Binance, the world’s largest crypto exchange, said on Thursday, October 29, 2026 that a security incident affected roughly $6.3 billion in crypto assets, making it the biggest crypto theft on record. Binance says it has frozen about $5 billion, has set aside more than $6.34 billion to cover all losses, and aims to reopen withdrawals on Sunday. Bitcoin fell to around $77,000 and more than $1.5 billion of leveraged bets were wiped out. Investigators have not published a final account of how the attack unfolded, and the sources behind the attribution to North Korea are preliminary.
Quick facts
- Amount: about $6.3 billion affected. Blockchain firm TRM Labs puts the amount moved at about $6.36 billion.
- When: Thursday, October 29, 2026, with most funds moved in about 20 minutes, according to TRM.
- How: Binance says the attack began with a compromised engineer’s laptop. On Friday its co-CEO said investigators found more breach points.
- Who: TRM says a North Korean group was likely behind it. This is an analyst assessment, not an official finding.
- Frozen: Binance first said about $3 billion, then raised the figure to roughly $5 billion on Friday.
- Users: Binance says it will cover all losses with company funds and that user funds are safe.
- Withdrawals: suspended. Binance is targeting a restart on Sunday, November 1, and plans a proof-of-reserves update and a full report on Monday.
- Previous record: the $1.5 billion Bybit hack in 2025, also linked to North Korea.
Timeline
| When (ET) | What happened |
|---|---|
| Thursday, Oct 29 | Binance says it is investigating a possible security issue; founder Changpeng Zhao says it looks like a hack |
| Thursday evening | Binance says total impact is about $6.3 billion and about $3 billion is frozen; deposits and withdrawals are paused |
| Thursday | Tether freezes more than $1.5 billion of USDT; Circle freezes more than $800 million of USDC; First Digital freezes stolen FDUSD |
| Thursday | Bitcoin and other major coins fall; liquidations pass $1 billion |
| Friday morning | Binance raises frozen assets to about $5 billion and says it has arranged $6.34 billion to cover losses |
| Friday midday | Co-CEO Richard Teng says investigators found additional breach points, explains how the hot wallet was taken over and sets a Sunday target to reopen withdrawals |
| Monday (planned) | Full proof-of-reserves report |
What we know about how the attack worked
Binance’s account so far, as reported by CoinDesk and NBC News:
- A compromised laptop. An attacker gained access through an engineer’s laptop, which opened access to a service container inside Binance’s systems.
- Unauthorised withdrawals. From there the attacker submitted withdrawal transactions without the usual approvals.
- Ethereum account delegation. Teng said the attackers used Ethereum’s EIP-7702 account-delegation feature to take control of a hot wallet without passing Binance’s normal approval steps. CoinDesk reports about $2.5 billion was drained this way in minutes.
- Erasing evidence. The attackers also used a self-destruct mechanism to remove traces, which makes investigation harder.
- Many chains. TRM says funds left wallets on 10 blockchains.
Binance has not published a full technical report. Teng said investigators have not yet worked out the complete sequence of events.
What we do not know yet
- The exact number of breach points and how long the attackers had access
- Whether the attack was designed or helped by insiders (nothing in the sources checked says so)
- How much of the stolen money will be recovered, and how much of the frozen amount can be returned
- Whether Binance.US, which is a separate business for US customers, was affected. The sources we checked do not say, so check Binance.US’s own status page
- Which tokens and customers were hit, and how Binance will report it
- Whether regulators in the US, EU and Asia will open investigations
Was it customer money or Binance’s money?
Binance says the attack hit its own hot wallet and that user funds are safe. But a separate CoinDesk review of Binance’s reserve data found that the compromised wallets had been listed among the assets backing customer balances. That difference is why the proof-of-reserves report on Monday matters. Until it is published and checked independently, treat the picture as incomplete.
Who is behind the Binance hack?
TRM Labs, a US blockchain intelligence firm, said a North Korean unit was likely responsible. North Korean groups were blamed for the $1.5 billion Bybit hack in 2025. Attribution in crypto thefts is often based on wallet patterns, laundering routes and past behaviour, and can change as investigators learn more. Binance has not formally named a culprit.
Market impact: bitcoin, ether, XRP and crypto stocks
| Asset | Price on Friday morning, Oct 30 | Move over 24 hours |
|---|---|---|
| Bitcoin (BTC) | About $77,200 to $77,400 | Down more than 3%, briefly near $76,000 |
| Ether (ETH) | About $2,240 | Down about 4% |
| BNB | About $700 | Down about 6% |
| XRP | About $1.25 | Down about 3% |
| Solana (SOL) | About $95 | Down about 6% |
Market-wide liquidations reached about $1.5 billion, mostly long positions, with bitcoin and ether leading. Crypto stocks also fell. Standard Chartered’s head of digital asset research said prices could stay under pressure until frozen assets are released and more detail emerges. Some Wall Street analysts told investors to buy crypto stocks on the weakness. These are opinions, not predictions, and this article is not investment advice.
Is there a Binance stock? No. Binance is privately held, so you cannot buy Binance shares. Investors usually trade related stocks such as Coinbase and Strategy, or the BNB token, which is a different asset.
Separate incident: the prediction market Polymarket suspended trading for international users after hackers drained more than $2.6 million from user accounts. Reports have not linked it to the Binance attack.
Why this hack matters
- Size. It is about four times the previous record, and Binance held roughly $144 billion in assets before the hack, according to DefiLlama data.
- Trust in centralised exchanges. Analysts argue it could push more traders toward decentralised exchanges, though decentralised platforms have their own risks.
- Stablecoin freezes. Tether and Circle froze funds within hours, which shows how issuers can limit what thieves can cash out.
- Security lessons. A single compromised laptop led to a major breach, which puts attention on employee device security, key management and transaction approvals.
- Context. Axios linked it to a wave of security incidents this month, sometimes called “Black October” in the press.
What Binance users should do now
- Do not panic-sell or panic-withdraw. Wait for official updates, especially the Sunday restart and Monday report.
- Use only official channels. Check Binance’s verified X account and its website for updates. Do not trust links in emails, DMs or ads.
- Watch for phishing. Scammers already use hack news to send fake “claim your compensation” or “verify your account” messages. Binance will not ask for your password, 2FA codes or seed phrase.
- Turn on strong security: an authenticator app or hardware key for 2FA, an anti-phishing code, and a withdrawal address allowlist.
- Review account activity and API keys, and delete any you do not use.
- Keep records of your balances and transactions in case you need them for claims or taxes.
- Spread risk. Do not keep all your crypto on one exchange. For large long-term holdings, consider a hardware wallet that you control.
To learn how to spot scams, see our guides on how to identify a fake text message and OTP scams, and for a related security story, see how to check if your PHP website was hacked.
FAQs
Was Binance hacked? Binance says a security incident affected about $6.3 billion in assets, and its founder said it looks like a hack. Binance says the attack began with a compromised laptop.
How much was stolen from Binance? About $6.3 billion was affected, according to Binance. TRM Labs counts about $6.36 billion moved out of wallets across 10 blockchains.
Is my money safe on Binance? Binance says user funds are safe and that it will cover all losses with company funds. Independent proof is pending, with a reserves report expected on Monday. Take precautions and follow official updates.
When will Binance withdrawals reopen? Binance is targeting Sunday, November 1, 2026, but the date depends on its testing and security review.
Who hacked Binance? TRM Labs says a North Korean group was likely behind it. Binance has not formally confirmed an attacker.
Is this the biggest crypto hack ever? Yes, according to Binance and major news outlets. It is larger than the $1.5 billion Bybit hack in 2025.
Why did the bitcoin price fall? Bitcoin fell to around $77,000 as traders reacted to the hack, with over $1.5 billion in leveraged positions liquidated. Analysts say pressure could last until more details emerge.
Can the stolen crypto be recovered? Yes, authorities and crypto companies may recover some of it. Tether, Circle, and other issuers have frozen large amounts of crypto. Binance also says it has frozen about $5 billion. However, authorities and companies must complete legal and technical steps before anyone can release those frozen assets.
Is Binance.US affected? The sources we checked do not say. Binance.US is a separate entity, so check its own status page and announcements.
Can I buy Binance stock? No. Binance is a private company. The BNB token is not a share in Binance.
What to watch next
- Whether withdrawals reopen on Sunday
- The proof-of-reserves report on Monday
- A technical post-mortem from Binance
- How much frozen money is returned
- Statements or actions from US and global regulators and law enforcement
- Bitcoin price and liquidations as markets absorb the news
This article reports developing news. Figures come from Binance, TRM Labs, CoinDesk, NBC News, AP, CBC and Axios as of October 30, 2026, and may change. It is not financial or legal advice.