Figure 1. The $6.3 Billion Binance Hack (October 2026): An Infographic. Jeremy Swenson.
On Thursday night, the world’s largest cryptocurrency exchange suffered what is now the largest theft in the industry’s history. Roughly $6.3 billion in digital assets left Binance’s hot wallets in a matter of minutes, more than four times the $1.5 billion taken from the exchange Bybit in February 2025, the previous record.[1] What follows is what we know so far, what it means for customers, including users of Binance.US, and the lessons that security, risk, and finance leaders should take from it.
What Happened
On the evening of October 29, on-chain researchers began flagging unusually large outflows from Binance wallets. Within the hour, Binance co-founder Changpeng Zhao acknowledged publicly that the activity looked like a hack, and the exchange paused withdrawals across multiple networks.[2] The blockchain analytics firm TRM Labs estimates that approximately $6.36 billion was moved out of Binance wallets across ten blockchains, most of it within about twenty minutes.[3] Binance’s own estimate puts the total impact at about $6.3 billion, and the company has cautioned that the figure may rise as tracing continues.[4]
Figure 2. Timeline of the Binance hack, October 29–November 2, 2026. Times are approximate and in Coordinated Universal Time (UTC); reported times differ across sources. Graphic by author. Data from Crypto Times, HackenProof, Bloomingbit, and statements by Binance, Tether, Circle, and the Arbitrum Security Council.
How the Attackers Got In
Binance’s first explanation pointed to a single entry point: a compromised laptop belonging to a DevOps engineer, which reportedly allowed the attacker to reach a service container and submit unauthorized withdrawal transactions.[5] That picture has since grown more complicated. Co-CEO Richard Teng has said the breach was not a one-click event but a more complex, multistage attack, and Binance’s investigators have identified additional points of breach beyond the laptop.[6] Teng also stated that the team had found no evidence that any wallet private keys were leaked.[7]
Not every analysis aligns neatly with that account. The security firm Blockaid’s incident report indicates that eleven Binance hot-wallet keys signed the outgoing transfers, which raises the question of whether the attacker abused Binance’s signing infrastructure rather than stealing keys outright.[8] Binance has promised a full technical post-mortem once its investigation is complete, and that report should reconcile the competing accounts.[9]
Who Is Behind It
Neither Binance nor the FBI has formally attributed the attack.[10] Two prominent analytics firms, however, point in the same direction. TRM Labs links the theft to a North Korean state-sponsored group, citing hallmarks of earlier operations attributed to that country, including long preparation and transaction signatures obtained in advance.[11] Elliptic likewise assesses North Korea as the likely culprit and reports that some of the stolen funds reached an address connected to the laundering of a suspected North Korean exploit of the exchange Bitget, though Elliptic notes that this establishes a shared laundering network rather than proving a single attacker.[12] According to a person familiar with the matter cited by Reuters, Binance is working with the FBI and the U.S. Secret Service.[13]
The Industry’s Freeze Response
One of the most striking features of this episode is how quickly the rest of the industry moved. Because a large share of the stolen funds were stablecoins, their issuers were able to freeze them on-chain:[14]
- Tether froze more than $1.56 billion in USDT linked to the incident.[15]
- Circle froze more than $800 million in USDC, in coordination with law enforcement.[16]
- Ripple froze roughly $200 million, and World Liberty Financial, working with the custodian BitGo, froze stablecoins and its own tokens.[17]
- Arbitrum’s Security Council froze about $30.5 million on its network, and the lending protocol Aave froze its Avalanche markets.[18]
Elliptic reports that stablecoins accounted for about $3.46 billion of the stolen funds and that the attacker was slow to convert them, which gave issuers a window in which to act. The firm has independently verified about $2.84 billion of frozen funds on-chain, close to Binance’s estimate of roughly $3 billion.[19] Binance has not said what has become of the remaining $3.3 billion.[20]
Figure 3. Status of the stolen assets and comparison with earlier major exchange hacks, in billions of U.S. dollars. Freeze amounts are as reported by issuers and Binance and do not sum precisely to Binance’s ~$3 billion estimate. Graphic by author. Data from Binance, Tether, Circle, Reuters, Elliptic, TRM Labs (via CNBC), Al Jazeera, and Ynet News.
Were Customer Funds Stolen?
Binance maintains that customers will not lose money. Teng has said the incident was confined to the exchange’s own hot wallets and that customer assets are managed under a separate security system; Binance says it has secured more than $6.34 billion of company funds to cover the losses in full.[21] That sum is more than six times the size of Binance’s roughly $1 billion Secure Asset Fund for Users (SAFU), the emergency reserve created in 2018 for exactly this kind of event.[22] The company has not detailed where the additional funds came from, but it plans to publish a full proof-of-reserves report by November 2.[23]
In the near term, customers are feeling the effects through access rather than balances. Withdrawals remain suspended while Binance rebuilds its withdrawal system, and the company expects to restore them by Sunday, November 1.[24] Early messaging was also inconsistent: Binance insisted that user funds were completely safe while simultaneously pledging to cover all losses, a combination that understandably confused users.[25] Analysts at Fundstrat Global Advisors say the breach does not currently appear to pose a meaningful solvency risk to an exchange that reported about $162.8 billion in assets under custody and 335 million registered users as of its 2025 annual report.[26]
What About Binance.US?
Binance.US, which operates as a separate company, has said it was not affected, and Coinbase likewise reported no impact on its operations.[27] The one caveat concerns Americans who access the global Binance exchange in spite of its geographic restrictions, for example through a virtual private network; they are in the same withdrawal queue as every other global user.[28]
Market Impact
The hack struck an already fragile market. Bitcoin fell toward $77,000, ether dropped by nearly 6 percent, and Binance’s native BNB token slid by nearly 10 percent.[29] The market maker GSR reported that bid–ask spreads on spot bitcoin at Binance were about five times wider than normal early Friday, a sign of thin liquidity as traders pulled back.[30]
Five Takeaways for Leaders
1. The most privileged endpoints are the biggest attack surface. A single engineer’s laptop appears to have provided an early foothold into systems controlling billions of dollars. Developer and DevOps endpoints deserve the same scrutiny as production infrastructure.
2. Key security is not the same as signing security. Even if no private keys leaked, an attacker who can push transactions through a legitimate signing pipeline can do enormous damage. Authorization logic, withdrawal limits, and anomaly detection along the signing path matter as much as key custody.
3. Centralized controls cut both ways. The ability of Tether, Circle, and others to freeze roughly $3 billion is the main reason this was not a total loss. It is also a reminder that stablecoins carry issuer-level control: a feature in a crisis and a policy debate the rest of the time.
4. Counterparty risk is real, even at the top. If the world’s largest exchange can be breached, institutions and individuals alike should know where their assets sit, who holds the keys, and what happens contractually when something goes wrong.
5. Expect regulation to follow. Industry voices, including the head of Franklin Templeton’s crypto business, are already calling for stronger cybersecurity rules.[31] A theft of this scale gives policymakers fresh momentum on custody standards, proof-of-reserves requirements, and mandatory incident disclosure.
The Bottom Line
Binance appears to have the balance sheet to absorb this loss, and a coordinated industry response froze nearly half of the stolen funds within hours. Yet the largest crypto theft in history occurred at the platform best resourced to prevent it. The forthcoming post-mortem will be one of the most important security documents the industry has produced, and it deserves close reading. How is your organization thinking about custody and counterparty risk after this week? I would welcome your perspective in the comments.
About The Author
Jeremy A. Swenson is a disruptive-thinking security entrepreneur, futurist/researcher, and seasoned senior management technology risk and digital strategy consultant. His experience spans healthcare, retail, financial services, high technology, and government. He is a frequent speaker and published writer, and he also does some pro bono consulting in these areas. He holds a certificate in Media Technology Policy from Oxford University’s Media Policy Summer Institute, an MSST (Master of Science in Security Technologies) degree from the University of Minnesota’s Technological Leadership Institute (TLI), an MBA from Saint Mary’s University of Minnesota, and a BA in political science from the University of Wisconsin Eau Claire. He is an alum of the Federal Reserve Secure Payment Task Force, the Crystal, Robbinsdale, and New Hope Community Police Academy (MN), as well as the Minneapolis FBI Citizens Academy. You can follow him on LinkedIn and Twitter. You can contact him for speaking, media, or consulting engagements via his website here: https://jeremy-swenson.com/
Endnotes
[1]Ravie Lakshmanan, “Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen,” The Hacker News, October 30, 2026, accessed October 30, 2026, https://thehackernews.com/2026/10/binance-suffers-security-breach.html; “Binance Hit by Record $6.3 Billion Crypto Hack: ‘This Was a Complex Attack,’ Says Co-CEO,” Yahoo Finance, October 30, 2026, accessed October 30, 2026, https://finance.yahoo.com/markets/article/bitcoin-drops-to-76000-as-binance-hack-spooks-investors-tether-circle-freeze-assets-083406383.html.
[2]“Binance Hack: How CZ, Coinbase, Tether and 70+ Crypto Leaders Reacted to the $6.3B Theft,” Crypto Times, October 30, 2026, accessed October 30, 2026, https://www.cryptotimes.io/2026/10/30/binance-hack-how-cz-coinbase-tether-and-70-crypto-leaders-reacted-to-the-6-3b-theft/; “Binance Pauses Withdrawals as Hackers Suspected of Stealing Billions in Crypto,” TechCrunch, October 29, 2026, accessed October 30, 2026, https://techcrunch.com/2026/10/29/binance-pauses-withdrawals-as-hackers-suspected-of-stealing-billions-in-crypto/.
[3]“Binance’s $6.3 Billion Hack: What We Know and What Comes Next,” CNBC, October 30, 2026, accessed October 30, 2026, https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html.
[4]“Binance Targeted in $6.3 Billion Crypto Heist, the Largest Ever,” NBC News, October 29, 2026, updated October 29, 2026, accessed October 30, 2026, https://www.nbcnews.com/business/markets/binance-hack-tether-circle-stablecoins-rcna606445.
[5]Lakshmanan, “Binance Suffers Security Breach.”
[6]Agence France-Presse, “Crypto Platform Binance Confirms ‘Complex’ $6.3 bn Hack,” Yahoo Finance, October 30, 2026, accessed October 30, 2026, https://finance.yahoo.com/markets/crypto/articles/crypto-platform-binance-confirms-major-013059975.html; “Binance Hack: What We Know About the $6.3B Breach,” HackenProof (blog), October 30, 2026, accessed October 30, 2026, https://hackenproof.com/blog/binance-hack.
[7]“Binance Hack: Teng Says No Private Key Leaked, and Blockaid Says Eleven Binance Keys Signed the Transfers,” FinanceFeeds, October 30, 2026, accessed October 30, 2026, https://financefeeds.com/binance-hack-eleven-keys-signed-no-leak/.
[8]“Teng Says No Private Key Leaked.”
[9]“Binance Hit by $6.3 Billion Theft in What Could Be the Biggest Crypto Heist on Record,” Help Net Security, October 30, 2026, accessed October 30, 2026, https://www.helpnetsecurity.com/2026/10/30/binance-crypto-hack/.
[10]“Binance Hack: What the $6.3 Billion Theft Means for US Crypto Users,” BreezyScroll, October 30, 2026, accessed October 30, 2026, https://www.breezyscroll.com/money/binance-hack-crypto-assets-frozen.
[11]“What We Know and What Comes Next.”
[12]Elliptic, “The Largest Theft in History: North Korea Likely Behind the $6.4 Billion Binance Hack,” Elliptic Insights, October 30, 2026, accessed October 30, 2026, https://www.elliptic.co/insights/binance-largest-hack-in-history/.
[13]Reuters, “Hackers Steal $6.3 Billion from Binance in Record Heist Blamed on North Korea,” Yahoo Finance, October 30, 2026, accessed October 30, 2026, https://finance.yahoo.com/markets/crypto/articles/tether-circle-freeze-2-38-222607515.html.
[14]“Binance Hit by $6.3 Billion Theft.”
[15]“Binance Targeted in $6.3 Billion Crypto Heist.”
[16]“Binance Hit by $6.3 Billion Theft.”
[17]Reuters, “Hackers Steal $6.3 Billion from Binance.”
[18]“What We Know About the $6.3B Breach.”
[19]Elliptic, “Largest Theft in History.”
[20]“Binance Says $6.3bn Stolen in Biggest Crypto Heist in History: What We Know,” Al Jazeera, October 30, 2026, accessed October 30, 2026, https://www.aljazeera.com/news/2026/10/30/binance-says-6-3bn-stolen-in-biggest-crypto-heist-in-history-what-we-know.
[21]“Binance CEO Says Full Proof-of-Reserves Report Due Nov. 2, Pledges Full Compensation for Hack Losses,” Bloomingbit, October 30, 2026, accessed October 30, 2026, https://en.bloomingbit.io/feed/news/123309.
[22]“Binance Says $6.3bn Stolen.”
[23]Reuters, “Hackers Steal $6.3 Billion from Binance.” “Binance CEO Says Full Proof-of-Reserves Report Due Nov. 2.”
[24]“Binance CEO Says Full Proof-of-Reserves Report Due Nov. 2.”
[25]Agence France-Presse, “Binance Confirms ‘Complex’ $6.3 bn Hack.”
[26]“What We Know and What Comes Next.” Reuters, “Hackers Steal $6.3 Billion from Binance.”
[27]“Binance Reports $6.3 Billion Crypto Breach, Potentially the Biggest Hack in History,” Ynet News, October 30, 2026, accessed October 30, 2026, https://www.ynetnews.com/business/article/bjmb5f11tme; “Binance Hack Update: $6.3B Impact, $3B Frozen After DevOps Laptop Breach,” Crypto Times, October 30, 2026, accessed October 30, 2026, https://www.cryptotimes.io/2026/10/30/binance-hack-6-3b-impact-3b-frozen-after-devops-laptop-breach/.
[28]“What the $6.3 Billion Theft Means for US Crypto Users.”
[29]“Live Updates: Bitcoin Falls to $77,000 as Binance Exploit Combines with Tech Woes,” CoinDesk, October 30, 2026, accessed October 30, 2026, https://www.coindesk.com/markets/2026/10/30/live-news-binance-hack-rattles-crypto-as-intel-plunges-and-ai-spending-fears-hit-tech; Agence France-Presse, “Binance Confirms ‘Complex’ $6.3 bn Hack.”
[30]Reuters, “Analysts React as Binance Freezes Assets after $6.3 Billion Security Breach,” Euronext Financial News, October 30, 2026, accessed October 30, 2026, https://live.euronext.com/en/financial-news/analysts-react-binance-freezes-assets-after-63-billion-security-breach.
[31]Chris Perkins, “Binance Hack Reveals Need for Stronger Cybersecurity Regulation,” interview, CNBC, video, October 30, 2026, accessed October 30, 2026, https://www.cnbc.com/video/2026/10/30/binance-hack-calls-for-stronger-cybersecurity-regulation-perkins.html.
