Binance suffered an unprecedented $6.3 billion cyber attack on October 29, 2026, marking the largest theft in cryptocurrency history. Blockchain intelligence firms and federal authorities attribute the breach to TraderTraitor, a North Korean state-sponsored unit. Although attackers exploited infrastructure weaknesses and smart contract delegations, issuers managed to freeze roughly $3 billion in stablecoins. Binance leadership pledged to cover all remaining losses using internal reserves and SAFU funds.
Scope and method of the hack
- ▪The $6.3 billion hack on Binance involved assets drained across 10 blockchains, with the majority transferred in a 20-minute burst starting around 20:05 UTC on October 29, 2026
- ▪Binance suffered a security breach draining an estimated $6.3 billion to $6.4 billion, marking the largest crypto theft on record
- ▪Binance initially stated that the $6.3 billion attack involved a compromised DevOps engineer's laptop, but later investigation revealed additional points of breach in its hot wallet signing infrastructure
- ▪TRM Labs reported that the attacker prepared for the $6.3 billion Binance theft at least 36 hours in advance, funding operational wallets via Tornado Cash and utilizing Ethereum EIP-7702 delegation authorizations
Status of stolen assets
- ▪Cryptocurrency issuers and security teams froze approximately $2.67 billion to $3 billion in stablecoins and tokens, including USDT and USDC, following the $6.3 billion Binance hack on October 29, 2026
- ▪TRM Labs noted that the attacker behind the $6.3 billion Binance hack retained over $2.4 billion in Bitcoin and Ether that cannot be frozen by token issuers
Binance response to the attack
- ▪Binance suspended asset withdrawals while initiating a security revamp following the $6.3 billion hack, with leadership anticipating the restoration of withdrawals within 48 hours
- ▪Binance pledged to cover all customer losses, reserving over $6.34 billion in company funds and utilizing its $1.2 billion Secure Asset Fund for Users (SAFU)
Law enforcement response
- ▪The United States Department of Justice acknowledged reports about the $6.3 billion Binance cyber attack but declined to comment on investigations
- ▪The Federal Bureau of Investigation and the Secret Service launched investigations into the $6.3 billion Binance cyber theft in coordination with private sector partners
Attribution to North Korean hackers
- ▪The FBI previously attributed a $1.5 billion hack against crypto exchange Bybit in February 2025 to North Korea's TraderTraitor group
- ▪Chainalysis and investigator ZachXBT observed funds stolen in the $6.3 billion Binance hack commingling with proceeds from a September 2026 Bitget exploit linked to North Korean actors
- ▪Blockchain intelligence firms TRM Labs, Chainalysis, and Pangolin Intelligence attributed the $6.3 billion Binance hack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit
Story comments
Loading comments…