Binance $6.3B Hack: What Happened and What to Do

Binance says about $6.3 billion was affected in a hack on 29 October 2026, the largest crypto theft on record. The investigation is still going on and the numbers may change. This article was last updated on 31 October 2026 and reflects reports available then.

Key Takeaways

• About $6.3 billion moved out across ten blockchains, most of it in around 20 minutes.
• Binance says its early investigation points to a compromised engineer's laptop, and it has since reported more points of breach.
• About $3 billion has been frozen, according to Binance. Other counts are lower.
• Binance says user funds are safe and that it has set aside more than $6.34 billion to cover the losses. Outside analysts haven't verified all of that.
• Expect scams. Trust only Binance's official channels.

What happened

Blockchain analysis firm TRM Labs says most of the funds moved in about 20 minutes starting at 20:05 UTC across ten blockchains. TRM puts the total at about $6.36 billion, while Binance estimates around $6.3 billion and has warned the figure may rise.

That is about four times the roughly $1.5 billion stolen from Bybit in February 2025, the previous record.

How the attackers got in

Binance's first findings suggest a compromised DevOps engineer's laptop may have let the attacker reach a service container and submit unauthorised withdrawals. It later said it had found additional points of breach, so the laptop may not be the whole story.

Binance says it has found no evidence that wallet private keys leaked. Not everyone is convinced: Mt. Gox's former chief Mark Karpeles told Reuters he thinks keys for at least two wallets were probably accessed. Neither view has been independently settled.

What has been frozen

Stablecoin issuers can freeze tokens on their own networks, which is why part of the money stopped moving.

• Binance: about $3 billion frozen on-chain so far.
• Tether and Circle: early figures from Binance put these at more than 1.567 billion USDT and more than 800 million USDC. Other reports give lower amounts for Tether.
• TRM Labs: about $2.7 billion in total, including freezes by Ripple, World Liberty Financial and Arbitrum's Security Council.

Analytics firm Elliptic counted $2.84 billion in verified freezes as of 30 October. CBC reported that Binance raised its frozen figure to $5 billion, but other reports describe about $5 billion as replacement tokens Binance holds to cover losses, which they count separately from frozen funds.

Frozen funds may be recoverable, but that isn't guaranteed. TRM says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze.

What it means for Binance users

Binance says user funds are safe and that losses will be covered from its SAFU emergency fund and company funds. It says it has set aside more than $6.34 billion, about $5 billion of it already in the same tokens the attacker took, and that the rest is being bought. Analytics firm Nansen said it couldn't verify the funds available beyond the roughly $1.16 billion emergency fund. Binance has also promised an updated Proof of Reserves once the work is finished.

Withdrawals were suspended while security checks run. Binance is targeting a phased restart, subject to those checks, so check its official channels for the current status. Reports differ on whether deposits were affected.

Money on an exchange isn't protected the way a bank deposit is, so a promise to cover losses depends on the company's ability and decision to pay.

Who is behind it

TRM Labs and Chainalysis both attribute the attack, with high confidence, to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group. The FBI blamed the same unit for the Bybit hack. Binance hasn't attributed the attack to anyone, and North Korea routinely denies involvement.

Market reaction

Bitcoin fell to a six-week low of about $76,368, and Ether dropped to a two-month low of $2,178, Al Jazeera reports. BNB fell about 8.6% in early trading. The market was already under pressure from other factors, so not all of the drop comes from the hack.

How to stay safe now

• Don't click "recovery" or "claim your refund" links from messages, comments or ads.
• Get updates only from Binance's official website, app and verified accounts.
• Never share a seed phrase, password or one-time code, whoever asks.
• Turn on two-factor authentication using an authenticator app or a hardware key.
• Don't pay anyone who promises to recover your funds for a fee.

What businesses can learn

This story began, by Binance's early account, with one work laptop. Any business handling payments or customer data can take the same lessons: limit what any single device or account can do, require more than one approval for sensitive actions, and set alerts for unusual activity.

If you want a security review of your app or website, talk to Leyora on WhatsApp.

This article is for information only and is not financial advice.