$6.3 Billion Binance Hack: How North Korea Pulled Off the Biggest Theft in Crypto History

• On the evening of October 29, 2026, about $6.36 billion left Binance hot wallets across 10 blockchains in roughly 20 minutes. That is four times larger than the previous record — the Bybit hack for $1.5 billion in 2025.
• The attack is attributed with high confidence to the North Korean group TraderTraitor. According to the exchange, the entry point was a compromised DevOps engineer’s laptop, along with several other vulnerabilities.
• Around $2.7–3 billion was frozen in time by Tether, Circle, Ripple, and others. The hackers still retain about $2.4 billion in ETH and BTC, which cannot be frozen.
• Binance has pledged to cover 100% of the losses from its own funds. As of October 31, 90% has been replenished, the top 10 assets are fully backed, and withdrawals are resuming in stages starting November 1.
• For the industry, this is a turning point: a blow to trust in centralized exchanges, a new wave of regulation, a debate over the right of stablecoin issuers to freeze funds, and a reassessment of hot wallet security.

In February 2025, the Bybit hack worth $1.5 billion was called the “heist of the century.” That record stood for just over a year and a half. On the evening of October 29, 2026, when it was approaching 11 p.m. in Kyiv, $6.36 billion vanished from the wallets of Binance — the world’s largest crypto exchange — in twenty minutes.

The Binance hack became the largest theft in cryptocurrency history. In scale, it is comparable to what North Korean hackers, according to CertiK estimates, stole from the entire industry over the previous ten years.

Below is everything known as of the evening of October 31: how the attack unfolded, who is behind it, what happened to users’ funds, and why the crypto industry will be dealing with the consequences of this hack for a long time.

The Binance Hack: A Timeline of 20 Minutes That Shook the Market

The Binance hack is striking above all for its speed and preparation. According to TRM Labs, the main share of the funds was drained between 22:05 and ~22:25 Kyiv time, but the operation had been prepared for at least 36 hours.

Time (Kyiv)	What happened
Oct. 28, morning	The hackers’ operator wallet receives three small transfers from the Tornado Cash mixer — this is how the attack is funded without leaving traces
Oct. 29, daytime	The malicious contract is tested on two wallets, then a “dress rehearsal” is carried out on a third
22:05–22:09	First strike: five Binance wallets on XRP Ledger send the hacker 233.46 million XRP
~22:10	Wallets on Solana and Optimism are drained
22:20	The hot BTC wallet sends 18,270 BTC. At the same time, EIP-7702 delegation is activated on Ethereum
~22:22	612.7 million USDT leaves the Tron wallet
~22:23	A single transaction drains 167,464 ETH and 1.615 billion USDT from the main ETH wallet
23:01–23:04	Tether and Circle freeze the first ~$1.8 billion in stablecoins
23:15	Binance co-founder Changpeng Zhao (CZ) writes on X: “It looks like this really is a Binance hack”
23:24	The exchange’s first official statement
~00:15, Oct. 30	Binance suspends withdrawals
~01:05	Second wave: wallets on Avalanche and Polygon are drained
02:08	The Arbitrum Security Council forcibly seizes ~$30 million from the hacker
06:30	Chainalysis links the attack to North Korea’s TraderTraitor
Oct. 30	Binance names the entry point and reserves $6.34 billion to cover losses
Oct. 31	90% of the stolen funds have been replenished, and a Proof of Reserves snapshot has been published
Nov. 1	Plan: phased launch of withdrawals
Nov. 3	Full zk-proof of reserves is expected

How much was stolen from Binance and in which coins

TRM Labs tracked every transfer from Binance wallets to the hacker’s addresses across ten networks. At prices at the time of the theft, the amount totaled ~$6.36 billion, while the exchange itself cites ~$6.3 billion.

Network	What was withdrawn	≈ Amount
Ethereum	200,630 ETH and nearly two hundred tokens, including 1.875 billion USDT, 823 million USDC, and 88.5 million RLUSD	$3.79 billion
Bitcoin	18,270 BTC	$1.47 billion
Tron	612.7 million USDT + 46.4 million TRX	$628 million
XRP Ledger	233.46 million XRP	$296 million
Solana	970,500 SOL	$96 million
Arbitrum, Optimism, Base	including 74.6 million ARB	$39 million
Avalanche	—	$28 million
Polygon	—	$10 million
Total		~$6.36 billion

Source: TRM Labs, data as of October 30, 00:30 UTC.

How Much Binance Is Actually Losing

The figure of $6.36 billion is how much was moved out, not how much was lost forever. About half has been frozen. If stablecoin issuers reissue the frozen tokens back to Binance, the net loss, according to Cointegrity analysts, will fall to $3.3–3.7 billion.

For comparison, Binance holds about $155 billion in client assets under management, according to CNN, and has more than 335 million registered users. The blow is enormous, but not fatal.

Who Hacked Binance: The North Korean TraderTraitor Connection

TRM Labs with high confidence attributes the attack to TraderTraitor — an elite North Korean hacking unit often linked to the Lazarus cluster. Chainalysis and independent investigator ZachXBT reached the same conclusions.

What the analysts base this on:

• The same signature as Bybit. The FBI had previously officially identified TraderTraitor as responsible for the Bybit hack in February 2025. The details match: funding through Tornado Cash, lengthy preparation, and signatures obtained in advance that are executed in a single burst.
• Connection to Bitget. According to Chainalysis, the funds stolen from Binance were mixed with money from the Bitget hack worth about $388 million, which had occurred a month earlier.
• Similarity to KelpDAO. The scheme resembles the April attack on KelpDAO (about $292 million) – the largest DeFi hack of 2026 up to that point.

The exchange itself has not yet officially named the perpetrator and says it is cooperating with law enforcement. The U.S. Secret Service confirmed that it is tracking the stolen funds.

How the Binance hack happened: an engineer’s laptop, EIP-7702, and 50 pre-signed authorizations

Binance’s version

According to the exchange’s preliminary data, hackers compromised a DevOps engineer’s laptop. Through it, they gained access to a service container and were able to send unauthorized withdrawal transactions.

Later, Binance reported additional points of compromise. The exchange’s co-CEO Richard Teng added that the attackers erased traces and bypassed security checks rather than pressing “one button.” According to Reuters, several people took part in the attack, and the malware was written to delete evidence while it was running.

An important detail: Binance said it found no signs of a leak of wallet private keys.

What blockchain analysts saw

The most elegant part of the attack took place on Ethereum. It is worth explaining in simple terms.

EIP-7702 is a feature introduced in Ethereum with the Pectra upgrade (May 2025). It allows a regular wallet to “delegate control” to a smart contract by signing an authorization. After that, any call to the wallet executes the contract’s code.

The problem for the hackers was that each wallet has a transaction counter (nonce), and the authorization works only at a specific counter value. Binance’s hot wallet constantly processes customer withdrawals, so the counter keeps increasing.

The solution turned out to be simple and terrifying: the hackers prepared 50 signed authorizations in advance — one for each of 50 consecutive counter values. One of them worked, and that was enough. The wallet turned into a “vacuum cleaner” that obeyed only the attack operator.

After 3 minutes and 24 seconds, the hacker instructed the wallet to send its entire balance: 167,464 ETH and 1.615 billion USDT in a single transaction. The delegation remained in effect, so all new funds arriving in the wallet were drained six more times until late at night.

Important to understand: EIP-7702 is not an Ethereum vulnerability, but a tool. In the other nine networks, the hacker received funds through ordinary signed transfers, even though those wallets use different key types and signature schemes. According to TRM’s assessment, this points to a compromise of Binance’s hot wallet signing system, rather than a bug in any specific blockchain. The exchange has not yet published its final technical report.

How hackers launder money

Hackers understood perfectly well that stablecoins could be frozen and began a race against the issuers:

• about 325 million USDT were sold to market makers via UniswapX for ~122,300 ETH — at a discount of more than 10%, just to make it in time;
• using 60 million USDT as collateral, about 19,760 ETH were borrowed on Aave, after which the protocol temporarily froze the affected markets;
• 18,270 BTC were sent through a peel chain — splitting them into round amounts, which makes tracking more difficult.

Chainalysis identified laundering schemes it had not seen before, along with thousands of automated transactions within a short period. TRM expects the next stage to involve cross-chain bridges, swap services, and OTC brokers.

Freezing $2.7–3 billion: who saved half of the stolen funds

For the first time in the history of crypto hacks, the industry blocked stolen funds this quickly and at such scale. Tether froze the first 971 million USDT just 37 minutes after the main withdrawal.

Who froze the funds	How much
Tether	~1.77 billion USDT
Circle	~825 million USDC
Ripple	40.5 million RLUSD
World Liberty Financial	27.8 million USD1
Arbitrum Security Council	8,426 ETH + 74.6 million ARB (~$30 million)
Total	~$2.7 billion according to TRM; Binance estimates ~$3 billion

Estimates differ because of different calculation times: Elliptic, for example, put the figure at $2.84 billion. But the overall picture is clear — nearly half was successfully frozen.

The downside is that only stablecoins and tokens with centralized control can be frozen. More than 420,000 ETH and 18,270 BTC (about $2.4 billion) are beyond the reach of any issuer.

What Binance is doing now: compensation, SAFU, and withdrawals

The exchange’s main statement was delivered by co-CEO Richard Teng: “Binance, not our users, will absorb the financial impact.”

Status as of October 31:

• Compensation. Binance has reserved more than $6.34 billion of its own funds, including about $5 billion in the same coins that were stolen. The rest is being purchased on the market and via OTC.
• 90% replenished (the previous day it was ~80%). BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed at 100%. The shortfall is mainly in low-liquidity tokens.
• Sources of funds: part of the SAFU fund, the futures insurance fund, and corporate capital. The exchange promises to restore SAFU to ~$1 billion.
• Proof of Reserves. The reserve snapshot was taken at 00:00 UTC on October 31. Full zk-proof is expected on November 3.
• Withdrawals will resume from November 1 in stages, coin by coin. Deposits are operating as usual.
• Binance.US — a separate U.S. entity — was not affected.

Why SAFU Would Not Have Been Enough

Binance created the SAFU fund (Secure Asset Fund for Users) in 2018 specifically for cases like this. In 2019, it fully covered the theft of 7,000 BTC (~$40 million). But now it holds about $1 billion, while more than six times that amount was stolen. Without corporate reserves, SAFU alone would have covered only one-sixth of the damage.

Do not keep on an exchange what you are not using for trading. It is safer to store long-term holdings on a hardware wallet. Which hardware wallet to choose in 2026

Market Reaction: Bitcoin, Ether, and BNB After the Binance Hack

Asset / metric	Movement	Level
Bitcoin (BTC)	−3…−4%	to ~$76,400–77,400, the lowest in six weeks
Ethereum (ETH)	−3…−4.4%	~$2,180–2,230
BNB	−6…−9%	~$690–700
Market capitalization	−4.6%	~$2.59 trillion
Futures liquidations	~$1.5 billion in 24 hours	the main share was longs

BNB was hit the hardest, as expected: it is directly tied to Binance’s balance sheet and reputation. Shares of public crypto companies also came under pressure — Coinbase stock fell 12% amid its quarterly report and the broader sell-off.

The paradox: a record-breaking hack — and a moderate decline

Four times more was stolen than in the Bybit case, yet bitcoin lost only 3–5%. Analysts explain it this way: the market has started to view exchange hacks as an operational risk rather than an existential one — provided the victim can pay. Binance’s promise to fully compensate losses and the swift freezing of stablecoins acted as a shock absorber.

But it is too early to relax. Geoffrey Kendrick, Head of Digital Assets Research at Standard Chartered, warned of possible further downside. The next few days will be decisive: withdrawals launching on November 1 and verifiable proof of reserves on November 3.

The Binance Hack and the Crypto Industry: 6 Main Consequences

This is where things get most interesting. The Binance hack apparently will not hit clients’ wallets, but it will change the rules of the game for the entire industry.

1. A blow to trust in centralized exchanges

The old principle “not your keys, not your coins” is back in vogue. Standard Chartered believes the hack will accelerate the shift of trading to decentralized exchanges (DEX), and that Uniswap will benefit from this in the long term. Analysts are already recording asset withdrawals by institutional investors from centralized platforms.

There is another side to this as well. Binance was able to allocate $6.3 billion within 24 hours — an amount exceeding the capital of most exchanges in the world. This reassures clients, but at the same time shows how dependent the industry is on a single player. The question of “too big to fail” in crypto is no longer theoretical.

2. A new wave of regulation

United States. President Donald Trump said the administration is “looking into” the incident and noted that Binance’s promise to reimburse losses reassures him. CFTC Chairman Michael Selig pointed to the risks posed by offshore exchanges that are not subject to the same rules as regulated U.S. institutions. Industry group Digital Chamber and advocacy organization Better Markets called for tighter oversight of exchanges.

European Union. Binance does not have a MiCA license: the exchange withdrew its application in Greece in June 2026, and from July 1 it restricted new services in the EU. Even before the hack, ESMA and regulators in France, Germany, and Greece were examining how Binance continues to serve Europeans through the “reverse solicitation” mechanism.

A telling detail: under Article 75(8) of MiCA, a licensed custodian must compensate clients for crypto-assets lost through its fault. Binance is now voluntarily doing exactly that, even though MiCA rules do not apply to it. For European regulators, this is a strong argument: MiCA rules are not bureaucracy, but real protection.

Learn more about which exchanges left the EU after July 1 and where Ukrainians in Europe can trade now in our MiCA analysis.

There are also voices against rushing: Frank Downing of Ark Invest urged regulators not to adopt hasty restrictive measures.

3. Stablecoin Freezes: A Double-Edged Sword

Without Tether, Circle, and Ripple, the hackers would have made off with nearly twice as much. Supporters of regulation received a powerful argument: $2.7 billion was taken out of criminals’ control within a few hours.

But the same story showed something else as well: an issuer or a network’s Security Council can move funds without the owner’s key. Arbitrum literally took ETH from someone else’s address. Today this helped against North Korea, but tomorrow the same mechanism could be used by court order, at a regulator’s request, or by mistake. The debate over how “decentralized” stablecoins and L2 networks really are has received its strongest argument in history – and it cuts both ways.

4. Hot Wallets and EIP-7702: A New Security Standard

After Bybit, the industry strengthened multisig setups and cold storage. Now the focus is shifting to the signing infrastructure of hot wallets. TRM has already given exchanges specific recommendations:

• monitor the appearance of EIP-7702 delegation on treasury wallets and immediately raise the alarm;
• reject unexpected EIP-7702 authorizations by default, and treat a request for a batch of permissions across a nonce range as a sign of compromise;
• separate signing systems by networks and wallet tiers so that a single attacker cannot obtain signatures across ten blockchains within half an hour.

It is reasonable to expect exchanges to begin undergoing external audits of their signing infrastructure on a large scale, while insurers revise their coverage terms.

5. Who pays when custody fails

The main takeaway for institutional investors: protecting keys is required, but not enough. What matters is who covers the losses if the protection fails. SAFU turned out to be six times smaller than the damage. Custody experts believe the next round of competition will not be about “the most secure storage,” but about real compensation mechanisms — insurance, capital reserves, and legally binding guarantees. This is where custodian banks gain an advantage over crypto exchanges.

6. North Korea is a systemic risk for the entire crypto industry

In less than two years: Bybit – $1.5 billion, KelpDAO – ~$292 million, Drift – ~$285 million, Bitget – ~$388 million, and now Binance – $6.36 billion. North Korean hackers have turned cryptocurrency theft into a sector of the state economy. This is no longer a matter of cybersecurity for individual companies, but of national security and sanctions policy.

The largest hacks in cryptocurrency history: comparison

Incident	Year	Amount at the time of the theft	Who was behind the attack	What happened to customers
Binance	2026	~$6.36 billion	TraderTraitor (North Korea)	The exchange promises 100%; as of 31.10, 90% has been replenished
Bybit	2025	~$1.5 billion	TraderTraitor (North Korea), according to the FBI	The exchange replenished reserves using its own funds and loans
Ronin (Axie Infinity)	2022	~$625 million	Lazarus (North Korea)	Compensation from company and investor funds
BNB Bridge (BSC Token Hub)	2022	~$570 million (2 million BNB)	Not established	The network was halted; most of the funds did not have time to leave
Binance	2019	~$40 million (7,000 BTC)	Not established	Fully covered by the SAFU fund
Mt. Gox	2014	~850,000 BTC	Not established	Payments to creditors began only a decade later

The trend is obvious: the amounts are growing, and the outcome for customers increasingly depends on whether the affected company has the money to provide compensation.

What Binance users in Ukraine and the EU should do right now

For many Ukrainians, Binance is the main platform for trading, P2P exchange, and storing stablecoins. Here is a practical checklist:

1. Do not panic in the first hour after withdrawals launch. Withdrawals will resume gradually, coin by coin. In the first few hours, queues and delays are possible — this is normal.
2. Check your account security: 2FA via an authenticator app or a hardware key (not SMS), a withdrawal address whitelist, and an anti-phishing code.
3. Beware of scammers. After high-profile hacks, fake “compensation,” “wallet verification,” and calls from the “Binance security team” always appear. According to the exchange, user balances were not affected, so no action is required to receive compensation. Never share your seed phrase, passwords, or codes with anyone. How not to lose access to your wallet and seed phrase →
4. Check your balance in Proof of Reserves on November 3. Binance allows every user to verify that their balance is included in the reserves.
5. Withdraw your long-term holdings to your own wallet — a hardware wallet or at least a non-custodial one like Trust Wallet. Choose the network carefully when withdrawing — what to do if you sent USDT to the wrong network.
6. Do not keep all your eggs in one basket. Spread your trading funds across several exchanges. Ukrainians in the EU should look at platforms with a MiCA license — exchange comparison.
7. If you trade futures, reduce your leverage. Volatility will remain until the fate of the stolen $2.4 billion becomes clear.

Risks: what to watch in the coming weeks

Honestly about what remains unknown for now:

• The root cause has not been disclosed. Binance has promised a technical report, but it is still unclear whether all vulnerabilities have been closed. “Additional breach points” are an alarming signal.
• 10% shortfall. It mainly affects low-liquidity tokens. Holders of small altcoins may have to wait longer than others.
• Proof of Reserves is a snapshot, not an audit. The statement about full backing on October 31 is a claim, while the verifiable zk-proof on November 3 is actual proof. The difference is fundamental.
• $2.4 billion will still surface. The funds will move through bridges, swaps, and OTC. Exchanges will block related deposits, and legitimate users who received “tainted” coins through a chain of transfers could be frozen by mistake.
• Regulatory response. New requirements for offshore exchanges in the US and accelerated inspections in the EU are possible, which could limit access to Binance in certain countries.
• Pressure on BNB. Until operations return to normal, the token remains the most vulnerable asset in this story.

FAQ: Binance hack – frequently asked questions

Is my money on Binance safe?

According to Binance, user balances were not affected: corporate funds were stolen from hot wallets, and the exchange is covering all losses itself. As of October 31, 90% of the stolen funds had been replenished, and BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are backed 100%. It will be possible to verify this independently after the zk-proof of reserves is published on November 3.

When will Binance resume withdrawals?

Binance plans to restart withdrawals gradually from November 1, 2026, coin by coin. Deposits continue to operate as usual throughout this period. The exchange publishes the exact schedule for each coin through its official channels.

How much was stolen from Binance?

According to TRM Labs, about $6.36 billion at prices at the time of the theft, while the exchange itself says about $6.3 billion. This is the largest theft in cryptocurrency history, roughly four times larger than the Bybit hack. About $2.7–3 billion was frozen.

Who hacked Binance?

TRM Labs and Chainalysis attribute the attack to the North Korean hacking group TraderTraitor – the same group that, according to the FBI, hacked Bybit in 2025. Binance has not yet officially named the perpetrator.

How did the hackers breach Binance?

According to Binance’s preliminary findings, the entry point was a compromised laptop belonging to a DevOps engineer, and other vulnerabilities were later found. Blockchain analysts believe the hackers gained access to the hot wallet signing system. On Ethereum, they used EIP-7702 delegation with 50 pre-signed authorizations. The exchange said it found no private key leaks.

Will the SAFU fund be enough to cover the losses?

No, SAFU alone would not have been enough: the fund holds about $1 billion, while more than six times that amount was stolen. That is why Binance is covering the damage using SAFU, the futures insurance fund, and corporate capital – more than $6.34 billion has been reserved in total. The exchange has promised to restore SAFU to about $1 billion.

Should you withdraw your crypto from exchanges now?

That depends on your goals. An exchange is necessary for active trading, but keeping long-term holdings there is an unnecessary risk, as this hack has shown. A sensible approach is to keep only trading capital on an exchange, store the rest in a hardware or non-custodial wallet, and spread trading funds across several platforms.

How will the Binance hack affect the crypto industry?

Tighter regulation of exchanges in the US and EU is expected, along with growing interest in decentralized exchanges and self-custody, a review of hot wallet security standards, and debate over whether stablecoin issuers should have the right to freeze funds. Pressure will also increase on custodians regarding insurance and compensation mechanisms.

The situation is evolving. The data is current as of October 31, 2026, 18:00 Kyiv time. We will update the article after withdrawals are launched and the Proof of Reserves is published.

Disclaimer: this material is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are a high-risk asset. Make your own decisions and verify information through official sources.