Binance hack of $6.3 billion — the largest ever, with $3 billion already frozen

The largest theft in crypto history happened in a single day, and within that day about half of it had been frozen. Binance, the world's largest exchange, confirmed a security incident in the early hours of October 30, 2026 (Korea time; late October 29 UTC), and later that day estimated the damage at about $6.3 billion. That is four times the $1.5 billion a North Korean group took from Bybit in February 2025. According to blockchain analytics firm TRM Labs, the attacker moved most of the funds out of Binance wallets on 10 blockchains in about 20 minutes.

The same day Tether, Circle, Ripple and the DeFi lending service Aave moved one after another to freeze funds, locking up about $3 billion. Binance pledged to cover all losses and said it had secured more than $6.34 billion. Three questions remain: how it got in, who did it, and when users can withdraw.

1. How it got in — from one laptop to the withdraw button

Binance's first explanation was simple. A DevOps engineer's laptop was infected, and the attacker used that access to get into a service container and submit unauthorized withdrawal transactions. Binance said it saw no evidence that wallet private keys had leaked. Hours later it said it had found additional points of breach and revised its description to a "complex attack". CEO Richard Teng said it was not a one-click attack but a multi-stage one.

The detail the industry focused on is EIP-7702, an Ethereum feature that lets an ordinary wallet delegate authority to a smart contract. Teng said the attacker set up this delegation on a hot wallet (a wallet connected to the internet) to skip the usual approval process. Analysts say this explains how funds across multiple chains were swept at once. Teng added that the attacker also used a self-destruct mechanism to erase traces.

A single person's laptop as the starting point is a familiar pattern. Analysis of the 2025 Bybit incident also found it began with the compromise of a wallet-service developer's computer. We covered another route North Korea uses to get inside companies in 'What is a laptop farm'. The chain of access from a personal device to production servers became a door worth billions of dollars.

2. Who did it — analysts point to North Korea, Binance stays quiet

TraderTraitor is the North Korean group the FBI named as responsible for the 2025 Bybit hack. If, as ZachXBT says, these funds were mixed with those from the September Bitget hack (about $350 million), one group would have hit two exchanges in two months. By TRM Labs' count, about 150 attacks in all of 2025 stole $2.9 billion in crypto. This single incident is more than double that.

Chainalysis said the laundering is following repeated, automated patterns. The attacker swapped tokens on decentralized exchanges such as Uniswap and borrowed WETH on Aave against stolen USDT, converting assets into other forms before they could be frozen.

3. How much was frozen — stablecoins acted like banks for the first time

What sets this incident apart is that most of the $3 billion frozen is stablecoins. No one can halt bitcoin or ether on their blockchains, but issuers of dollar-pegged stablecoins can block specific addresses. By Arkham's count, the attacker's wallets at one point held about $1.5 billion in bitcoin, about $900 million in ether, about $1.5 billion in USDT and more than $800 million in USDC. The stablecoins were mostly frozen; bitcoin and ether account for what got away.

Markets were shaken. In Asian trading bitcoin fell more than 3% to $76,368, a six-week low, and ether slid to $2,178. Binance's own token, BNB, dropped 5–8% over 24 hours. In US after-hours trading Coinbase shares fell 4.8% and Strategy, a large bitcoin holder, fell nearly 6%. Coinbase and Binance.US said they were not affected by the incident.

4. What about users' money — a full-coverage pledge, and how it is funded

Binance co-CEO Yi He said the company would cover "all hack losses". The money comes from SAFU, a user protection fund set up in 2018, and company funds.

SAFU alone covers only about a sixth of the loss, which means company money fills most of it. Crypto held on an exchange is not covered by statutory deposit insurance the way bank deposits are; reimbursement depends on Binance's promise and its ability to pay. That is why the reserve Binance announced, $6.34 billion, is almost exactly the size of the loss estimate.

The latest target is to resume withdrawals within 40 hours of 2:34 pm UTC on October 30, which works out to around 06:30 UTC on November 1 (about 3:30 pm in Korea). Over a single day the target changed three times: 48 hours, then 45, then 40.

5. Open questions / what is unconfirmed

• Final loss figure: Binance says $6.3 billion, Chainalysis $6.4 billion. Binance said the amount could rise.
• The remaining $3.3 billion: There is no public analysis of where the unfrozen share went or how much can be recovered.
• Attribution: Analysts point to North Korea, but there is no official statement yet. The next step is whether the US government formally names a culprit, as it did after Bybit.
• Post-mortem: The laptop infection path, the additional breach points and how EIP-7702 was abused need to be confirmed in Binance's official post-mortem.
• Withdrawal restart: Whether the November 1 target holds is the first test of trust. Tim Sun of HashKey in Hong Kong said investors will reassess the risks of centralized exchanges after this.

Security incidents kept coming the same week. A vulnerability in Drupal's online-store module was exploited in real attacks ('Drupal Commerce vulnerability patch versions'). We covered attackers using stolen keys to run up someone else's resources in 'What is API key theft'.