Sign in Subscribe
News

Binance hack: $6.3B stolen in the largest crypto theft on record

Attackers drained about $6.3B from Binance hot wallets on October 29, 2026. Here is what happened, who was behind it and where funds stand.

stakefish

stakefish

— 7 min read
Share
Binance hack: $6.3B stolen in record crypto theft

Last updated November 1, 2026, 5 PM CT.

Latest update (Nov 1, 5 PM CT): Binance said it processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on November 1. That is a net outflow of about $3.64 billion, or 2.1% of the $171 billion in assets in its October 28 proof of reserves. Binance says withdrawal volumes fell after an early spike. It is still testing the remaining networks and has not given a date for the next phase. It now expects the updated proof-of-reserves report, with zero-knowledge proofs, on its PoR website on November 2 (Binance on X). The U.S. Secret Service said it is investigating with the FBI, IRS-CI, DOJ and two U.S. Attorney's Offices (U.S. Secret Service on X).

Earlier on November 1: Binance reopened withdrawals in phases on Sunday, November 1. Bitcoin came back first, shortly after 06:00 UTC (Binance on X). By 12:36 UTC all 15 networks in phase one were open again, including ETH, BSC, SOL, XRP, TRX, Base, Arbitrum, Optimism and Polygon (Binance on X). More assets and networks will follow after security checks. Binance now says it has covered about 95% of the stolen amount, up from 90% (Binance Update #4). On October 31 the FBI said North Korea was behind the attack and named the TraderTraitor group (FBI).

Attackers stole about $6.3 billion from Binance hot wallets on October 29, 2026, the largest crypto theft on record. The theft began at 20:05 UTC and hit wallets on ten blockchains, with most of it taking place in about 20 minutes. Blockchain analytics firm TRM Labs says it is roughly four times the size of the $1.5 billion Bybit hack in February 2025.

Key facts

  • Amount: about $6.3B ($6.36B per TRM Labs) (TRM Labs)
  • Date: October 29, 2026, starting 20:05 UTC
  • Chains: 10, including Ethereum, Bitcoin, XRP Ledger, Tron and Solana (TRM Labs)
  • Attributed to: North Korea (TraderTraitor), per the FBI on October 31 (FBI). TRM Labs, Chainalysis and Elliptic reached the same finding.
  • Frozen: about $3B, per Binance as of October 30 (Binance on X). Elliptic has verified $2.85B frozen or seized on-chain (Elliptic).
  • Withdrawals: reopening in phases since November 1. All 15 phase-one networks were open by 12:36 UTC (Binance on X). Net outflow was about $3.64 billion from 06:00 to 15:30 UTC, 2.1% of assets. No date yet for the next phase (Binance on X).
  • Deposits: open, and not affected by the incident, as of November 1 (Binance Update #4).
  • Proof of reserves: snapshot from 00:00 UTC on October 31 is live. New withdrawal wallets were added to the list on November 1 (Binance on X). As of November 1, Binance expects the updated report with zero-knowledge proofs on November 2. It had earlier said November 3 (UTC) (Binance on X, Binance Update #3).
  • Coverage: Binance set aside more than $6.34B of company funds to cover losses (Richard Teng on X). It says about 95% of the stolen amount, about $6B, was covered as of November 1 (Binance Update #4, Binance on X).
  • Law enforcement: the FBI, USSS and IRS-CI are tracking the funds. They asked exchanges, DeFi services and node operators to block a published list of attacker addresses (FBI). The Secret Service says DOJ units and U.S. Attorney's Offices in D.C. and Central California are also on the case (U.S. Secret Service on X). No arrests have been announced.

What happened in the Binance hack?

XRP, Bitcoin, Tron and Ethereum wallets were hit first. Funds also left Binance wallets on Solana, Arbitrum, Optimism and Base, and a second wave hit Avalanche and Polygon around 23:05 UTC. Ethereum accounted for about $3.79 billion, including roughly 200,630 ETH plus large amounts of USDT and USDC. About 18,270 BTC was also taken.

How did the attackers get in?

Binance has not published a final root cause. Its first finding pointed to a compromised DevOps engineer's laptop. That gave the attacker access to a service container used to submit withdrawals. Binance later said it found more points of breach and that the attack "was not carried out by one person" (Binance on X). CEO Richard Teng said the attacker used EIP-7702 delegation to gain on-chain approval over a hot wallet, and that this delegation skipped Binance's normal approval controls (Richard Teng on X).

Binance says it found no evidence that wallet private keys leaked. It says it will publish a post-incident report once the investigation is complete (Binance Update #4).

Who was behind the Binance hack?

The FBI said on October 31 that North Korea was responsible for the theft of more than $6 billion from Binance. It calls this activity "TraderTraitor." The FBI, USSS and IRS-CI saw the attackers convert stolen assets mainly into ETH and expect more laundering through DeFi and instant swap services (FBI). TRM Labs and Chainalysis had already tied the attack to TraderTraitor. Chainalysis found stolen funds mixed on-chain with funds from the Bitget theft last month (Chainalysis). Binance thanked the FBI for its support (Binance on X). Its own updates do not name an attacker. On November 1 the U.S. Secret Service said its investigators worked with industry partners within minutes of the theft to freeze a large part of the stolen funds. The case also involves the U.S. Attorney's Office for D.C., the U.S. Attorney's Office for the Central District of California, DOJ CCIPS and the DOJ National Security Division (U.S. Secret Service on X).

Where do frozen funds and withdrawals stand?

Tether, Circle, Ripple and others froze funds within the first hour. Binance said on October 30 that about $3 billion was frozen (Binance on X). Elliptic has verified $2.85 billion frozen or seized on-chain, almost all of it USDT and USDC. The attacker is swapping the rest into ETH and other assets that issuers cannot freeze (Elliptic). Binance has set aside more than $6.34 billion of company funds to cover user losses. That figure is separate from the frozen assets (Richard Teng on X).

As of November 1, withdrawals are reopening in phases and deposits are open. Phase one covers 15 networks, chosen by user demand over the past week (Binance Update #4). BTC opened first. ETH, USDT and USDC on Ethereum and BNB Chain followed, then XRP, Base, DOGE, Optimism, Arbitrum, TRX, SOL, Polygon, Avalanche C-Chain, ZEC, TON and SUI (Binance on X). Binance says other assets and networks will return as security checks finish. It warns of delays during the rollout. All withdrawals now come from new wallets, which it added to its proof-of-reserves list (Binance on X). Between 06:00 and 15:30 UTC on November 1, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits. It puts the net outflow at about $3.64 billion, 2.1% of its $171 billion in assets as of October 28. It says withdrawal volumes have declined since the first spike and that it will share details of the next phase once testing is done (Binance on X).

Why it matters for stakers and institutions

Exchange hot wallets hold assets that the exchange controls. On Ethereum, staked ETH can only be withdrawn to the address set in a validator’s withdrawal credentials, so it is worth asking your provider where those point. Scammers often follow large hacks with fake recovery offers and look-alike support pages. Trust only official channels, and never share a seed phrase or sign a transaction from an unsolicited link.

Sources

Frequently asked questions

How much was stolen in the Binance hack?

About $6.3 billion. TRM Labs puts the total at $6.36 billion at the prices when each asset was taken, across ten blockchains, on October 29, 2026.

Who was behind the Binance hack?

The FBI says North Korea was responsible and names the TraderTraitor group (FBI). TRM Labs, Chainalysis and Elliptic reached the same finding. Binance has not named an attacker in its own updates.

Are Binance user funds covered?

Binance says it will bear the losses, not users. As of November 1 it has covered about 95% of the stolen amount, about $6 billion, with SAFU, part of its Futures insurance fund and its own treasury. BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are backed 100%. The last 5% are less liquid tokens it is still buying (Binance Update #4).

When will Binance withdrawals resume?

They began to resume on November 1, 2026. Phase one covers 15 networks, including BTC, ETH, BNB Chain, SOL, XRP and TRX, and all 15 were open by 12:36 UTC (Binance Update #4, Binance on X). As of November 1, Binance is still testing the other networks and assets and has not given a date for the next phase (Binance on X).

Will Binance publish proof of reserves?

Yes. Binance posted a snapshot taken at 00:00 UTC on October 31 and added its new withdrawal wallets on November 1 (Binance on X). On November 1 it said the updated report, computed with zero-knowledge proofs, should be on its PoR website on November 2. Its October 31 update had given November 3 (UTC). The proof lets users check that their own balances are backed at least 1:1 (Binance on X, Binance Update #3).

Was Binance staked ETH affected?

Binance has not said that staked assets were affected. The attack drained hot wallets used for deposits and withdrawals.

Read more