Choose a section or paragraph
Binance, the world’s largest cryptocurrency exchange by trading activity, is facing an unprecedented cybersecurity crisis after attackers moved approximately $6.3 billion in cryptocurrencies from exchange-controlled wallets on October 29, 2026.
The incident is the largest publicly reported cryptocurrency theft on record, exceeding the roughly $1.5 billion Bybit hack of February 2025 by more than four times.
The stolen assets included Bitcoin, Ethereum, XRP, Solana, USDT, USDC and numerous other digital tokens. Blockchain investigators identified suspicious transfers across multiple networks, while stablecoin issuers moved quickly to block billions of dollars in stolen assets.
Binance has acknowledged the security incident and pledged to cover user losses. Blockchain intelligence firms TRM Labs and Elliptic have linked the attack to North Korean threat actors, although the exchange’s forensic investigation remains ongoing.
The breach raises a fundamental question for the cryptocurrency industry: how could a highly sophisticated exchange lose billions of dollars through systems designed to protect customer funds?
How Much Cryptocurrency Was Stolen From Binance?
Binance estimated the impact of the security incident at approximately $6.3 billion.
TRM Labs, which analyzed transfers from Binance-attributed wallets across ten blockchain networks, calculated approximately $6.36 billion in stolen assets.
Elliptic independently estimated approximately $6.43 billion, based on its own blockchain tracing methodology.
The variation reflects differences in asset prices, transaction classification, tracing coverage and observation times. It does not necessarily indicate separate thefts.
According to TRM Labs, Ethereum accounted for approximately $3.79 billion of the loss.
Bitcoin was the second-largest source, with 18,270 BTC valued at approximately $1.47 billion when stolen.
Additional losses involved Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
Around $3 billion in affected assets had been frozen through coordinated action with blockchain companies, according to Binance’s October 30 statement.
However, frozen cryptocurrency is not the same as cryptocurrency already recovered and returned to Binance.
Which Cryptocurrencies Were Affected?
The incident involved substantially more than Bitcoin and Ethereum.
TRM Labs identified 200,630 ETH and 185 other Ethereum-based tokens in the Ethereum portion of the theft.
Its investigation included approximately 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD on Ethereum.
On Bitcoin, investigators identified 18,270 BTC.
The Tron network experienced transfers involving approximately 612.7 million USDT and 46.4 million TRX.
On XRP Ledger, approximately 233.46 million XRP was transferred from Binance-linked wallets.
Solana-related outflows totaled approximately 970,500 SOL.
Arbitrum was also affected, including around 74.6 million ARB tokens, while Avalanche, Optimism, Base and Polygon accounted for additional losses.
Other affected Ethereum-based assets included tokens associated with decentralized finance, stablecoins and tokenized financial products.
The number of distinct token assets is therefore in the hundreds, although investigators’ totals differ depending on whether they count individual tokens, blockchain networks or wrapped representations separately.
How Did the Binance Hack Happen?
Binance initially reported that the attack may have begun with a compromised laptop belonging to a DevOps engineer.
According to the exchange, the compromise potentially allowed an attacker to access a service container and submit unauthorized withdrawals.
Binance said its investigation had not found evidence that wallet private keys were leaked.
That detail is important because a cryptocurrency theft does not necessarily require criminals to steal the underlying cryptographic keys.
An attacker who compromises the infrastructure responsible for requesting or authorizing legitimate transactions may still be able to trigger withdrawals.
Subsequent investigations identified additional potential breach points, and Binance described the operation as more complex than its initial findings suggested.
Co-CEO Richard Teng clarified that the incident was not simply the result of one engineer’s permissions or a single action.
The company has promised a full technical post-mortem once its forensic investigation is complete.
What Was the Role of Ethereum’s EIP-7702?
Blockchain intelligence firm TRM Labs identified a particularly sophisticated technique involving Ethereum’s EIP-7702 functionality.
The mechanism allows an externally owned Ethereum account to delegate certain execution capabilities to smart-contract code through signed authorization.
Investigators reported that attackers used pre-signed authorizations to make a Binance hot wallet execute code that could automatically transfer assets to attacker-controlled destinations.
TRM identified 50 authorizations prepared in advance.
The malicious mechanism reportedly allowed attackers to sweep funds from a heavily used Ethereum wallet and continue transferring newly arriving funds.
This does not establish that Ethereum itself was compromised.
Rather, it illustrates how advanced blockchain functionality can be misused when an institution’s authorization infrastructure is breached.
The central issue was control over the authorization process, not a demonstrated failure of Ethereum’s cryptographic security.
How Did the Attack Unfold?
Investigators identified signs of preparation before the large withdrawals began.
TRM Labs reported that an operator wallet received small Tornado Cash transfers beginning October 28 and that code resembling the eventual attack mechanism was tested before the main operation.
On October 29, the first identified suspicious outflows began around 20:05 UTC on the XRP Ledger.
Additional transfers appeared on Solana and Optimism shortly afterward.
At around 20:20 UTC, approximately 18,270 BTC left a Binance Bitcoin wallet.
Within minutes, major transfers involving USDT, ETH and other digital assets followed across Ethereum and Tron.
The most damaging activity took place within a concentrated period of approximately 20 minutes, according to TRM Labs, although additional suspicious movements continued afterward.
Some early on-chain analyses tracked affected transactions across nine networks, while TRM’s broader investigation identified ten.
Who Is Suspected of Hacking Binance?
TRM Labs has attributed the attack to TraderTraitor, a North Korean state-sponsored hacking operation.
The firm’s assessment was based on blockchain transaction patterns and other intelligence indicators.
TraderTraitor was previously named by the FBI in connection with the February 2025 Bybit attack.
The suspected operation is linked to a broader history of North Korean cryptocurrency theft involving advanced social engineering, compromised infrastructure and sophisticated movement of stolen digital assets.
Investigators identified several patterns consistent with previous attacks, including advance preparation, staged malicious transactions, rapid asset withdrawals and efforts to obscure the movement of funds.
However, attribution by blockchain intelligence companies is not the same as a completed criminal investigation or judicial finding.
Binance has not publicly established the identities of the individual attackers.
The suspected North Korean connection remains an intelligence assessment while law enforcement and forensic teams continue their work.
What Did Binance Founder Changpeng Zhao Say?
Changpeng Zhao, widely known as CZ, acknowledged the apparent attack in a public statement on October 29.
Zhao said it appeared that Binance had been hacked and praised Tether and Circle for quickly freezing affected stablecoin assets.
He also clarified that he no longer manages Binance’s operations.
Speaking from his position as a shareholder, Zhao said he expected users to be fully covered.
His early post referred to approximately $971 million frozen by Tether and $823 million by Circle.
Those numbers reflected the initial response rather than the final amounts identified by investigators.
Tether subsequently reported freezing more than $1.567 billion in USDT.
Zhao’s remarks reinforced Binance’s stated commitment to protecting customer balances, but an assurance of coverage should be distinguished from independent verification that all losses have already been restored.
What Did Binance Leadership Say About Customer Funds?
Binance co-founder Yi He said that user funds were safe and that the exchange would cover all hacking-related losses.
Co-CEO Richard Teng also communicated directly with users, explaining that Binance was investigating multiple aspects of the incident.
The company temporarily suspended withdrawals while reviewing its security systems and withdrawal-address infrastructure.
In a subsequent update, Binance said deposits were operating normally and that withdrawals were expected to resume after the security review, with an initial timeframe of around 48 hours.
Service status can change rapidly during an active incident, so users should verify current availability through Binance’s official channels.
How Will Binance Cover the $6.3 Billion Loss?
On October 30, Binance said it had allocated more than $6.34 billion in company resources to address the incident.
The exchange said approximately $5 billion was already held in the exact cryptocurrency assets needed to replenish affected balances.
It also indicated that remaining assets would be acquired to match the relevant liabilities.
Those company resources are separate from the approximately $3 billion of affected cryptocurrency that Binance said had been frozen with industry assistance.
Binance also referred to its Secure Asset Fund for Users, or SAFU, as part of its emergency response.
The SAFU fund is a reserve designed to address qualifying extraordinary incidents affecting customer assets.
However, its approximately $1 billion historical size is considerably smaller than the total reported hack.
The more important question is therefore whether Binance can demonstrate sufficient independently verifiable assets to support all customer liabilities.
Binance has promised an updated Proof of Reserves after remediation.
How Much of the Stolen Crypto Has Been Frozen?
The response to the theft highlighted the significant role stablecoin issuers can play during a cryptocurrency security crisis.
Tether froze more than $1.5 billion in affected USDT, according to CEO Paolo Ardoino.
Circle, led by CEO Jeremy Allaire, froze more than $800 million in USDC associated with the incident.
Other reported responses involved Ripple’s RLUSD, World Liberty Financial’s USD1 and additional token issuers.
Arbitrum’s Security Council also took emergency action concerning affected assets on its network.
TRM’s initial tracing identified approximately $2.7 billion in frozen or secured assets, while Binance later reported around $3 billion frozen.
The exact amount depends on when the figures were measured and which freezing or recovery actions are included.
Critically, frozen assets may remain in attacker-controlled addresses even though the attacker can no longer transfer them.
Legal, technical and operational steps may still be necessary before they can be returned.
Where Did the Hacker Send the Stolen Funds?
Blockchain investigations show that attackers distributed assets among multiple addresses rather than leaving the entire amount in one wallet.
TRM Labs identified Bitcoin movements involving 18,270 BTC that were subsequently split into smaller address balances.
On Ethereum, attackers used decentralized exchanges and other blockchain financial infrastructure to convert certain stolen stablecoins and tokens into ETH.
Elliptic reported that the attacker exchanged hundreds of millions of dollars in stablecoins before freezing actions prevented additional movement.
These conversions are important because native cryptocurrencies such as Bitcoin and Ethereum generally do not have centralized issuers capable of freezing balances at a particular address.
Investigators also observed activity involving decentralized trading platforms and borrowing protocols.
The use of a platform does not establish that the platform or its operators participated knowingly in the crime.
What Are the Main Wallet Addresses Investigators Are Tracking?
One key Binance Ethereum hot wallet identified in the investigation is:
0x28c6c06298d514db089934071355e5743bf21d60
This address is associated with Binance’s own hot-wallet infrastructure and should not be confused with the attacker’s receiving wallet.
Investigators are also monitoring a series of recipient and intermediary addresses across Ethereum, Bitcoin, Tron and other networks.
Because assets are actively being moved, a static list of addresses can become incomplete very quickly.
For current transaction-level evidence, readers can consult the blockchain intelligence investigations linked below.
Wallet attribution requires care: an address receiving funds from an attacker is not necessarily owned by the attacker, and transfers through decentralized applications do not automatically prove criminal involvement by their operators.
Why Did the Hackers Convert Stablecoins Into Bitcoin and Ethereum?
Centralized stablecoins such as USDT and USDC have administrative controls that can allow their issuers to freeze particular token balances under defined circumstances.
Bitcoin and native Ether do not provide equivalent issuer-level freezing functions.
That difference creates an incentive for attackers to exchange stolen stablecoins for other assets before enforcement actions are implemented.
Elliptic reported that substantial amounts were exchanged rapidly, sometimes at unfavorable prices.
The apparent objective was to prioritize control of funds and avoid freezes rather than obtain the best available exchange rate.
This is one of the most important lessons from the incident: blockchain transparency can make stolen funds visible, but visibility does not automatically make them recoverable.
What Are Other Cryptocurrency Industry Leaders Saying?
Several prominent industry executives and companies participated in or commented on the response.
Tether CEO Paolo Ardoino publicly confirmed major USDT freezing activity.
Circle CEO Jeremy Allaire confirmed that Circle had frozen more than $800 million in USDC in cooperation with relevant authorities.
Those actions showed how centralized stablecoin operators can intervene rapidly when assets associated with a major exchange theft are identified.
Conor Grogan, a senior director and product leader at Coinbase, was also among the industry figures tracking the size of suspicious outflows during the early stages of the incident.
His preliminary estimates helped illustrate how quickly blockchain analysts were identifying the extent of the transfers.
However, preliminary estimates from industry observers should not be confused with formal company statements.
At the time of this report, Cryptopian News could not independently verify direct public responses from Coinbase CEO Brian Armstrong, Bybit CEO Ben Zhou or OKX founder Star Xu specifically addressing the Binance incident.
We are therefore not attributing comments to those executives without verified statements.
Why Is This Hack a Major Challenge for Centralized Exchanges?
Centralized cryptocurrency exchanges simplify digital asset trading by holding customer assets and managing large-scale transaction infrastructure.
That structure can offer convenience, deep liquidity and account-management services.
It also creates concentration risk.
When a single platform controls significant assets through connected operational systems, a successful compromise can expose enormous balances.
The Binance incident demonstrates that security challenges extend beyond the protection of private keys.
Withdrawal approvals, internal software access, employee devices, cloud systems, transaction-signing services and emergency response procedures all form part of the security perimeter.
An exchange may use strong cryptography while still remaining vulnerable to failures in the systems that authorize how that cryptography is used.
What Does the Hack Reveal About Proof of Reserves?
Proof of Reserves is commonly used by centralized exchanges to demonstrate that they hold digital assets associated with customer balances.
But a reserve snapshot is not a permanent guarantee that assets remain available after an unexpected loss.
CoinDesk’s review of Binance’s earlier reserve data indicated that some drained wallets were included in the assets backing customer balances.
The report estimated that the ETH outflows could temporarily reduce Binance’s reported ETH backing below full coverage if replacement assets were not supplied.
That is not equivalent to a finding that the company is insolvent.
It does, however, illustrate why real-time custody controls, transparent liabilities, reserve verification and independently supportable financial resources matter.
Binance’s promised post-incident reserve update will be an important step in evaluating its recovery claims.
How Does the Binance Hack Compare With Bybit’s 2025 Attack?
The February 2025 Bybit incident resulted in approximately $1.5 billion in stolen cryptocurrency and was attributed by U.S. authorities to North Korean-linked hackers.
The October 2026 Binance theft is approximately four times larger.
Both incidents illustrate the risks associated with high-value cryptocurrency custody operations.
However, the reported technical methods are not identical.
The Binance incident includes allegations of compromised internal operational infrastructure and unauthorized transaction-signing activity.
These differences reinforce the need for security controls tailored to each exchange’s architecture rather than relying on one general security solution.
How Did Bitcoin and the Crypto Market React?
The news triggered a broader cryptocurrency market selloff as traders evaluated the scale of the theft and potential effects on exchange liquidity.
Early reporting showed Bitcoin trading below $79,000, with Ethereum and BNB also recording declines.
Cryptocurrency prices were moving rapidly during the incident, and the market reaction could not be attributed exclusively to the hack without considering broader trading conditions.
The deeper market concern is whether a major exchange can restore confidence in its operational security while managing short-term withdrawal restrictions and asset replacement.
What Should Binance Users Do Now?
Binance users should follow official announcements regarding withdrawals, deposits and security remediation.
They should also be alert to phishing attempts that exploit public anxiety surrounding the incident.
Fraudsters may impersonate exchange support staff and claim that users must verify their wallets, transfer assets or disclose recovery phrases to receive compensation.
Users should never provide wallet recovery phrases, private keys or account authentication codes in response to unsolicited messages.
Requests to transfer funds to a supposed recovery wallet should be treated as suspicious.
Account holders should also review their login security, withdrawal address protections and account activity through verified Binance services.
What Happens Next in the Investigation?
Several unanswered questions will determine the long-term significance of this attack.
Investigators must establish the complete compromise pathway, including how attackers gained transaction-authorization capabilities and why existing controls did not prevent the withdrawals.
The exchange must demonstrate whether all customer liabilities remain fully backed and when normal withdrawal operations can safely resume.
Law enforcement and blockchain intelligence teams will continue tracing funds that escaped stablecoin freezing.
Meanwhile, attention will turn to whether this incident produces stronger industry standards for hot-wallet authorization, internal access controls and coordinated emergency responses.
Cryptopian News Analysis: The Real Security Failure Is Bigger Than One Exchange
The most significant lesson from the Binance hack is not simply the amount stolen.
It is the apparent ability of an attacker to manipulate infrastructure responsible for authorizing high-value transactions.
That is a systemic security problem for any organization holding significant cryptocurrency balances.
In conventional finance, multiple operational, legal and institutional mechanisms may intervene when unauthorized transfers are detected.
Blockchain networks can settle authorized transactions rapidly and irreversibly, making prevention at the authorization layer especially important.
The industry’s coordinated freezing response demonstrated that certain digital assets can be immobilized quickly.
At the same time, the rapid conversion of stablecoins into non-freezable assets revealed the limitations of that response.
For centralized exchanges, stronger internal authorization systems, continuous monitoring, compartmentalized access and independently verifiable reserves are becoming essential requirements.
For users, the incident reinforces the importance of understanding custody arrangements and the risks associated with leaving substantial assets on any single exchange.
Final Verdict
The Binance hack of October 29, 2026, is one of the most significant security incidents in cryptocurrency history.
Approximately $6.3 billion in digital assets was affected, hundreds of tokens were involved, and blockchain intelligence companies have attributed the operation to suspected North Korean hackers.
Binance says it will cover customer losses and has allocated significant company resources toward restoring affected balances.
Around $3 billion has been frozen, but a substantial quantity of cryptocurrency remains beyond issuer-level freezing mechanisms.
The final impact will depend on successful asset recovery, demonstrated customer coverage and the findings of Binance’s forthcoming technical investigation.
The incident has already exposed serious questions about centralized cryptocurrency custody and the security of systems that control digital asset withdrawals.
Cryptopian News will continue monitoring official updates, blockchain intelligence findings and the status of affected cryptocurrency assets.
Editor’s note: This report reflects information available on October 30, 2026. Loss estimates, frozen balances, wallet movements and service status may change as investigations continue.
Primary sources and verification
These are the most important sources to link from the published article:
- Binance — Official Security Incident Update — the exchange’s incident estimate, initial technical findings and reimbursement commitment. Binance Support
- TRM Labs — Binance Hack Investigation — suspected attacker attribution, affected chains, asset quantities and attack timeline. TRM Labs
- Elliptic — Stolen Funds and Blockchain Analysis — individual cryptocurrencies, tracing findings and frozen asset estimates. Elliptic
- Bitquery — On-Chain Wallet and Transaction Investigation — detailed wallet movements and transaction records. Bitquery
- Reuters — Binance’s $6.34 Billion Coverage Plan — latest company funding commitments. Reuters
- BleepingComputer — Richard Teng’s Technical Clarification — additional breach points and the ongoing investigation. BleepingComput
With $388M hacked, Bitget resumes Bitcoin Withdrawals After Stolen Crypto Moves.
Inside the $21M Solana DEXX Hack: Insights from the SlowMist Report
Google Cloud’s Crypto Security Technology Could Change How Institutions Protect Digital Assets
Disclaimer: This article provides news and general information, not financial, legal or cybersecurity advice.
- Binance $6.3 Billion Hack: North Korean Group Suspected as Bitcoin, Ethereum, XRP and Stablecoins Are Stolen - October 30, 2026
- Wall Street Goes On-Chain as DTCC Launches Tokenization Service - October 29, 2026
- CFTC Moves Toward New US Crypto Trading Rules: What Could Change for Exchanges? - October 28, 2026