The theft and Binance's response
The attack began at 20:05 UTC on October 29, 2026, according to blockchain analytics firm TRM Labs. Within about 20 minutes, the attackers moved most of the stolen funds. TRM traced transfers from Binance wallets across ten blockchains to addresses under one attacker's control: the XRP Ledger, Ethereum, Bitcoin, Tron, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
The exchange and analytics firms put the theft at approximately $6.3 billion, or about €5.63 billion. Analysts said stablecoins, including Tether and USD Coin, accounted for most of the haul, alongside Bitcoin and Ether. Stablecoins are tied in value to traditional currencies.
Binance initially halted both deposits and withdrawals. In a subsequent update, it said deposits were operating normally, but withdrawals remained suspended while it overhauled the withdrawal service and associated addresses. It expected withdrawals to resume within 48 hours.
The company said customer balances were safe and promised to cover every loss through its Secure Asset Fund for Users, known as SAFU, and company funds. It also committed to publishing updated proof of reserves after completing the remedial work.
A record loss and a market sell-off
The theft far exceeds the previous record for an exchange hack: the roughly $1.5 billion stolen from Bybit in early 2025. Another major case, the 2014 attack on Japan's Mt. Gox, involved about 850,000 bitcoins, then worth approximately $450 million, and ultimately led to that exchange's insolvency.
News of the Binance breach triggered panic selling. Bitcoin briefly dropped below $77,000, reaching its lowest level in about six weeks. Other major cryptocurrencies and Binance's BNB token also fell sharply. Forced closures of leveraged derivatives positions produced liquidations worth millions of dollars.
Investigators examine the signing system
Binance's preliminary investigation pointed to a potentially compromised laptop belonging to an engineer in its development department. Investigators considered whether the attackers used that device to reach a service computer and initiate unauthorized withdrawals. Binance said it had found no evidence that private wallet keys had leaked and was examining possible manipulation of its signing infrastructure.
Co-CEO Richard Teng said on October 30 that investigators had identified "additional points of breach" beyond the initially suspected DevOps engineer's laptop. He described "a more complex attack process," rather than a single "one-click" action, and said the investigation had not assigned responsibility to any individual. Binance plans to release fuller technical findings after the forensic work is complete.
TRM's blockchain analysis identified preparations stretching back at least 36 hours before the theft. Starting on the morning of October 28, the operator's wallet received three small transfers from Tornado Cash, a cryptocurrency mixing service. Early the next day, the operator tested an initial version of the attack code on two wallets. A later rehearsal used a third wallet; four hours afterward, the same code was installed on a Binance hot wallet.
On Ethereum, TRM found that an EIP-7702 delegation had converted a Binance hot wallet into an attacker-controlled "sweeper" contract. The operation used 50 authorizations signed in advance. TRM interpreted that finding as evidence of a breach of Binance's hot-wallet signing infrastructure, rather than a leaked private key.
Evidence pointing to North Korean hackers
TRM attributes the attack to TraderTraitor, a North Korean hacking group also blamed for the Bybit theft. According to its analysis, the attackers moved most of the Binance funds within 20 minutes to stay ahead of authorities' efforts to freeze them.
The firm identified similarities to both Bybit and the April 2026 KelpDAO hack, another theft linked to North Korea. Separately, Chainalysis reported seeing stolen Binance assets mixed in real time with funds from the previous month's Bitget exploit, which had also been attributed to North Korean actors.
Elliptic chief scientist and cofounder Tom Robinson emphasized the scale of the theft in comments to WIRED. If North Korea was responsible, he said, this heist "would almost double everything the regime has stolen in crypto to date."
Billions frozen, but substantial funds remain out of reach
Binance said partners and stablecoin issuers had helped freeze about $3 billion in stolen assets. Analysts offered differing estimates of the amount immobilized and the funds still available to the attackers.
TRM put the frozen total at roughly $2.7 billion. Its breakdown attributed about $2.67 billion in stablecoin freezes to Tether, Circle, Ripple and World Liberty Financial. The Arbitrum Security Council separately froze 8,426 ETH and 74.6 million ARB on its network, together worth about $30 million.
TRM estimated that the attackers retained more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond the reach of issuers' freezing powers and inaccessible to Binance. The researchers could not account for the rest of the stolen sum.
To get ahead of the freezes, TRM said, the attackers sold about 325 million USDT to market makers in exchange for roughly 122,300 ETH, accepting a discount of more than 10%. They also borrowed ETH on the Aave lending protocol using USDT as collateral.
Elliptic's Robinson gave WIRED a separate estimate: approximately $2.8 billion, or 44% of the stolen total, had been frozen. He put the remaining amount at roughly $3.3 billion, mostly in Bitcoin, Ether and XRP, which cannot be frozen.
Leadership and regulatory scrutiny
Binance is the world's largest cryptocurrency exchange, handling billions of dollars in daily transactions and holding digital assets for millions of customers. Its opaque corporate structure and lack of a fixed headquarters complicate regulatory oversight.
Founder Changpeng Zhao, widely known as "CZ," quickly took to X to reassure customers and promise full compensation. Although he formally left the chief executive role following earlier US regulatory scandals and a guilty plea, he remains Binance's principal owner, its public symbol and its dominant decision-maker. Critics allege that the company's opaque structure and inadequate security precautions may have helped make the attack possible.
In Europe, Binance has faced criticism for continuing to serve customers without a license under the EU's Markets in Crypto-Assets regulation, or MiCA. As of October 1, 2026, the European Securities and Markets Authority and national regulators in France, Germany and Greece were examining its reliance on the "reverse solicitation" exemption. Possible enforcement measures include fines.
Binance's local licenses in France, Spain and Poland had lapsed under MiCA. Customers in other EU countries were being served through its Abu Dhabi entity, which has been regulated there since December 2025.
