Binance Hack 2026: $6.3 Billion Stolen in the Largest Crypto Theft on Record

The Binance hack 2026 is now the largest cryptocurrency theft ever recorded. On Thursday, October 29, attackers drained an estimated $6.3 billion from the world’s biggest crypto exchange in about 20 minutes. Binance says it will cover every customer loss, roughly $3 billion of the stolen assets have been frozen, and investigators are already pointing at North Korea. If your business holds any crypto on any exchange, this is the moment to check your balances and tighten your security. Here is what happened, what is confirmed, and what to do next.

What happened: $6.3 billion gone in about 20 minutes

According to TRM Labs, the bulk of the transfers began at about 4:05 p.m. Eastern on Thursday, October 29, and most of the money was gone within roughly 20 minutes. The attackers emptied Binance’s hot wallets — the online wallets an exchange uses to pay out customers — across ten different blockchains. The haul included bitcoin, ether, and billions of dollars in the USDT and USDC stablecoins, among smaller tokens.

The exact total depends on who is counting and at what prices. Binance puts the impact at around $6.3 billion. TRM Labs, which traced each transfer on-chain, counts about $6.36 billion. Chainalysis revised its own estimate to roughly $5.9 billion at the time of the theft. Whichever figure survives, the scale is not in dispute: at roughly four times the $1.5 billion stolen from Bybit in February 2025, this is the largest crypto theft on record. Binance held about $144 billion in customer assets before the attack, according to DefiLlama data cited by CoinDesk.

How the attackers got in: one compromised laptop

This was not a failure of any blockchain. Binance’s initial investigation points to something much more ordinary: a compromised laptop belonging to one of its DevOps engineers. According to the BBC and CoinDesk, that laptop gave the attacker access to an internal service container, and from there the ability to submit unauthorized withdrawal transactions that Binance’s own systems then carried out. Binance says it found no evidence that any wallet private keys leaked, and on Friday it said investigators had found additional points of breach — so the full entry path is still being mapped.

That detail matters for every small business, not just Binance. The attackers did not break cryptography. They got inside one employee’s machine and used legitimate internal tools. The same pattern — one compromised staff device, one set of credentials with too much reach — is how most small companies get breached too.

Who did it? Investigators point to North Korea

Two blockchain intelligence firms, TRM Labs and Chainalysis, attribute the attack with high confidence to TraderTraitor, a North Korean state hacking unit linked to the Lazarus Group. Chainalysis said its assessment rests on links to a previous hack; TRM cited matching tactics, including the rehearsal-style test withdrawals and pre-obtained signatures seen in earlier operations. TraderTraitor is the same unit the FBI publicly blamed for the $1.5 billion Bybit theft in February 2025.

Treat this as a strong lead, not a settled fact. Binance has not named any attacker, no government agency has made a formal attribution, and Binance did not directly answer the BBC’s questions about a North Korea link. In the Bybit case, the FBI’s public attribution came five days after the theft.

What is frozen, what is covered, and when withdrawals reopen

Binance and its partners moved quickly to freeze what they could. Binance says about $3 billion of the stolen assets have been frozen on-chain so far. The biggest share came from the stablecoin issuers: the BBC reports that Tether and Circle together froze about $2.4 billion, and TRM’s tally of about $2.7 billion frozen by early Friday included roughly $1.77 billion in USDT and $825 million in USDC. Stablecoins can be frozen by their issuers; bitcoin cannot, and a large share of the stolen bitcoin and ether remains in wallets the attackers control.

For customers, the commitment is explicit. Binance co-CEO Yi He said the platform would cover “all hacking losses,” and the exchange told CoinDesk it has set aside more than $6.34 billion in company resources to restore customer balances, with $5 billion of that already held in the exact token assets that were taken. Withdrawals are paused while Binance finishes security checks; deposits remain open. Binance said it expected withdrawals to resume within about 48 hours of the pause.

One important distinction for US readers: Binance.US, the separate American company, said it was not affected. The hack hit Binance.com, the global platform, which does not serve US residents.

Update: Binance withdrawals resume in phase one on Sunday, November 1 – see the phase-one report for which networks are live and what is still not back.

Update: Binance phase two is live – see the phase-two proof-of-reserves report.

The market reaction

Crypto prices fell as the alerts spread. Bitcoin dropped more than 4%, sliding below $77,000 to a six-week low of about $76,368, and Binance’s own BNB token fell faster. The timing did not help: the theft landed a day after the Fed’s decision this week to hold interest rates steady, with risk assets already on edge. Bitcoin has since steadied above $77,000, but expect volatility while the frozen-versus-missing accounting continues.

What your business should do now if it holds crypto anywhere

You do not need a Binance account for the Binance hack 2026 to affect you. The lesson is about any exchange account holding business funds. Work through this checklist today:

1. Verify your balances everywhere. Log in to every exchange and wallet your business uses, confirm balances match your records, and screenshot or export statements. If an exchange pauses withdrawals during an incident, your own records are your evidence.
2. Upgrade account security to hardware-backed 2FA. SMS codes and authenticator apps are the floor, not the ceiling. Where your exchange supports passkeys or hardware security keys, turn them on for every team member with account access, and remove old devices and API keys you no longer use.
3. Shrink what sits on exchanges. Keep only the working float you need for near-term payments or trades on any platform. Move long-term holdings to self-custody — a hardware wallet with the recovery phrase stored offline, in two separate secure locations.
4. Prefer regulated US venues for business funds. For operating money, use an exchange with US licensing, published reserves, and a real business account — our comparison of the best crypto exchange for small business covers fees, business accounts, and security records side by side.
5. Protect the human layer. The entry point here was one employee’s laptop. Keep work devices patched, use a password manager with unique passwords per service, and limit which staff machines can reach financial accounts at all.
6. Keep tax records as you go. Exports of trades, deposits, and withdrawals from every platform, saved monthly, make year-end reporting far easier — and if an exchange ever freezes activity mid-incident, you will already have your numbers.

Conclusion

The Binance hack 2026 will be studied for years: a record $6.3 billion taken in minutes, through one compromised laptop, from the largest exchange in the industry. Binance’s promise to cover all losses means its customers should be made whole — but the next business may not be so lucky, and no exchange’s promise protects funds you hold elsewhere. Spend thirty minutes on the checklist above today. It is the cheapest insurance your crypto holdings will ever get.

For what changed next, see our Binance hack update.

Frequently Asked Questions

Sources

• BBC News — “Crypto giant Binance hit by $6.3bn hack suspected to be largest in history” (October 30, 2026): https://www.bbc.com/news/articles/cwg7xp8kx4v5o
• CoinDesk — “Binance arranges $6.34 billion to cover losses from biggest crypto hack ever” (October 30, 2026): https://www.coindesk.com/business/2026/10/30/binance-arranges-usd6-34-billion-to-cover-losses-from-record-crypto-hack
• CoinDesk — “Binance loses over $6 billion in the largest crypto hack to date” (October 29, 2026): https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets?ref=blockhead.co
• TRM Labs — “North Korea Steals USD 6.36 Billion from Binance in the Largest Hack in History” (October 30, 2026): https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
• SecurityWeek — “$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor” (October 30, 2026): https://www.securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor/amp/
• Bloomberg via BusinessWorld — “Binance estimates $6.3 billion hacked in crypto’s biggest heist” (October 30, 2026): https://bworldonline.com/bloomberg/2026/10/30/790477/binance-estimates-6-3-billion-hacked-in-cryptos-biggest-heist/

Reporting note: this is a developing story. Figures were checked on October 30, 2026, and Binance’s investigation is ongoing; totals and the withdrawal timeline may be revised. This article is news reporting, not financial advice — see our Disclaimer page.