Binance hacked: about $6.3 billion stolen, withdrawals paused

On the evening of 29 October 2026 an attacker moved funds out of Binance hot wallets on ten blockchains. The first transfer left at 20:05 UTC, and most of the money was gone within about twenty minutes. Binance puts the damage at about $6.3 billion; the analytics firm TRM Labs counts $6.36 billion. It is the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in February 2025.

What is known

• How. Binance says its initial investigation points to a compromised laptop belonging to a DevOps engineer. Through it the attacker reached a service container and submitted withdrawal transactions. Binance says it has found no evidence that wallet private keys leaked.
• Who. TRM Labs and Chainalysis attribute the theft to TraderTraitor, a North Korean state hacking unit. TRM says the pattern matches the Bybit theft.
• Frozen. Binance says about $3 billion has been frozen on-chain with the help of partners. Most of it is stablecoins: by TRM's count, Tether froze about $1.77 billion in USDT and Circle about $825 million in USDC.
• Not frozen. More than 420,000 ETH and 18,270 BTC, about $2.4 billion, are still with the attacker, who is moving them through decentralised exchanges and lending protocols.
• Accounts. Binance says users will not bear the loss: it will pay from its SAFU reserve fund and its own money. Deposits and withdrawals were suspended. On 30 October co-founder Yi He said deposits were working again and withdrawals should return within 48 hours.

Be careful in the coming weeks

• Fake refunds and fake support. Every large hack brings a wave of phishing: "claim your compensation" pages, "verify your account" emails, support agents who message you first on Telegram or X. Binance says it is covering the losses itself. Anyone who asks for your seed phrase, a "verification fee" or a wallet connection in order to return your money is not Binance. Follow the news only in the app or on binance.com typed in by hand.
• Coins tied to the theft. The stolen ETH and BTC will keep moving for weeks through swaps, bridges and private sales. Exchanges and swap services check incoming deposits against the addresses from this theft, and a deposit that traces back to them can be frozen even if you got the coins in good faith. Be wary of strangers offering ETH or BTC below the market price. In our catalogue, the line "May freeze funds" on a card marks a service whose internal checks can hold your money without a court order.
• Stablecoins can be frozen. Tether and Circle froze more than $2.5 billion within hours. They can freeze any USDT or USDC address the same way, including yours if it ever turns up in an investigation.
• An exchange balance is a promise. Binance can cover $6 billion. A small custodial service, and many no-KYC exchangers are custodial, has no such reserve. Keep on any custodial platform only what you are trading right now, and move the rest to a wallet whose keys you hold.

In the catalogue

Binance is not listed: it requires identity verification. Wallets that keep the keys with you are in the wallet category; a card marks them with the line "Non-custodial".

Sources: Binance on X · TRM Labs, 30 October 2026 · Binance and Yi He statements, Fox Business · Yi He on withdrawals, U.Today