Binance, the world's largest crypto exchange, confirmed it was hacked for about $6.3 billion on Oct. 29, 2026, US time, or the morning of Oct. 30 in Thailand. It is the largest crypto theft on record. Binance says about $3 billion, or roughly half, has been frozen, but that figure needs a closer look. Nearly all of the frozen funds are tokens controlled by their issuers, while much of the rest is bitcoin and ether that no one can freeze.
What Happened in the $6.3 Billion Binance Hack
The attacker withdrew funds from Binance hot wallets on 10 blockchains, with most transfers completed within about 20 minutes. Estimates vary. Binance puts the impact at about $6.3 billion, TRM Labs at about $6.36 billion and Chainalysis at roughly $5.9 billion at the time of the theft. Arkham data showed the attacker's wallets at one point holding about $1.5 billion in bitcoin, about $900 million in ether, about $1.5 billion in USDT and more than $800 million in USDC. The loss equals roughly 4% of the assets on Binance's platform and is about four times Bybit's previous record of $1.5 billion, stolen in February 2025.
How the Attacker Got In: A Binance Engineer's Laptop
Binance's preliminary investigation points to a compromised laptop belonging to a DevOps engineer, which may have given the attacker access to internal systems and allowed unauthorized withdrawals. Binance says it has found no evidence that wallet private keys leaked. On Ethereum, the attacker used pre-signed EIP-7702 authorizations to let a malicious smart contract take control of a hot wallet and drain incoming funds. CEO Richard Teng said the breach was not a one-click attack and went beyond one engineer's permissions, while TRM Labs suggests a broader compromise of Binance's signing infrastructure, which Binance has not confirmed.
North Korea Linked to the Binance Hack
TRM Labs and Chainalysis attribute the theft to TraderTraitor, a North Korean hacking group tied to the Lazarus Group and linked to the Bybit theft. TRM says it made the assessment with high confidence, and on-chain investigator ZachXBT and security firm Blockaid reached similar conclusions. After the theft, the attacker swapped stablecoins for bitcoin and ether on Uniswap and used stolen USDT as collateral to borrow at least 20,000 WETH from Aave, prompting Aave to pause some markets to avoid bad debt.
About $3 Billion Frozen: Why Bitcoin and Ether Could Not Be
Most of the frozen funds are stablecoins controlled by their issuers. Tether froze more than $1.57 billion in USDT and Circle froze about $800 million in USDC. Ripple and World Liberty Financial also froze their tokens, and the Arbitrum Security Council froze about $30.5 million. Binance's verified frozen total rose from about $2.54 billion to about $3 billion within roughly 90 minutes. Bitcoin and ether, however, have no issuer that can freeze them on-chain. Investigators can only trace the funds and ask cooperating exchanges to freeze them when they arrive. That is why the attacker rushed to convert stablecoins into bitcoin and ether, and why several outlets estimate the attacker still holds about $1.5 billion to $3 billion.
Frozen Is Not Recovered, and SAFU May Fall Short
Freezing funds does not return them. TRM's Ari Redbord said recovery requires a legal process, such as court orders and issuer cooperation, which can take weeks. Binance has pledged to cover all user losses with its SAFU fund, reported at about $1 billion in bitcoin, plus company funds. If $1.5 billion to $3 billion remains unrecovered, SAFU alone would not be enough and Binance would need to use its own money. Withdrawals have been suspended since 22:15 UTC on Oct. 29 with no reopening date, and Binance has promised a technical post-mortem and updated proof of reserves.
What Investors Should Watch: Crypto Still Has Middlemen
Markets reacted immediately. Bitcoin fell about 5% to below $77,000, ether dropped about 5.7% and BNB fell about 8%. Binance.US and Coinbase said they were not affected. The key lesson is that much of the crypto people use still runs through several layers of middlemen. The first is exchanges like Binance, which hold coins for users and can halt withdrawals and decide whether to compensate them. The second is stablecoin issuers like Tether and Circle, which can freeze tokens instantly. That sharply reduced the damage this time, but it also means those tokens can always be controlled by a company. Bitcoin and ether have no such middleman, so once they are stolen they are very hard to get back. Next, watch for Binance's confirmed net loss, the date withdrawals reopen and its updated proof of reserves.
