Binance says hackers drained about $6.3 billion from its wallets on Thursday, in what investigators now call the largest crypto theft ever recorded. The world’s biggest crypto exchange put the estimated impact at $6.3 billion, while blockchain firm TRM Labs traced $6.36 billion moving out of Binance wallets across 10 blockchains.
Most of the money moved in about 20 minutes, TRM said, starting at 20:05 UTC on October 29. Binance has since worked with partners to freeze roughly $3 billion of the stolen funds, and the company says it will cover all losses. Withdrawals remain paused while Binance overhauls its withdrawal systems, with service expected back within 48 hours.
No exchange has ever lost this much in one attack.
How the Binance hack unfolded
Binance’s early account of the breach starts with a single laptop. The company said its investigation points to a compromised DevOps engineer’s laptop that gave an attacker access to a service container, which was then used to submit unauthorized withdrawals. It found no evidence that the private keys used to approve crypto transfers were exposed, though Binance stressed that the specific attack path is still under investigation.
Founder Changpeng Zhao, known as CZ, wrote on X that “User funds are safe!” and added that the incident “does look like a hack on Binance.” That post came after an initial period in which Binance said only that it was investigating reports of unauthorized withdrawals. Deposits kept operating normally through the incident, Binance said, even as withdrawals stayed frozen.
Freezing the money became a race against the clock. Binance said partners including Tether, Circle, Ripple, World Liberty and Paxos helped freeze affected assets, among them USDT, USDC, Ripple’s RLUSD and Pax Dollar. About $3 billion has been located so far, according to Binance and Reuters, with no update yet on the remaining roughly $3.3 billion. Binance has promised an updated proof of reserves once remediation is complete, followed by a full technical post-mortem.
North Korea’s TraderTraitor group blamed for Binance hack
TRM Labs attributed the attack to TraderTraitor, which it described as North Korea’s elite hacking unit, and said it made that judgment with high confidence based on on-chain and off-chain intelligence. Chainalysis reached the same conclusion: co-founder and CEO Jonathan Levin wrote on X that the firm believed the Binance hack was likely carried out by the North Korean group TraderTraitor, citing links to earlier attacks.
That name is familiar to investigators. The FBI named TraderTraitor as the group behind the $1.5 billion theft from rival exchange Bybit in February 2025, previously the largest crypto hack on record. Experts cited by Reuters also linked the group to a $387 million hit on exchange Bitget in September 2026. Chainalysis said in a December 2025 report that North Korea had stolen at least $6.75 billion in crypto through the end of 2025, a figure that already included Bybit.
One detail matters for readers: Binance itself has not named an attacker. The North Korea attribution comes from TRM Labs, Chainalysis and other blockchain investigators, not from the exchange. North Korea has denied involvement in past crypto thefts attributed to it.
Researchers say TraderTraitor typically targets developers and IT staff at crypto and financial firms, using malware and phony job offers to trick candidates into downloading malicious software during fake interviews. That access can yield login credentials and a way into internal systems. An FBI public service announcement on October 13 warned separately that North Koreans were secretly taking jobs at US tech and financial companies to earn money for the regime and steal sensitive data. Cybersecurity experts told Reuters the proceeds from crypto thefts help fund North Korea’s weapons programs.
What the Binance hack means for crypto users
Start with scale. At $6.3 billion, the Binance theft is more than four times the $1.5 billion Bybit loss, and it dwarfs the $610 million Poly Network theft of 2021 and the $530 million Coincheck theft of 2018. Those older cases defined the worst-case scenario for crypto security. Binance just reset it.
Markets reacted fast. Bitcoin fell about 3% on Friday, Reuters reported, as traders weighed both the hack and a broader selloff in tech stocks. That drop says something about how crypto now trades: a breach at one exchange, even one that promises to cover losses, still shakes confidence across the market.
For ordinary users, the immediate picture is narrower than the headline number. Binance says it will cover the losses, deposits are working, and withdrawals should return within about two days. The open questions are the ones Binance has not answered yet: how a single compromised laptop reached a withdrawal system, what changes in the security overhaul, and whether the unfrozen $3.3 billion can be traced before it is laundered beyond reach.
There’s a second, less obvious story here. Investigators identified a suspect group and froze nearly half the haul within a day, something that would have been unthinkable in the Coincheck era. Blockchain tracing has grown up. But so has the other side: moving $6.36 billion across 10 blockchains in 20 minutes takes planning, tooling and patience, and the group accused of it has now been linked to thefts totaling well into the billions. Don’t expect either side to slow down.
Frequently asked questions
How much was stolen in the Binance hack?
Binance puts the estimated impact at about $6.3 billion. TRM Labs traced $6.36 billion moved from Binance wallets across 10 blockchains, most of it in about 20 minutes on October 29, 2026.
Who is blamed for the Binance hack?
TRM Labs and Chainalysis point to TraderTraitor, a North Korean hacking group, with TRM citing high confidence. Binance itself has not named an attacker, and North Korea has denied involvement in past attacks attributed to it.
Are Binance user funds safe after the hack?
Binance says it will cover all losses, and founder Changpeng Zhao posted that user funds are safe. Withdrawals are paused during a security overhaul and are expected to resume within 48 hours, while deposits continue to operate normally.
How did the Binance hackers get in?
Binance says its early investigation points to a compromised DevOps engineer’s laptop that gave an attacker access to a service container used to submit unauthorized withdrawals. The company says it found no evidence that wallet private keys leaked.
Sources: Reuters, CNN, TRM Labs, Chainalysis, Binance