Binance Confirms $6.3 Billion Hack, the Largest Theft in Cryptocurrency History

What happened

Binance, the world's largest cryptocurrency exchange by daily trading volumes, confirmed on Friday, October 30, 2026 that a "complex attack" had drained an estimated $6.3 billion from its hot wallets across 10 blockchains, making it the biggest security breach in cryptocurrency history. The theft unfolded in a coordinated operation lasting roughly 20 minutes on Thursday evening, October 29, and the exchange said the figure "may continue to increase as our teams work closely with law enforcement, issuers, blockchain intelligence firms and industry partners to trace and freeze additional assets." Binance posted on X: "This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it," and confirmed on its Latin America X account that "the total estimated impact is around $6.3 billion," according to Channels Television. The company's initial investigation pointed to a compromised laptop belonging to a "DevOps engineer," which allowed unauthorized access to a "service container" and the use of Ethereum's EIP-7702 feature to authorize malicious contracts and execute unauthorized withdrawals. Binance said "We have found no evidence of any private key leaks from wallets," but later stated that "subsequent investigation has uncovered additional points of breach." The firm earlier posted contradictory messages, insisting "user funds are completely safe" while also saying it would "cover all losses." All deposits and withdrawals were "temporarily suspended," and at about 0900 GMT on Friday Binance said it was on track to resume withdrawals in 45 hours. Around $3 billion in affected assets had been frozen on-chain, with stablecoin issuers freezing more than $2.38 billion in linked assets: Paolo Ardoino, CEO of Tether, said his firm froze about $1.6 billion "related to a potential Binance exchange hack," while Jeremy Allaire, who runs Circle, said his company froze more than $800 million in USDC. Blockchain analytics firm TRM Labs said on Thursday it had "high confidence" the hack was orchestrated by TraderTraitor, a North Korean state-sponsored cyber unit believed to be part of the Lazarus Group, citing "robust on and off-chain intelligence," and Chainalysis also attributed the intrusion to TraderTraitor. "Several features of this attack match earlier North Korea-linked heists," TRM said. The heist is roughly four times the previous record, the $1.5 billion stolen from Bybit in February 2025, also attributed to TraderTraitor. Crypto prices tumbled on the news: Bitcoin fell nearly 5%, Ethereum nearly 6%, and BNB, the token native to Binance, tumbled nearly 10%, though Il Messaggero put the moves at 2.34% to $77,000 for Bitcoin and 3.35% to $2,233 for Ethereum. The US Department of Justice and the FBI did not immediately respond to requests for comment.

Why it matters

The scale of the loss sets a new benchmark for exchange risk. At $6.3 billion, the breach is more than four times the previous record of $1.5 billion taken from Bybit in February 2025, and it struck the largest venue in the market, which handles the highest daily trading volumes in the industry. The attribution to TraderTraitor, if it holds, would extend a pattern in which North Korean-linked units have been held responsible for the two largest thefts in crypto history within two years, a point TRM Labs underlined when it said the attack's features match earlier North Korea-linked heists. The market reaction was immediate and broad: Bitcoin down nearly 5% by one count, Ethereum down nearly 6%, and BNB down nearly 10%, a sharper fall that reflects Binance's own exposure. The response from stablecoin issuers also shows how quickly the industry can now move: Tether froze about $1.6 billion and Circle more than $800 million within hours, contributing to roughly $3 billion in total on-chain freezes. For users, the immediate questions are practical, since deposits and withdrawals were suspended and the exchange said at about 0900 GMT Friday that withdrawals would resume in 45 hours. For regulators and law enforcement, the case raises questions about operational security at major exchanges, given that the initial investigation traced the entry point to a single compromised engineer laptop before Binance said further investigation had uncovered additional points of breach. The silence so far from the US Department of Justice and the FBI leaves the official response an open question.

How it is being covered

The story is being carried by 785 sources, with 284 rated, split 30% left, 39% center and 31% right, according to ground.news. Of the rated outlets, 152 are rated high factuality and 86 very high, against 38 mixed, 5 low and 2 very low. Ground.news flags no blindspot: outlets across the spectrum are covering the breach, its attribution and the market fallout.

What to watch

Three threads are live. First, the stolen total: Binance itself has warned the $6.3 billion figure may rise as tracing continues, so any revision from the exchange or its partners is the number to track. Second, the freeze-and-recover effort: the roughly $3 billion already frozen on-chain, including the $2.38 billion from Tether and Circle, could grow or be moved by the attackers, and statements from the issuers will signal progress. Third, the operational timeline: Binance said at about 0900 GMT Friday that withdrawals would resume in 45 hours, so the resumption itself, and any further disclosure about the "additional points of breach," will test confidence in the platform. Watch also for formal comment from the US Department of Justice and the FBI, which did not immediately respond to requests for comment, and for any updated attribution from TRM Labs or Chainalysis beyond the "high confidence" designation already issued.

By the numbers

Source snapshot