The $6.3 billion Binance hack: what happened, what Binance has said and what we still don't know

On 29 October 2026, Binance, which the US Treasury described in 2023 as the world’s largest crypto exchange, said it had been hit by a security incident with an estimated impact of about $6.3 billion. If that figure holds, it’s the largest crypto theft on record, about four times the $1.5 billion that the FBI says North Korea stole from the exchange Bybit in February 2025.

This is a developing story. This guide sets out what Binance and the authorities have said so far, attributing each point to its source, and what is still unknown. We’ll update it as official information appears. For what to do if you have a Binance account, see the Binance hack: what users should do now.

What happened

According to Binance and early reporting:

• On 29 October, users reported funds draining from Binance wallets. Binance confirmed a security incident and suspended deposits and withdrawals while it secured its systems.
• Binance said: “The estimated total impact sits at around $6.3B.”
• Blockchain analytics firm TRM Labs said an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC.

How the attacker got in

Binance said its initial investigation pointed to a compromised laptop, which let “an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” It later said it had found additional points of breach, and no evidence of any wallet private key leak. Binance said it would publish a detailed technical post-mortem once its investigation is complete.

In other words, according to Binance, the attacker didn’t need to steal the keys to its wallets. They got far enough inside its systems to make the exchange approve withdrawals itself.

How much has been frozen

Freezing has clawed back a large share of the theft:

• Binance said about $3 billion of crypto that passed through hacker-linked wallets had been identified and frozen, working with partners, and that “this figure may continue to increase”.
• Tether’s chief executive said it froze more than $1.5 billion of its stablecoin, and Circle’s chief executive said it had frozen hundreds of millions of dollars.
• TRM said issuers including Tether, Circle, Ripple and World Liberty Financial had frozen about $2.67 billion in stablecoins, and that the attacker still held about $2.4 billion in assets that no issuer can freeze.

Stablecoins can be frozen because their issuers control them; bitcoin and ether can’t. See how stablecoin issuers freeze stolen crypto.

Will customers be repaid?

Binance said it will “cover all losses” and that “user funds are safe”, using its emergency protection fund and company money. Its founder, Changpeng Zhao, said that as a shareholder he expected all user funds to be fully covered.

That’s a commitment from the company, not a legal guarantee. Crypto held on an exchange isn’t protected by government deposit insurance. See when a crypto exchange is hacked, who pays?

Who did it?

• TRM Labs attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group, “with high confidence”, saying several features matched earlier North Korea-linked heists, including Bybit.
• Chainalysis’s chief executive said it was “likely” the work of the same group.
• The FBI said it “is aware of the incident and is engaged with relevant public and private partners”, but, according to Nextgov/FCW, didn’t attribute the intrusion as of 30 October.
• Binance said it was “working closely with our law enforcement partners to confirm the identity of these criminals”.

The FBI has attributed earlier thefts by the same group, including Bybit’s. See North Korea’s crypto hackers: TraderTraitor explained.

The timeline so far

What we don’t know yet

• the final amount stolen and recovered, which Binance says could change;
• the full technical cause, pending Binance’s post-mortem;
• an official attribution by the FBI or other authorities;
• exactly when all services return to normal;
• whether regulators will take any action.

If you hold crypto on any exchange

• Use only official channels for updates. Binance warned users not to trust unofficial links, messages or requests for account information.
• Expect scams. Big hacks are followed by fake “refund” and “recovery” offers. See crypto recovery scams.
• Keep long-term holdings off exchanges if you’re comfortable managing your own keys. See hot vs cold wallets.