Binance loses about $6.3B: what happened, where the money went, and how it compares with past hacks
On October 29, Binance hot wallets were drained across multiple chains within about four hours. Binance estimates the total impact at about $6.3 billion, the largest crypto theft on record. This article sticks to what has a source, and marks what is still unconfirmed.
What happened
- When: From 20:05 UTC on October 29, 2026, Binance hot wallets on several chains sent assets to attacker addresses. The Ethereum hot wallet was swept again several times over the following hours. (TRM Labs)
- Chains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon, 10 in total. The three largest: Ethereum about $3.79B (including about 200,000 ETH, 1.875B USDT and 823M USDC), Bitcoin 18,270 BTC (about $1.47B), and Tron about $628M. (TRM Labs)
- Total: Binance estimates the total impact at about $6.3B. Chainalysis put the value at the time of theft at about $5.9B; TRM Labs puts it at about $6.36B at transfer-time prices. The figures use different methods; Binance's formal report will be the reference.
- Market reaction: BTC fell 4.8%, briefly below $77,000; ETH fell 5.7%; BNB fell 8%. (CoinDesk, at time of publication)
How it happened (preliminary)
Binance's initial finding is that a DevOps engineer's laptop may have been compromised, letting the attacker reach a service container and submit unauthorized withdrawal transactions. Binance says it has "found no evidence of any wallet private key leak."
TRM Labs' onchain analysis adds two points. On Ethereum, the attacker used EIP-7702 (live since Ethereum's May 2025 upgrade) to make a Binance hot wallet run a contract only the attacker controlled. On the other chains, the transfers were normally signed. TRM concludes the attacker most likely gained the ability to make Binance's hot wallet signing system sign for them.
This resembles the 2025 Bybit hack: in neither case was a private key stolen; a step in the signing process was taken over. Binance says a full technical report will follow once the investigation is complete.
Where the money went
Frozen: about half
- Tether froze more than $1.57B in USDT (Tether CEO Paolo Ardoino).
- Circle froze more than $800M in USDC (Circle CEO Jeremy Allaire).
- Ripple froze part of the RLUSD, World Liberty Financial froze part of the USD1, and the Arbitrum Security Council forcibly moved about $30M in ETH and ARB out of an attacker wallet. (TRM Labs)
- In a late October 29 update, Binance said about $3B had been frozen, including $2.3B in USDT and USDC.
Not frozen: being moved
As of 00:30 UTC on October 30, the attacker still held about $2.4B, including more than 420,000 ETH and 18,270 BTC. TRM Labs observed about 325M USDT swapped into about 122,300 ETH via UniswapX and similar routes; USDT supplied to Aave to borrow ETH (Aave then froze the affected markets); and the BTC being split into 1,000 and 100 BTC pieces and moved out in batches.
Historically, once stolen funds are converted into ETH or BTC and enter mixers or bridges, little is recovered. About half could be frozen this time because a large share of the stolen assets were stablecoins that their issuers can freeze.
Who did it
TRM Labs and Chainalysis both say they have "high confidence" North Korean hackers are responsible; TRM names TraderTraitor, the group the FBI publicly blamed for the 2025 Bybit hack. As of publication, Binance itself has not named an attacker, and no government agency has made a formal attribution for this incident.
What it means for Binance users
- Binance's position: "User funds are safe," and losses will be fully covered by the SAFU fund and company funds.
- Scale: According to DefiLlama, Binance held about $144B in assets before the hack, so the impact is about 4%. The SAFU fund holds about $1B (in BTC); the rest would come from company funds.
- Withdrawals: Paused. Binance co-CEO Yi He said at 04:17 UTC on October 30 that withdrawals are expected to start resuming within 48 hours. Deposits are unaffected.
- Not yet published: the final loss figure, the technical report and an updated proof of reserves.
What holders can do now
- Beware of "compensation" or "urgent asset migration" links and DMs. Phishing that impersonates the exchange tends to peak after a major hack. Rely only on announcements in the Binance app and on its official website.
- When withdrawals resume, check the proof of reserves. Binance has promised an update after remediation.
- Think about which assets need to sit on an exchange. However secure an exchange wallet is, someone else holds it. For assets you don't trade, it is worth reconsidering whether they belong in a wallet you control.
Major past hacks and how they ended
| Year | Incident | Stolen (value then) | How | Outcome | Final user loss |
|---|---|---|---|---|---|
| 2026 | Binance | ~$6.3B (Binance estimate) | Preliminary: engineer laptop compromised → unauthorized withdrawals | ~$3B frozen; Binance says it will cover all losses | Ongoing |
| 2025 | Bybit | ~$1.5B | Malicious code injected into the Safe front end used for its multisig wallet | FBI attributed it to North Korea's TraderTraitor; Bybit covered the gap with loans and large deposits, without halting withdrawals | None |
| 2022 | Ronin (Axie Infinity) | ~$625M | Bridge validator keys stolen | FBI attributed it to North Korea's Lazarus; Sky Mavis raised funds and reimbursed users | None |
| 2021 | Poly Network | ~$610M | Cross-chain contract bug | The attacker returned almost everything within days | None |
| 2018 | Coincheck | ~$530M (NEM) | Hot wallet theft | About 260,000 holders compensated in yen; Japan's FSA ordered business improvements; acquired by Monex the same year | Compensated at the price then |
| 2022 | FTX | ~$477M | Drained on the day of the bankruptcy filing; US charged 3 people in 2024 over an alleged SIM-swap intrusion | Handled in the bankruptcy | Part of the bankruptcy |
| 2014 | Mt. Gox | ~$450M (~850,000 BTC) | Long-running theft that went unnoticed | Exchange went bankrupt; repayments only began in 2024, and the deadline is now October 2027 | Partial, after 10+ years |
| 2022 | Wormhole | ~$320M | Bridge contract bug | Jump Crypto replaced the 120,000 ETH | None |
| 2016 | Bitfinex | ~$72M (~120,000 BTC) | Hot wallet theft | All users first took a 36% haircut, repaid with BFX tokens; in 2022 the US DOJ seized about 94,000 BTC | Haircut, later repaid |
| 2016 | The DAO | ~$60M (~3.6M ETH) | Smart contract bug | Ethereum hard-forked to return the funds; those who disagreed stayed on the original chain, now ETC | None (via hard fork) |
| 2019 | Binance | ~$40M (7,000 BTC) | API keys and 2FA codes stolen | Fully covered by the SAFU fund; withdrawals paused about a week | None |
Patterns in this table
- Whether users lose depends on whether the exchange can pay. Binance in 2019, Coincheck and Bybit covered losses themselves. Mt. Gox could not, and users waited more than ten years. FTX was already collapsing when it was drained.
- Stolen funds are rarely recovered. The exceptions: an attacker giving funds back (Poly Network), or law enforcement seizing them years later (Bitfinex). About half could be frozen this time because stablecoins can be frozen by their issuers.
- Attacks increasingly target the signing process, not contract bugs. Ronin, Bybit and this Binance hack all took over a step in signing.
Read this article with care
- Information is still changing. The amount, cause and attacker are preliminary. Binance's formal report and law enforcement findings will be the reference. This article will be updated as news comes in, with every change logged below.
- Historical figures use the USD value at the time of theft, and sources differ slightly.
- This is not financial advice.
Sources
- Binance preliminary findings: Binance on X; summary: Bitcoin.com
- Onchain details, freezes, attribution: TRM Labs
- Amounts, market reaction, Tether and Circle freezes, SAFU: CoinDesk
- Withdrawal timing: FinanceFeeds
- Bybit: FBI PSA; FTX: CNBC, Elliptic; Mt. Gox: Crypto Briefing
Update log: 2026-10-30 first published.