analytics firm TRM Labs, the attacker moved roughly $6.36 billion across ten blockchains, most of it within about 20 minutes (NPR).

The exchange's first explanation pointed to a single weak link. Its initial update said a DevOps engineer's laptop appeared to have been compromised, giving the attacker access to a service container from which unauthorized withdrawal transactions were submitted.

That picture has since widened. In a second update signed by its co-CEOs, "Yi and Richard", Binance said investigators had found additional points of breach beyond the laptop. It has not said where. Both updates stress one point: so far there is no evidence that any wallet private keys were leaked.

Time (UTC)	Event
Oct 30, 19:33	Update #2: $6.34B set aside, more breach points found, withdrawals targeted in ~34 hours
Oct 30, 11:36	First update revised to clarify deposits are unaffected
Oct 30, 02:23	Binance publishes first update: ~$6.3B impact, ~$3B frozen, withdrawals suspended
Oct 29, evening	Tether and Circle freeze stablecoins tied to the attacker
Oct 29, ~20:05	Hot wallets compromised; funds drained across ten chains

Who is behind it

Two leading blockchain intelligence firms have pointed at North Korea. TRM Labs linked the attack to a state-sponsored North Korean group, and Chainalysis CEO Jonathan Levin said it was likely the work of TraderTraitor (CNBC). The FBI previously tied the same group to the Bybit theft.

Investigators, including on-chain sleuth ZachXBT, also found the stolen funds commingled with proceeds from last month's $388 million Bitget exploit (AMBCrypto). Binance itself has not named a culprit, saying only that it is working with law enforcement to identify those responsible.

Freezing the loot

About $3 billion — nearly half the haul — is already frozen, largely because so much of it was in stablecoins whose issuers can block tokens. More than $2 billion of the frozen assets are stablecoins (Yahoo Finance).

Freezing party	Amount frozen
Tether	~$1.567B in USDT (NBC News)
Circle	>$800M in USDC (PBS/AP)
World Liberty Financial, with BitGo	~$27M in stablecoins + ~$2M in WLFI tokens (TradingView)

Frozen is not the same as recovered. Binance says it is working with law enforcement, token issuers and other exchanges to claw the funds back, and expects further recoveries.

Who pays

Binance, not its users. The exchange says it will cover the full loss from its Secure Asset Fund for Users (SAFU) and its corporate treasury.

It has already set aside more than $6.34 billion, including $5 billion held in the exact assets that were stolen — USDC, USDT, BTC, ETH, BNB and others. That covers about 80% of the impact in kind; Binance is buying the remaining 20% through market and OTC channels.

The pledge matters because crypto exchange balances carry no deposit insurance. Any reimbursement is at the exchange's discretion (NBC News). Founder Changpeng Zhao, now a shareholder rather than an executive, said on X that he expects all user funds to be fully covered.

Market fallout

Prices slid as news spread. Bitcoin dipped as low as $76,518 before recovering to around $78,100, down 2.5%, while Binance's own BNB token fell about 6% (Investing.com). Crypto-exposed stocks also fell.

The drop was sharp but not a panic, likely because Binance moved quickly to freeze funds and guarantee balances. Analysts say the real test is how fast withdrawals reopen and whether outflows stay orderly when they do (CNBC). Binance holds a large share of the market: it reports 335 million registered users and about $162.8 billion in assets under custody as of its 2025 annual report.

What happens next

Binance has set out four priorities for the coming days:

Restore withdrawals — in phases, starting roughly 34 hours after the October 30 evening update, which points to Sunday, November 1 (UTC). Co-CEO Yi He has also said withdrawals should be back by Sunday (Bloomberg). The timing depends on security checks finishing.
Publish a fresh Proof of Reserves — a snapshot is being taken now, with results due Monday, November 2, so users can verify their balances are backed.
Recover the frozen funds — through law enforcement, analytics firms, token issuers and other exchanges.
Release a technical post-mortem — further findings are expected within about 48 hours of the second update, with a full report on causes and new safeguards later.

What users should do now

Don't panic-sell or rush the exit. Binance says balances are intact and losses are covered; trading and deposits still work.
Expect a phased reopening. Withdrawals may return asset by asset or network by network, with possible queues.
Use only official channels. Major hacks attract phishing and fake "refund" or "recovery" scams. Follow Binance's official announcements and never share passwords or 2FA codes.
Check the Proof of Reserves on November 2. It is the clearest independent signal that Binance's backing is whole.
Binance.US users are not affected, according to that exchange (ABC News).

The bigger question is what this means for the industry. A single compromised laptop, plus other still-undisclosed weak points, was enough to empty billions from the best-resourced exchange in crypto. The post-mortem will be read closely across the sector.