On October 29, 2026, an attacker moved about $6.36 billion out of Binance's wallets across ten blockchains. TRM Labs, the blockchain analytics firm tracking the transfers, identified it as the largest crypto theft on record. Binance stated it will absorb the loss, and phased withdrawals began reopening on November 1.
At a glance
- Most funds were drained within roughly 20 minutes on October 29.
- TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean state-backed hacking group. The FBI confirmed North Korean responsibility on October 31.
- Binance set aside more than $6.34 billion in corporate funds to cover user balances.
- Deposits continued functioning normally. Suspended withdrawals began resuming on November 1.
- Binance has not yet released a root cause analysis, pending completion of the investigation.
What happened
TRM's onchain analysis shows the attacker prepared the exploit at least 36 hours in advance, funding operations with small withdrawals from Tornado Cash on October 28 and testing attack code on independent wallets the next day. Four hours after testing the payload on an external test wallet, the attacker deployed it to a Binance hot wallet.
The exploit began at 20:05 UTC on October 29 on the XRP Ledger, spreading across Ethereum, Bitcoin, Tron, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. A second wave targeted Avalanche and Polygon around 23:05 UTC. Binance acknowledged a potential security issue and halted withdrawals across several networks.
Stablecoin issuers intervened rapidly. Tether, Circle, Ripple, and World Liberty Financial froze roughly $2.67 billion, while Arbitrum's Security Council locked about $30 million in ETH and ARB. TRM estimated frozen funds near $2.7 billion by early October 30, while Binance estimated the total closer to $3 billion.
How it happened
Binance has not released a technical post-mortem. TRM's initial analysis indicates the attacker compromised the systems authorizing transactions for Binance's hot wallets, the internet-connected wallets used for daily withdrawal processing.
The mechanics differed by network. On Ethereum, the attacker leveraged EIP-7702, which lets an externally owned account delegate execution logic to a smart contract via an authorization signature. The attacker queued 50 pre-signed authorizations to ensure execution, converting the hot wallet into an automated sweeper. Across the other nine networks, which rely on different key formats and signature algorithms, funds left Binance hot wallets through standard signed transfers within thirty minutes. While the Ethereum activity initially looked like credential theft or phishing, the synchronized transfers across nine distinct architectures point to compromised backend signing infrastructure.
Binance initially cited a possible compromised employee laptop, but later noted additional intrusion vectors. Co-CEO Richard Teng stated the attackers ran a self-destruct mechanism to erase forensic evidence, and emphasized that the majority of customer reserves remain in offline cold storage. NyxLab CEO Kok Tin Gan told the AP that the transaction patterns indicate a single high-level authorization granted the attacker persistent access to hot wallet signing.
Who is behind it
TRM and Chainalysis both attribute the attack to TraderTraitor, the North Korean state-sponsored threat actor responsible for the $1.5 billion Bybit breach in February 2025. Technical signatures match previous campaigns: initial operational funding via Tornado Cash, long staging windows, and batches of pre-calculated signatures executed simultaneously.
The FBI confirmed North Korean responsibility on October 31. Binance stated it is coordinating with law enforcement, and President Trump confirmed US federal agencies are investigating the theft.
Where the stolen money is now
Roughly $2.7 billion remains frozen by token issuers and network operators. TRM estimates the attacker still holds approximately $2.4 billion in unfreezable assets, primarily over 420,000 ETH and 18,270 BTC.
Immediately following the exploit, the attacker moved to outrun issuer blacklists by selling roughly 325 million USDT to market makers at discounts topping 10% and borrowing ETH against USDT on Aave. TRM expects subsequent laundering will route through cross-chain bridges, decentralized liquidity pools, and over-the-counter brokers.
At $6.36 billion, this breach is roughly four times the size of the Bybit theft. Binance founder Changpeng Zhao noted that while this incident set an all-time dollar record, earlier historic hacks such as Mt. Gox involved higher total quantities of bitcoin.
What this means for Binance users
Binance stated that users will not absorb the loss, committing over $6.34 billion in company reserves. On November 1, CoinDesk reported that Binance had restored backing for roughly 95% of impacted balances, up from 90% the day prior. This reflects corporate capital allocated to replace missing assets while frozen funds await legal recovery, rather than funds returned by the attacker.
Deposits remained open. Withdrawals resumed in phases on November 1 between 06:00 and 09:00 UTC, starting with bitcoin. Remaining tokens and networks require individual security validation before going live, leading to staggered recovery times. Binance.US, which runs on separate infrastructure, reported no impact. Market prices fell following the disclosure, with bitcoin dropping near $77,000.
While Binance is absorbing the financial loss, the upcoming root-cause disclosure remains critical for the wider sector to determine whether similar vulnerabilities exist in other centralized signing setups.
What to do right now
Current disclosures indicate the exploit compromised internal exchange hot wallets rather than user credentials or account databases. Recommended precautions include:
- Rely exclusively on Binance's verified website and official X account for service updates. Disregard links in emails, direct messages, or search advertisements.
- Watch for opportunistic phishing campaigns promoting fake claims, refunds, or wallet re-verification.
- Ensure two-factor authentication and an anti-phishing code are active on your account.
- Plan for staggered withdrawal schedules, as networks are reactivated individually.
- Review overall exchange exposure and consider migrating long-term balances to self-custody cold storage.
What to watch next
Binance stated it will issue a full technical report once forensic work finishes. Primary ongoing factors include the schedule for remaining withdrawal rails, legal resolution around the $2.7 billion in frozen stablecoins, and onchain movement of the attacker's remaining $2.4 billion in ETH and BTC.
What developers can take from this
The incident compromised signing infrastructure rather than smart contract logic. Key takeaways for teams managing programmatic keys and transaction systems:
- Monitor Ethereum accounts for unexpected EIP-7702 delegations, which appear as contract code deployed to externally owned addresses.
- Flag high-volume authorization queues or nonce-spanning signature requests as indicators of compromise.
- Segment signing architecture and authorization boundaries across chains and storage tiers so a single compromise cannot sign cross-network transactions.
- Implement and test fast-path revocation mechanisms for all delegated signing keys.
- Strictly constrain the transaction scopes and spending limits granted to automated signing services.
Frequently asked questions
Is my money safe on Binance?
Binance stated it is covering all user losses and allocated over $6.34 billion from company reserves, reporting 95% backing for affected assets by November 1. Forensic investigations remain underway.
Can I withdraw from Binance now?
Partially. Bitcoin withdrawals reopened on November 1, with other assets and networks returning in phases as individual verification checks complete. Binance's official channels maintain the active list.
Who hacked Binance?
TRM Labs and Chainalysis attributed the breach to TraderTraitor, a North Korean state-sponsored group. The FBI confirmed North Korean responsibility on October 31.
Was this a hack of user accounts?
Current evidence indicates an exploit of Binance's internal hot wallet signing systems, not individual user accounts or credentials. Binance has not yet published its full forensic report.
Is this the biggest crypto hack ever?
In nominal dollar terms, yes. At approximately $6.36 billion, it is roughly four times larger than the February 2025 Bybit hack.
