Binance suffered an estimated $6.3 billion security breach on October 29, 2026, in what blockchain investigators describe as the largest cryptocurrency theft on record. The exchange suspended withdrawals, pledged to cover losses and began working with industry partners to freeze stolen assets.
Blockchain intelligence company TRM Labs calculated that approximately $6.36 billion left Binance wallets across ten blockchains, with most of the transfers taking place within roughly 20 minutes. It attributed the attack to North Korea’s TraderTraitor hacking unit with high confidence.
Binance’s investigation remains ongoing. The company initially pointed to a compromised employee laptop but subsequently disclosed additional breach points. For customers, the immediate questions concern access to withdrawals, replacement of affected assets and whether the exchange has fully contained the intrusion.
How Much Was Stolen in the Binance Hack?
TRM’s estimate puts the incident at more than four times the approximately $1.5 billion stolen from Bybit in February 2025, previously the largest recorded crypto theft.
Ethereum accounted for approximately $3.79 billion of the Binance outflows. Another $1.47 billion left in Bitcoin, while roughly $628 million was taken on Tron. Other affected networks included XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. These are network-level totals: the Ethereum figure includes multiple tokens, not just ETH.
Binance’s estimate of approximately $6.3 billion and TRM’s more precise calculation describe the same broad incident. Dollar totals can differ because investigators use different price snapshots, identify additional transfers or adjust which assets they include.
The scale of the theft should also be distinguished from the eventual financial loss. Some assets have been frozen, and further recovery may be possible. However, freezing stolen tokens does not automatically return them to Binance or settle customer obligations.
Investigators Link the Attack to North Korea
TRM attributed the operation to TraderTraitor using blockchain evidence and intelligence gathered outside the blockchain. Its assessment is stronger than an unsubstantiated social-media rumor, although it remains an attribution by a private intelligence company.
Chainalysis chief executive Jonathan Levin also identified TraderTraitor as the likely perpetrator. According to reporting on his assessment, investigators observed funds connected to September’s Bitget hack being mixed with assets stolen from Binance. Blockchain investigator ZachXBT separately pointed to the Lazarus Group as the likely attacker.
These assessments place the incident within the wider pattern of suspected North Korean cryptocurrency thefts. They do not mean Binance itself has conclusively identified the perpetrators.
At the time of the cited reporting, Binance had not publicly confirmed responsibility by North Korea. The exchange said it was cooperating with law enforcement and industry specialists.
For readers following the investigation, attribution and technical cause are separate questions. Identifying a suspected group does not establish precisely how every compromised system was accessed or which security controls failed.
Binance Finds More Breach Points Beyond an Employee Laptop
Binance initially suggested that an attacker compromised a DevOps engineer’s laptop, accessed an internal service container and submitted unauthorized withdrawal transactions. Its preliminary statement said it had found no evidence that wallet private keys were leaked. coindesk.com
The company later broadened that explanation:
‘Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.’
That update means the laptop theory should not be presented as a complete, final explanation. Binance has yet to establish the full incident publicly.
TRM’s technical analysis points to a possible compromise of the exchange’s hot-wallet signing infrastructure. On Ethereum, investigators identified an authorization mechanism that allowed attacker-controlled code to direct wallet activity. On other networks, funds moved through ordinary signed transactions.
The distinction is significant: unauthorized transfers can occur if an attacker manipulates the systems approving transactions, even without publicly exposing a private key. The investigation must therefore examine both access to internal services and the controls governing transaction approval.
Around $3 Billion Frozen as Binance Promises to Cover Losses
Binance said approximately $3 billion in affected assets had been frozen through cooperation with partners. Independent estimates published at earlier checkpoints were closer to $2.7 billion, reflecting differences in timing and accounting.
The initial figures supplied for Tether and Circle were approximately $971 million in USDT and $823 million in USDC. Those should be treated as early snapshots: subsequent reporting put Tether’s frozen total substantially higher.
Stablecoin issuers can restrict transfers involving their tokens. Native Bitcoin and Ether do not have an equivalent issuer-operated freeze mechanism. That makes recovery more complicated, although it does not mean tracing or eventual seizure is impossible.
Binance has pledged to cover losses using company resources and its Secure Asset Fund for Users, known as SAFU. Founder Changpeng Zhao also expressed his expectation that users would be fully covered, while emphasizing that he no longer manages the exchange.
According to the October 30 statement supplied for this article, Binance reserved more than $6.34 billion of company funds. It said $5 billion was already held in the specific token assets affected, with remaining purchases proceeding through market and over-the-counter channels.
That statement describes replacement funding, not the recovery of $6.34 billion from the attacker. Binance said limited token liquidity and settlement times could slow completion.
When Will Binance Withdrawals Resume?
In its October 30 investigation update, Binance said it remained on track to resume withdrawals within its stated 45-hour timeline. That estimate runs from the update, rather than from when a customer reads the announcement.
The exchange said deposits were unaffected in that update and that unauthorized outflows had stopped after withdrawals were paused. Reopening remained an expected timeline, not confirmation that withdrawals had already resumed.
Markets did fall after the news. Associated Press reported Bitcoin declining 3.2% to below $79,000 on Thursday evening. That snapshot does not establish a uniform 2–4% decline across cryptocurrencies or prove the incident had little market impact.
The next meaningful milestones are confirmed withdrawal access, completion of replacement-asset purchases and a detailed explanation of the breach. Binance’s reimbursement commitment addresses the financial shortfall; restoring customer confidence will also require evidence that the systems behind the unauthorized transactions have been secured.