Direct answer: yes — Binance was hacked. On the evening of October 29, 2026, billions of dollars in cryptocurrency left wallets linked to Binance, the world's largest crypto exchange by trading volume, in unauthorised withdrawals. Early on-chain estimates put the outflow at around $5.6 billion. Binance's own later estimate put the total impact at around $6.3 billion. Either figure makes it the largest crypto exchange hack on record — more than four times the previous record, the roughly $1.5 billion taken from Bybit in February 2025. Binance has pledged to cover all customer losses, and about $3 billion has been frozen so far. Frozen does not mean recovered, and the investigation is still in its early days.
What happened on the night of October 29
The theft moved fast. According to blockchain analytics firm TRM Labs, an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes. The affected networks included Ethereum, Bitcoin, Tron, Solana, Arbitrum, Avalanche, Optimism, Base, Polygon and the XRP Ledger. On Ethereum, TRM says the attacker used an EIP-7702 delegation — a mechanism that lets a standard wallet hand control of its behaviour to a smart contract — to turn a Binance hot wallet into a sweeper under the attacker's control.
As the outflows were spotted, the industry's freeze machinery kicked in. Stablecoin issuers can blacklist addresses holding their tokens, and they did: Tether froze around $1.57 billion in USDT, Circle froze around $823 million in USDC, and Ripple intercepted around $200 million. Binance itself suspended withdrawals while it secured its systems, and said it expected withdrawals to resume within about 48 hours.
Binance founder Changpeng Zhao, known as CZ, posted on X that the outflow "does look like a hack on Binance" and that user funds were safe. Binance co-CEO Yi He said in a separate post that the platform would cover "all hacking losses". Binance's later update put the total impact at about $6.3 billion and the amount frozen at about $3 billion — close to half of the estimated outflow.
The two numbers: $5.6 billion and $6.3 billion
If you have seen two different totals, neither is a typo — they measure the same event at different times, with different methods. The $5.6 billion figure was the early on-chain estimate, tallied from wallets and transfers visible on public blockchains in the first hours. Binance's $6.3 billion figure is the exchange's own later estimate of the incident's total impact, and TRM Labs' independent tracing landed in the same place, at about $6.36 billion. The honest way to report it: around $5.6 billion by the first count, around $6.3 billion by the exchange's count. Expect the final number to move again as Binance publishes its findings.
| Where the early $5.6 billion estimate came from | Amount |
|---|---|
| Ethereum | About $3.51 billion |
| Bitcoin — 18,270 BTC | About $1.44 billion |
| Tron | About $630 million |
| Early on-chain total | About $5.6 billion |
The three components above add up to roughly $5.58 billion, which is why the early tally was rounded to $5.6 billion. The later $6.3 billion estimate covers more chains and more transfers than the first count, which is why it is higher — not because another $700 million disappeared later.
What was frozen — and what frozen does not mean
About $3 billion frozen is a genuinely large intervention, and it is also routinely misunderstood. Freezing a stablecoin means the issuer blacklists the attacker's addresses, so those tokens cannot move or be redeemed. It does not put the money back in Binance's wallets, and it does not by itself return anything to users. Recovery — getting frozen funds released back to the exchange or to victims — is a separate legal and technical process that takes time, and some frozen funds may stay frozen for a long while.
Freezing also only works on assets with a central issuer. Tether can freeze USDT. Circle can freeze USDC. Nobody can freeze bitcoin or ether in the same way: the 18,270 BTC, worth about $1.44 billion in the early tally, can only be tracked, not switched off. TRM estimated the attacker still held more than 420,000 ETH and the 18,270 BTC beyond the issuers' reach, with the bitcoin moving through a "peel chain" — a laundering method that splits funds into a long string of smaller transfers. That is why the frozen share, large as it is, is only about half the story.
| Who froze what | Amount frozen |
|---|---|
| Tether (USDT) | About $1.57 billion |
| Circle (USDC) | About $823 million |
| Ripple (intercepted) | About $200 million |
| Total frozen (Binance's update, all parties) | About $3 billion |
The three named figures add up to about $2.6 billion; the remaining share of the roughly $3 billion total came from other issuers and platforms acting alongside Binance. Treat the $3 billion as Binance's rounded total, not as the sum of the three rows.
How the attack reportedly worked — and what is disputed
Binance's preliminary explanation is that a laptop belonging to a DevOps engineer was compromised, and that the compromise let an attacker reach a service container — a sealed unit of the exchange's internal software — and submit unauthorised withdrawals from it. Binance says it found no evidence that wallet private keys leaked. That last point matters: if private keys had leaked, the attacker could keep signing withdrawals at will, and the fix would be far bigger than securing one laptop and one container.
That account is preliminary, and it is already disputed. At least one security firm has publicly questioned whether a laptop compromise alone explains an attack of this speed and scale across ten blockchains, and TRM's analysis has pointed instead toward a possible compromise of Binance's hot-wallet signing infrastructure. Binance has not published a full technical post-mortem, and has not presented the laptop finding as a completed forensic account. Until it does, treat the "how" as an open question with two competing explanations, not a settled fact.
Who is blamed — and who has not confirmed it
TRM Labs has attributed the attack to TraderTraitor, a North Korean hacking unit within the wider Lazarus ecosystem, saying it made that judgment "with high confidence" based on on-chain and off-chain intelligence. The FBI previously used the TraderTraitor name when it attributed the February 2025 Bybit hack, worth about $1.5 billion, to North Korea, and TRM says the Binance attack shares preparation and transaction patterns with that earlier theft, including small Tornado Cash withdrawals used to fund an operator wallet in advance.
Binance has NOT confirmed that attribution. The exchange has said it is cooperating with law enforcement to determine who carried out the attack, but it has not publicly named a suspect. Independent investigator ZachXBT reached a similar conclusion to TRM's, and the CEO of Chainalysis has called TraderTraitor the likely perpetrator — but those are investigators' assessments, not an official finding. No government has formally named a culprit for the Binance attack yet. Reporting the attribution as TRM's, rather than as fact, is the honest line.
What Binance promises users — and whether the money covers it
Binance has pledged to cover all customer losses using its Secure Asset Fund for Users (SAFU) and company funds, and its executives have repeated that user funds are safe. Withdrawals were suspended during the security overhaul, with resumption expected within about 48 hours of the incident, while deposits continued to operate normally.
One honest caveat on the pledge: the SAFU fund alone cannot cover a $6.3 billion loss. CoinDesk reported that SAFU holds roughly $1 billion in bitcoin. That means the bulk of any payout must come from Binance's own company funds — which, with roughly $144 billion in assets on the platform before the hack according to DefiLlama data, is plausible, but it is not yet itemised. Binance has not detailed how much will come from SAFU and how much from company funds, and it has promised an updated Proof of Reserves after remediation. Until that breakdown and the reserves update appear, "all losses covered" is a pledge, not a completed payment.
The market reaction
Crypto prices fell on the news. Bitcoin hit a six-week low of around $76,470, down about 3%, and ether fell more than 3%. The drop is modest next to the scale of the theft, and that itself is informative: markets treated this as a blow to one exchange's security rather than a blow to the underlying networks. Bitcoin and Ethereum kept running exactly as before — the theft exploited Binance's systems, not the blockchains themselves. Whether prices recover quickly will depend less on the hack's size and more on whether withdrawals resume on schedule and the reserves update reassures holders.
What it means if you hold crypto on an exchange
The lasting lesson of this hack is one the crypto world repeats after every big exchange theft, and it applies regardless of which exchange you use: coins held on an exchange are ultimately under the exchange's control, not yours. If the exchange's internal systems are breached, your balance depends on the exchange's promise to make you whole — as Binance has now promised — rather than on anything you control directly.
The alternative is self-custody: holding your own coins in a wallet whose keys only you possess, ideally a hardware wallet kept offline. That removes exchange-breach risk, but it replaces it with personal responsibility — lose the keys and there is no support desk. There is no risk-free option, only a choice about which risk you would rather carry. This article is not financial advice, and it is not a recommendation to move any specific asset; it is a description of the trade-off that this hack has put back in front of every exchange user.
Three practical steps are worth taking after any exchange hack, whatever you decide about custody: turn on every security feature your exchange offers, especially hardware-key two-factor authentication; check that withdrawal addresses and connected devices on your account are ones you recognise; and be alert for phishing in the days after a hack, when scammers impersonate support teams offering "recovery" help.
What to watch next
- Withdrawals resuming on schedule — Binance pointed to about 48 hours; a delay would signal deeper damage than the first updates suggested.
- The updated Proof of Reserves — the next snapshot will show whether customer assets are fully backed after the theft, and how the gap was filled.
- The full post-mortem — whether Binance confirms the laptop explanation or revises it, and what it changes in its withdrawal systems.
- Attribution — whether any government or Binance itself confirms TRM's TraderTraitor attribution, or whether it stays an investigators' assessment.
- Frozen vs recovered — how much of the roughly $3 billion frozen actually makes its way back, and over what timescale.
Frequently asked questions
Did Binance users lose their money?
Binance says no — it has pledged to cover all hacking losses from its SAFU fund and company funds, and its executives have repeated that user funds are safe. The pledge is not yet a completed payment, and the breakdown between SAFU and company funds has not been published. Withdrawals were temporarily suspended during the security overhaul.
How much was stolen — $5.6 billion or $6.3 billion?
Both figures describe the same event. About $5.6 billion was the early on-chain estimate, built from roughly $3.51 billion on Ethereum, about $1.44 billion in 18,270 bitcoin, and about $630 million on Tron. About $6.3 billion is Binance's later estimate of the total impact, and TRM Labs' independent tracing put it at about $6.36 billion. The later figure covers more chains and transfers than the first count.
Who hacked Binance?
TRM Labs attributes the attack to TraderTraitor, a North Korean hacking unit, with high confidence, citing similarities to the February 2025 Bybit hack. Binance has not confirmed that attribution and has not publicly named a suspect, and no government has formally named a culprit for this attack yet. Treat the attribution as TRM's assessment, not an established fact.
How much of the stolen crypto has been frozen?
About $3 billion, according to Binance's update — including about $1.57 billion in USDT frozen by Tether, about $823 million in USDC frozen by Circle, and about $200 million intercepted by Ripple. Frozen does not mean recovered: frozen tokens cannot move, but returning them is a separate process that takes time, and bitcoin and ether cannot be frozen at all.
Is my crypto safe on an exchange after this?
An exchange hack does not break the underlying blockchains — Bitcoin and Ethereum kept running normally. But coins on an exchange are under the exchange's control, so your protection is the exchange's promise to cover losses, as Binance has pledged here. Self-custody removes that dependence but puts full responsibility for your keys on you. There is no risk-free option; this article is not financial advice.
Sources
- CoinDesk: Binance loses over $6 billion in the largest crypto hack to date — https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets
- Reuters: Blockchain analysis firm TRM says North Korea behind Binance crypto theft — https://www.reuters.com/legal/government/blockchain-analysis-firm-trm-says-north-korea-behind-binance-crypto-theft-2026-10-30/
- SecurityWeek: $6 billion Binance hack bears hallmarks of North Korea's TraderTraitor — https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/
- Seoul Economic Daily: Binance hit by $6.3 billion hack, largest ever in crypto — https://en.sedaily.com/finance/2026/10/30/binance-hit-by-63-billion-hack-largest-ever-in-crypto
- CCN: Binance's $6.3B Halloween hack — where are the stolen billions? — https://www.ccn.com/news/crypto/binance-6-3b-halloween-hack-stolen-bitcoin-ethereum-wallets/
- News.Bitcoin.com: Binance hack pinned on North Korea's Lazarus Group by TRM Labs and ZachXBT — https://news.bitcoin.com/security/binance-hack-north-korea-lazarus-tradertraitor/
Be the first to share a useful question or thought.