Hackers have stolen roughly $6.3 billion in cryptocurrency from Binance, marking the most important crypto theft on document and elevating recent issues concerning the safety of centralized exchanges. Blockchain analytics companies have linked the assault to North Korea, whereas Binance has pledged to cowl the losses and is working with trade companions to get well the stolen belongings.
The breach occurred on October 29, 2026, when attackers transferred funds from Binance-controlled wallets throughout 10 blockchain networks to addresses beneath their management. In keeping with TRM Labs, a lot of the theft unfolded inside roughly 20 minutes.
The incident triggered a broad sell-off throughout cryptocurrency markets. Bitcoin fell to a six-week low, whereas Ethereum and Binance’s BNB token additionally declined. Binance briefly suspended withdrawals throughout a number of networks because it investigated the breach.
Co-CEO Richard Teng sought to reassure prospects, saying consumer funds have been secure and the alternate would cowl each loss.
North Korea-linked hackers suspected
Blockchain analytics companies TRM Labs and Chainalysis expressed excessive confidence that North Korea was accountable, figuring out its state-linked hacking group TraderTraitor because the probably perpetrator.
TRM mentioned the operation shared similarities with earlier assaults attributed to North Korean hackers, significantly the $1.5 billion Bybit hack in February 2025, which the US Federal Bureau of Investigation linked to Pyongyang.
In keeping with the agency’s evaluation, the attackers started making ready at the least 36 hours earlier than the Binance breach. Their exercise included small withdrawals from Twister Money, a cryptocurrency mixing service, and a number of other exams of malicious code earlier than the primary operation.
North Korea has repeatedly been accused by worldwide authorities of utilizing cyberattacks to generate income for the state. Nevertheless, Pyongyang has constantly denied involvement in such actions.
Binance has not independently confirmed the id of the attackers, saying its investigation stays ongoing.
North Korea Steals USD 6.36 Billion From Binance (Supply: TRM Labs)
How the attackers breached Binance
An preliminary investigation instructed the assault could have began with a compromised laptop computer belonging to a Binance engineer, probably giving hackers entry to inner methods used to authorize transactions.
TRM’s findings level to a broader compromise involving Binance’s sizzling pockets signing infrastructure.
Sizzling wallets are internet-connected cryptocurrency wallets that exchanges use to course of transactions and withdrawals. Their accessibility makes them handy for buying and selling operations but in addition exposes them to cybersecurity dangers.
On Ethereum, the attackers reportedly exploited EIP-7702, a function that enables a pockets to delegate transaction execution to sensible contract code by a signed authorization.
The hackers ready 50 authorizations prematurely, rising the possibilities that one would stay legitimate when submitted. As soon as activated, the compromised Binance pockets might execute a contract managed by the attackers, permitting them to empty its belongings.
The operation moved roughly 167,464 ETH and dozens of different tokens from the affected pockets. Further funds arriving later have been additionally swept into attacker-controlled addresses.
The breach prolonged throughout Bitcoin, Tron, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon.
TRM mentioned the simultaneous motion of funds throughout a number of networks instructed that the attackers could have gained entry to Binance’s transaction-signing infrastructure. The alternate has but to publish a definitive clarification of the incident’s root trigger.
Round $2.7 billion in belongings frozen
A fast response from cryptocurrency corporations and blockchain networks helped forestall a considerable portion of the stolen belongings from transferring past restoration efforts.
In keeping with TRM, roughly $2.7 billion in belongings was frozen following coordinated motion by stablecoin issuers and blockchain operators.
Tether accounted for the most important share, freezing roughly $1.77 billion in USDT. Circle blocked round $825 million in USDC, whereas Ripple froze roughly $40.5 million in RLUSD. World Liberty Monetary additionally froze round $27.8 million in its USD1 stablecoin.
Arbitrum’s Safety Council individually intervened to take away roughly $30 million in ETH and ARB tokens from the attacker’s attain.
Nevertheless, the hackers moved shortly to transform some stablecoins into belongings that can’t be straight frozen by centralized issuers. TRM recognized giant transactions involving decentralized exchanges, market makers and lending protocols, together with Aave.
Following these actions and restoration efforts, the attackers have been estimated to retain greater than 420,000 ETH and 18,270 BTC, value roughly $2.4 billion.
An summary of the October 29, 2026 Binance hack in TRM
Crypto markets react to record-breaking theft
The breach added strain to an already fragile cryptocurrency market as traders reassessed the dangers of holding digital belongings on centralized exchanges.
Bitcoin dropped to $76,368, its lowest stage in six weeks, whereas Ethereum fell greater than 3% to roughly $2,178. Binance’s BNB token declined round 5% over 24 hours to $709.70, in accordance with CoinGecko.
Shares of publicly traded cryptocurrency corporations additionally weakened. Coinbase World fell 4.8%, whereas Technique, a serious company Bitcoin holder, declined practically 6% in prolonged US buying and selling.
Market analysts warned that the incident might additional undermine confidence in centralized platforms, significantly as institutional traders proceed rising their publicity to digital belongings.
Tim Solar, senior researcher at Hong Kong-based HashKey Group, mentioned the breach might dampen investor danger urge for food and immediate market individuals to reassess the protection of belongings held on centralized exchanges.
The timing is difficult for the trade, which has already confronted strain from elevated US rates of interest and softer demand for cryptocurrency funding merchandise.
Bitcoin (BTC) Worth Efficiency on Oct 31, 2026 (Supply: CoinGecko)
Binance faces renewed safety scrutiny
Binance has roughly 335 million registered customers globally and held round $162.8 billion in belongings beneath custody, in accordance with its 2025 annual report.
The alternate additionally maintains its Safe Asset Fund for Customers (SAFU), a reserve designed to guard prospects in opposition to losses arising from safety incidents. The fund holds roughly $1 billion in Bitcoin.
Nevertheless, the dimensions of the newest theft considerably exceeds the fund’s worth, inserting larger consideration on Binance’s monetary sources and its dedication to compensating affected customers.
Teng mentioned the corporate would use its personal funds alongside present safety mechanisms to cowl the losses.
The incident additionally highlights the rising safety challenges going through the cryptocurrency trade. TRM estimated that roughly $2.9 billion in digital belongings was stolen throughout practically 150 assaults throughout 2025.
Though the freezing of billions of {dollars} demonstrates the significance of cooperation between exchanges, stablecoin issuers and blockchain networks, the remaining stolen belongings current a big problem for investigators.
Because the investigation continues, the Binance breach is more likely to intensify scrutiny of alternate safety requirements, pockets administration and transaction authorization methods. It additionally raises broader questions on whether or not present safeguards can adequately defend the rising quantity of digital belongings held by centralized platforms.
