On October 29, 2026, Binance, the world’s biggest cryptocurrency exchange, suffered what appears to be the largest crypto theft ever recorded. An attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in roughly 20 minutes starting at 20:05 UTC. That is about four times the size of the $1.5 billion Bybit hack of February 2025.
What happened
The stolen funds came from wallets on Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. Binance confirmed a security incident and suspended withdrawals on multiple networks. The suspension came just hours after a separate, apparently unrelated breach hit the prediction market Polymarket.
Binance’s explanation of the cause has shifted as its investigation continued. The company first suggested the breach might have involved a compromised DevOps engineer’s laptop. It later said the investigation had found additional “points of breach,” and co-CEO Yi He’s counterpart Teng confirmed that Binance’s own hot wallet was affected.
Who is behind it
Both TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean state-backed hacking group with a history of crypto thefts. TRM pointed to several features that match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack of April 2026. These include small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and pre-obtained signatures executed in one burst. TRM’s analysis points to a compromise of the exchange’s hot wallet signing infrastructure.
The chase for the money
Investigators are now racing to trace and freeze the funds. Binance says it worked with blockchain partners to freeze roughly $3 billion in affected assets. Stablecoin issuers Circle (USDC) and Tether (USDT) also moved to freeze funds.
Recovery is difficult, though. Chainalysis researchers said they saw laundering patterns they had not seen before, and that thousands of transactions in a short period suggest the attackers are using automation to obscure the trail. TRM’s Ari Redbord described the effort as a race against time.
Will users lose money?
Binance has pledged to make customers whole. The company says it has reserved more than $6.34 billion of its own funds to cover the stolen assets and has begun recovering assets for users. It also says 90% of the losses are now covered, with withdrawals planned to resume Sunday.
The scale of the loss is a serious test for the exchange. The theft eclipses the $1 billion emergency fund Binance had set aside for such situations, although it is a small fraction of the exchange’s roughly $155 billion in user assets. Reopening withdrawals will test whether customers trust the exchange enough to leave their money there.
Market and industry fallout
Bitcoin and ether prices fell after Binance confirmed the hack. Coinbase and Robinhood were not affected by the breach, though their shares dropped on Friday.
The industry is also debating what should change. Chris Perkins of Franklin Templeton said the attack underscores the need for stronger cybersecurity standards and more coordination among governments. Others are skeptical that regulation alone would have prevented it. If the breach did start with a compromised engineer’s laptop, as Binance first indicated, then regulatory requirements likely would not have stopped it.
What to watch next
Three questions will shape the story in the coming days:
Withdrawals: whether Binance reopens them on schedule and whether users rush to pull funds out.
Root cause: what the “additional points of breach” turn out to be.
Recovery: how much of the stolen money can be frozen or traced before it is laundered.
