Binance was hacked on Oct. 29, 2026 for about $6.3B, the largest crypto theft on record. What happened, what Binance said, and what users should do now.
On Thursday, Oct. 29, 2026, Binance, the world's largest crypto exchange, suffered the largest crypto theft on record. According to blockchain analytics firm TRM Labs, funds began leaving Binance hot wallets at 20:05 UTC, and most of the theft was over within about 20 minutes. A second wave followed around 23:05 UTC.
The first public signs came from users and on-chain watchers who saw funds draining from Binance wallets. Binance told TechCrunch it was "aware of reports of a potential security issue" and had "temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure." Deposits and withdrawals were then suspended across the platform while the exchange investigated.
On Saturday, Oct. 31, the FBI attributed the attack to North Korean hackers, tying it to the group known as TraderTraitor, the same unit behind the $1.5 billion Bybit hack in February 2025, the Associated Press reported. TRM Labs and Chainalysis had already attributed the attack to TraderTraitor, TRM with "high confidence".
Binance estimates the total impact at about $6.3 billion. Independent estimates are close but not identical: TRM Labs puts it at about $6.36 billion (valued at the time of each transfer), and Chainalysis at about $6.4 billion, CNBC reported.
TRM's chain-by-chain breakdown:
Because a large share was in stablecoins, issuers could act quickly. Binance said about $3 billion was frozen on-chain. TRM counted about $2.7 billion frozen as of 00:30 UTC on Oct. 30, mostly by Tether (about 1.77 billion USDT) and Circle (about 825 million USDC), with smaller freezes by Ripple, World Liberty Financial and the Arbitrum Security Council. Bitcoin and ether have no issuer that can freeze them, so those assets remained with the attacker. Frozen does not mean recovered: as TRM's Ari Redbord told CNBC, getting frozen funds back requires a separate legal process.
Binance has not yet published a root cause, and the details below may change once it does.
In its first update, Binance said a compromised DevOps engineer's laptop may have given the attacker access to a service container used to submit withdrawals, and that it had "found no evidence of any wallet private key leak," Decrypt reported. A day later, Binance said "our subsequent investigation has uncovered additional points of breach." Co-CEO Richard Teng added that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action."
On Ethereum, investigators say the attacker used EIP-7702, a feature from Ethereum's Pectra upgrade that lets an ordinary wallet temporarily run smart contract code. According to Hypernative, the attacker obtained a valid authorization that delegated one of Binance's main hot wallets, labeled Binance 14, to an attacker-controlled sweeper contract at 20:20 UTC, then drained about 167,464 ETH and 63 tokens in a single call. Binance revoked the delegation at 00:10 UTC on Oct. 30. On the other nine chains, funds left through ordinary signed transfers, which TRM says points to a compromise of Binance's hot wallet signing infrastructure rather than a bug in any smart contract.
TRM also found that preparation started at least 36 hours earlier: the attacker's operator wallet was funded through Tornado Cash on Oct. 28, and the sweeper code was tested and rehearsed on other wallets before it was used against Binance.
Binance's message has been consistent on one point: customers will not bear the loss.
"Bottom line - your money is safe, and we're covering every loss." — Richard Teng, Binance co-CEO, on X
Binance said it would cover losses from its SAFU emergency fund and company funds, and on Oct. 30 said it had readied $6.34 billion for the purpose. Teng said on Oct. 31 that 90% of the stolen assets had been replenished. By Nov. 1, Binance said it had covered around 95%, with the remaining 5% in less liquid tokens that take longer to source, according to CNBC.
Teng also said Binance's investigation "has not attributed responsibility to any individual" and promised "a detailed technical post-mortem once the investigation is complete and every fact is verified."
Trade without handing over custody
Binance began restoring withdrawals in phases at 06:00 UTC on Sunday, Nov. 1. By 12:36 UTC, the first phase of 15 networks and assets was live, and testing continued for the rest. The Block reported that Cardano, Chainlink, Hyperliquid, Litecoin and NEAR were among the networks still being tested at the time.
In the first nine and a half hours, Binance said it processed $4.65 billion in withdrawals and $1.01 billion in deposits, a net outflow of about $3.64 billion, or 2.1% of the $171 billion in assets shown in its Oct. 28 proof of reserves. Binance said withdrawal volumes were "stabilising as expected" after an initial spike. Third-party figures differ: DefiLlama's dashboard showed higher net outflows, a reading Binance disputed.
Binance has said it will publish an updated, zero-knowledge proof of reserves based on an Oct. 31 snapshot. As of this writing, that report has not been released, and it is the main open item for anyone judging the exchange's balance sheet after the hack.
On the evidence so far, Binance appears able to absorb the loss. Fundstrat's Sean Farrell told CNBC the attack did not appear to create meaningful solvency risk, and the reported net outflow on reopening was about 2% of assets. Users have not been asked to share in the loss.
The open questions are about security, not solvency. The root cause is unpublished, the initial explanation has already been revised, and roughly $2.4 billion in ETH and BTC remained in attacker wallets as of TRM's Oct. 30 count. Whether Binance is "safe" depends on what the post-mortem shows and whether the fixes hold.
This hack was not a failure of crypto itself, and nobody should celebrate it. A state-backed team spent days preparing an attack on one of the best-resourced security operations in the industry, and Binance's response has so far protected its users. That is worth acknowledging.
It does show a structural fact, though. When you keep assets on a centralized exchange, you hold a claim on the exchange, not the coins. Your safety depends on the exchange's hot wallets, signing systems, staff devices and balance sheet. This time the balance sheet was big enough to cover $6.3 billion. In 2025, Bybit covered a $1.5 billion loss. Both times, customers could not move their funds while the exchange dealt with the incident.
Self-custody removes that layer. With a non-custodial wallet, no exchange hot wallet holds your funds, and there is no shared pool that one attack can empty. It is not risk-free. You become responsible for your own keys and devices, the same phishing tactics that target exchange staff target individuals too, and on-chain venues carry their own smart contract and bridge risks. But no exchange can pause your withdrawals, and a breach of an exchange's signing systems does not reach keys only you hold.
Dexly is a non-custodial trading app built on Hyperliquid. You trade perps and spot from a wallet you control, and Dexly never holds your funds. Try it at dexly.trade.
Risk Warning: Trading perpetual futures involves significant risk of loss. Only trade with capital you can afford to lose. Dexly is a non-custodial interface; you are responsible for your own funds and trading decisions.
Trade without handing over custody