Binance is the world's largest crypto exchange. Late on 29 October 2026, its security team watched billions of dollars leave its hot wallets, the accounts it keeps online to process withdrawals. This is what is known two days later, from Binance's own updates, the FBI and the blockchain analytics firms tracing the money. It is a developing story, and we will update this page as the investigation continues.

stolen, by Binance's count ($6.36B to $6.43B by analytics firms)
$6.3B
blockchains hit
10
from the first transfer to Binance shutting the attacker out
~4 hours
frozen, mostly stablecoins
$2.7-3B
set aside by Binance to cover users
$6.34B+
in crypto futures liquidated as prices fell
$1.57B

What happened

Binance dates the compromise to about 20:05 UTC on 29 October. Most of the money moved within about 20 minutes; the draining went on until Binance revoked the attacker's access shortly after midnight.128

  1. 28 Oct

    The attacker's wallet is funded with three small withdrawals from the Tornado Cash mixer, and the attack code is tested on test wallets.

  2. 29 Oct, 20:05 UTC

    Binance's XRP wallets are drained.

  3. 29 Oct, 20:20 UTC

    18,270 bitcoin and Tron stablecoins are taken. The attacker takes control of an Ethereum hot wallet called "Binance 14".

  4. 29 Oct, 20:24 UTC

    167,464 ether and 63 other tokens are swept from Ethereum, including about 1.6 billion USDT.

  5. 29 Oct, 21:01 UTC

    Tether freezes 971.1 million USDT; three minutes later Circle freezes 823 million USDC.

  6. 29 Oct, 22:55 UTC

    Binance says more than $5.7 billion is affected.

  7. 30 Oct, 00:10 UTC

    Binance revokes the attacker's access to the Ethereum wallet. By about 00:30 it has suspended deposits and withdrawals.

  8. 30 Oct

    TRM Labs and Chainalysis link the theft to North Korea's TraderTraitor group. Binance says it has set aside more than $6.34 billion.

  9. 31 Oct

    Binance says 90% of the stolen assets are replenished. The FBI attributes the theft to North Korea.

Times from TRM Labs, CoinDesk and Binance's updates.2816

How the attack worked

The attacker reached Binance's hot wallets on ten blockchains. On Ethereum, they used a feature added in a 2025 network upgrade, EIP-7702, to turn the "Binance 14" wallet into one they controlled, and drained about $2.5 billion in under four minutes. Customer deposits that arrived afterwards were swept too.8 On the other nine chains the thefts were ordinary signed transfers: TRM Labs and Elliptic believe the attacker got Binance's own signing system to approve them.24

Binance first pointed to a compromised laptop belonging to one of its engineers. It later said it had found additional points of breach and tools used to wipe evidence. "The attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action," co-CEO Richard Teng said.98 Binance says it found no evidence that private keys leaked, and has promised a full post-mortem.1 Investigators say the attack was staged at least 36 hours in advance.10

BlockchainTakenValue
Ethereum200,630 ETH and 185 tokens, including 1.875B USDT and 823M USDC~$3.79B
Bitcoin18,270 BTC~$1.47B
Tron612.7M USDT and 46.4M TRX~$628M
XRP Ledger233.46M XRP~$296M
Solana970,500 SOL~$96M
Arbitrum, Optimism and BaseVarious~$39M
AvalancheVarious~$28M
PolygonVarious~$10M

Breakdown by TRM Labs as of 30 October, at prices then.2

Who did it

On 31 October the FBI, working with the Secret Service and IRS Criminal Investigation, said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets". It published hundreds of wallet addresses and asked exchanges, DeFi services and THORChain node operators to block them.311

The analytics firms had reached the same conclusion a day earlier. TRM Labs attributed the theft to TraderTraitor, a North Korean hacking unit, "with high confidence". Chainalysis assessed that TraderTraitor was responsible after seeing the stolen funds mixed with money from the September 2026 Bitget theft, and Elliptic called the group the likely perpetrator.254 TRM now estimates North Korea has stolen $7.4 billion in crypto in 2026, most of it from Binance.12

Where the money is

Stablecoins can be frozen by the companies that issue them, and that is where most of the frozen money comes from: about $1.77 billion of Tether's USDT and about $823 million of Circle's USDC, plus smaller amounts frozen by Ripple, World Liberty Financial and the Arbitrum security council. The estimates of the total frozen range from $2.7 billion (TRM Labs) to $2.85 billion verified by Elliptic, and about $3 billion by Binance's count.241

The attacker moved fast to get the rest out of reach. They swapped stablecoins for ether at discounts of 10% to 26%, borrowed ether against stolen USDT on the lending platform Aave, and routed funds through THORChain. They still hold more than 420,000 ether and the 18,270 bitcoin, which were split across 19 wallets.2513

A freeze is not a refund. "A freeze stops the money from moving, and recovery follows through legal process," said TRM Labs' Ari Redbord.10 Nothing had been returned by 31 October, and no bounty has been offered.14

What Binance has done

Binance suspended withdrawals and, briefly, deposits; deposits and its other services now work.1 Some early reports said trading was halted, but Binance's updates do not mention a trading halt. Binance.US and Coinbase say they were not affected.15

Binance says it will absorb the loss: "Binance will absorb the financial impact of these stolen funds, not our users."1 It is paying from its SAFU emergency fund, part of its futures insurance fund and its corporate treasury. By 31 October it said 90% of the stolen assets had been replenished, with the remaining 10% in less liquid tokens. A proof-of-reserves snapshot from 31 October shows at least full backing for its ten largest assets, and a full cryptographic proof is due on 3 November.6

Withdrawals are due to restart in phases from Sunday 1 November.6 Whether Binance's promise is enforceable is another question: one UK lawyer cautioned that customers "should not regard this as legally binding".16 We found no lawsuits filed as of 31 October.

Markets and politics

Bitcoin fell 4.1% on 30 October to $77,446, its lowest in six weeks, and BNB, Binance's own token, fell 6% after dropping nearly 10% during the day. About $1.57 billion in crypto futures positions were liquidated.1718

In Washington, the chair of the Commodity Futures Trading Commission, Michael Selig, said the hack "proves our exact point in proposing regulations for crypto markets earlier this month", and President Trump said the White House was "looking at" it.1920

How it compares

IncidentDateAmount at the timeAttributed to
BinanceOctober 2026~$6.3BNorth Korea (FBI)3
BybitFebruary 2025~$1.5BNorth Korea (FBI)21
Ronin bridgeMarch 2022~$620MNorth Korea's Lazarus Group (FBI)22
Poly NetworkAugust 2021~$610M, mostly returnedNot attributed23
FTXNovember 2022$477MUnresolved24
BitgetSeptember 2026$387MNorth Korea (Chainalysis)25
DMM BitcoinMay 2024~$305MTraderTraitor (FBI, Japan's National Police Agency)26
WazirXJuly 2024~$230MNorth Korea27

Measured in bitcoin rather than dollars, the 2014 collapse of Mt. Gox, with about 850,000 bitcoin missing, is still larger.

If you use Binance

  1. Ignore "refund" and "compensation" offers. Binance says customers don't need to claim anything and has announced no claims process.16 UK Finance has warned of "a wave of fraudsters contacting potential victims and asking for payment to help them get their money back".7
  2. Use only official channels: the Binance app, binance.com and its verified social accounts.
  3. Keep records of your balances, pending withdrawals and any losses you take while withdrawals are suspended, including liquidations.
  4. If you lost money because of the incident, add yourself to the case so people in the same position can find each other. Read how to get money back after a scam.

For the bigger picture, see crypto scams and hacks in 2025 and 2026.

Sources

  1. Security Incident Update #2, Binance, 30 October 2026; and Security Incident Update, Binance, 30 October 2026. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9

  2. North Korea steals USD 6.36 billion from Binance in the largest hack in history, TRM Labs, 30 October 2026. ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10

  3. FBI says North Korea was behind the $6.3 billion Binance crypto hack, NBC News and Reuters, 31 October 2026, on the FBI's statement. ↩ ↩2 ↩3

  4. The largest theft in history: North Korea behind the $6.4 billion Binance hack, Elliptic, 30 October 2026, updated 31 October. ↩ ↩2 ↩3 ↩4

  5. The Binance hack: tracing the North Korea link, Chainalysis, 30 October 2026. ↩ ↩2 ↩3

  6. Recovery Update #3: 90% of stolen assets replenished, Binance, 31 October 2026. ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  7. FBI says North Korea behind $6 billion Binance crypto theft, Newsweek, 31 October 2026. ↩ ↩2

  8. How one Ethereum permission let an attacker drain $2.5 billion from Binance, CoinDesk, 30 October 2026. ↩ ↩2 ↩3 ↩4

  9. Binance uncovers wider breach in $6.3 billion exploit, CoinDesk, 30 October 2026. ↩

  10. Binance's $6.3 billion hack: what we know and what happens next, CNBC, 30 October 2026. ↩ ↩2

  11. FBI confirms North Korea's role in $6 billion Binance hack, CoinDesk, 31 October 2026. ↩

  12. North Korea has stolen USD 12.8 billion in crypto, USD 7.4 billion of it in 2026, TRM Labs, 30 October 2026. ↩

  13. Binance hacker splits $1.4 billion of bitcoin into 19 wallets, CoinDesk, 30 October 2026. ↩

  14. Experts divided over Binance hack asset freezes, CoinDesk, 30 October 2026. ↩

  15. FBI says North Korea responsible for Binance breach, ABC News, 31 October 2026. ↩

  16. Binance's $6.3 billion hack: the legal fallout, LawFuel, 30 October 2026. ↩

  17. Bitcoin tumbles as Binance hack rattles crypto markets, CNBC, 30 October 2026. ↩

  18. Crypto liquidations jump to $1.57 billion as Binance hack sends bitcoin, ether lower, CoinDesk, 30 October 2026. ↩

  19. $6.3 billion Binance hack is the largest crypto theft on record, CNBC, 29 October 2026, updated 30 October. ↩

  20. Binance $6.3B record hack sparks pre-election political clashes, Cointelegraph, 31 October 2026. ↩

  21. North Korea responsible for $1.5 billion Bybit hack, FBI public service announcement, 26 February 2025. ↩

  22. FBI says North Korea behind biggest crypto theft in history, Gizmodo, 15 April 2022. ↩

  23. Poly Network hacker returns remaining cryptocurrency, CNBC, 23 August 2021. ↩

  24. The $477 million FTX hack: following the blockchain trail, Elliptic, 10 October 2023. ↩

  25. The $387 million North Korea stole from Bitget, Chainalysis, 1 October 2026. ↩

  26. Attribution of the DMM Bitcoin theft, Japan National Police Agency, 24 December 2024. ↩

  27. WazirX crypto platform confirms $230 million heist, The Record, 18 July 2024. ↩