Inside the $6.3 Billion Binance Hack: How the Largest Crypto Heist in History Unfolded and What It Did to the Market

1. What happened at Binance on 29 October 2026

The first public signal did not come from Binance’s status page but from its founder. Hours before the exchange confirmed anything, Changpeng Zhao — no longer chief executive but still its largest shareholder — wrote on X that the company appeared to have been hacked, TechCrunch reported. Users had already noticed funds leaving Binance wallets in unusually large, rapid transfers.

Reconstructing the evening from public ledgers, TRM Labs found that preparation started a day earlier, when three small withdrawals from the Tornado Cash mixer funded the attacker’s operator wallet. On 29 October the attack code was tested on two wallets and rehearsed on a third. Then, from 20:05 UTC, the hot wallets began to empty: XRP first, then Solana and Optimism, then 18,270 BTC at 20:20 UTC and, minutes later, 167,464 ETH plus 63 tokens from the main Ethereum hot wallet. A second wave hit Avalanche and Polygon at 23:05 UTC.

Binance first told reporters it was “actively investigating” reports of a potential security issue and temporarily suspended withdrawals on multiple networks. By the early hours of 30 October it had confirmed the incident, estimated the impact at about $6.3 billion and said it would publish a full post-mortem once the investigation is complete.

2. How the attackers got in: two competing explanations

Binance has not yet published a root cause, and the early explanations differ in an important way.

The two accounts are not necessarily contradictory. A foothold on an engineer’s machine can be the first step towards the internal systems that request and sign withdrawals. What matters for the industry is the pattern: the private keys may have stayed secret, but the machinery allowed to use them was turned against the exchange. That is the same lesson investigators drew from the 2025 Bybit theft, which the FBI attributed to North Korea.

3. Follow the money: ten chains, $6.3 billion

Estimates of the total vary with the pricing method. Binance says about $6.3 billion. TRM Labs counts $6.36 billion at the moment of each transfer. Chainalysis initially put the figure at about $5.9 billion at the time of the theft, according to Cointelegraph’s live coverage, before revising it to $6.4 billion. Whatever the exact number, Ethereum-based assets made up the bulk.

The laundering playbook differed from Bybit, where stolen ether was pushed through cross-chain bridges. This time, TRM saw the attacker race to convert freezable stablecoins into assets no issuer can block:

4. The freeze: how about $3 billion was stopped

The most consequential defence came from outside Binance. Within an hour of the main transfers, Tether began freezing USDT; Circle followed with USDC. TRM’s snapshot at 00:30 UTC on 30 October counted about $2.7 billion frozen: roughly $1.77 billion in USDT, $825 million in USDC, $40.5 million in Ripple’s RLUSD, $27.8 million in World Liberty Financial’s USD1 and about $30 million in ETH and ARB forcibly moved by the Arbitrum Security Council. Binance itself later reported about $3 billion verified frozen.

The split exposes an uncomfortable truth for both sides of the decentralization debate. Centrally issued stablecoins proved recoverable; native ETH and BTC did not. TRM estimates that more than 420,000 ETH and all 18,270 BTC — around $2.4 billion — remained under the attacker’s control.

5. Who is behind it: TraderTraitor

TRM Labs attributes the attack with high confidence to TraderTraitor, the North Korean unit often grouped under the Lazarus umbrella. Its reasoning rests on tradecraft: small Tornado Cash withdrawals to fund an operator wallet, staging well before the theft, and signatures prepared in advance and executed in a single burst — the same fingerprints found in the Bybit theft of February 2025 and the KelpDAO exploit of April 2026. On-chain investigator ZachXBT also pointed to the Lazarus Group. Binance says it is working with law enforcement; at the time of writing no government agency had published a formal attribution for this incident.

6. Market impact: prices, liquidations and confidence

Markets reacted within minutes. The sell-off was broad but not disorderly — more a repricing of counterparty risk than a panic.

Analysts do not expect a quick rebound. Geoffrey Kendrick, global head of digital assets research at Standard Chartered, told CoinDesk: “I suspect the negative price action still has some way to go.” In his view, a new price floor will only form once frozen assets are released and more details emerge. Sean Foley of Macquarie University warned that damaged confidence in Binance could weigh on prices and push some traders towards decentralized venues.

7. Can Binance absorb the loss?

Binance co-CEO Yi He said the exchange would cover “all hacking losses”, using its Secure Asset Fund for Users (SAFU) and company funds. The SAFU fund, created after a 7,000 BTC hot-wallet theft in May 2019, holds roughly $1 billion in bitcoin. Before the attack, DefiLlama data cited by CoinDesk showed about $144 billion in assets on the exchange, which puts the gross loss at around 4% — and the net loss lower if frozen funds are returned.

As of the morning of 30 October, Binance said deposits were operating and that it remained on track to restore withdrawals within roughly 45 hours, after a security overhaul of its withdrawal service. Whether customers keep their assets on the platform once withdrawals reopen will be the real test of confidence.

8. What the Binance hack means for licensed crypto businesses

For founders building exchanges, custodians and brokers, the incident turns abstract regulatory requirements into a concrete risk scenario. Under the EU’s Markets in Crypto-Assets Regulation (MiCA), a crypto-asset service provider providing custody is liable to clients for crypto-assets lost through an incident attributable to it, up to their market value. The Digital Operational Resilience Act (DORA), applicable since January 2025, adds mandatory ICT risk management, incident reporting and resilience testing. Supervisors will now ask how an applicant would survive a hot-wallet compromise of this kind.

If you are preparing a MiCA CASP application, a VASP registration or a VARA license in Dubai, regulators will expect a custody policy, an incident-response plan and AML controls that can block tainted funds. Our AML/KYC compliance programmes and ongoing compliance support cover exactly these areas. For background reading, see our MiCA regulation guide, the AML/KYC compliance checklist for crypto businesses and the global crypto licensing landscape 2026.

Frequently asked questions

How much was stolen in the Binance hack?

Binance estimates the impact at about $6.3 billion. TRM Labs calculates $6.36 billion at transfer-time prices, and Chainalysis revised its estimate to $6.4 billion. It is the largest crypto theft on record.

Who hacked Binance?

TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit linked to the Lazarus Group. No government agency had published a formal attribution at the time of writing.

Are Binance user funds safe?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. Withdrawals were paused while the withdrawal service was rebuilt, with resumption expected within about two days of the attack.

How much of the stolen crypto was frozen?

About $3 billion, according to Binance — mostly USDT frozen by Tether and USDC frozen by Circle, plus smaller amounts by Ripple, World Liberty Financial, First Digital and the Arbitrum Security Council.

How did the Binance hack affect crypto prices?

Bitcoin fell about 4.8% to below $77,000, ether 5.7%, BNB about 8% and AAVE 11%, while around $1.5 billion of leveraged positions were liquidated across the market.