P700 / / Crypto

Binance hack: $6.3 billion stolen. What it means if you hold crypto

The Binance hack took $6.3 billion in 20 minutes. How it happened, what was frozen, who pays, and what to do with your coins.

Richard Teng of Binance on stage at Binance Blockchain Week 2023
Photo: Binance, CC BY 4.0

The Binance hack of 29 October 2026 is the largest crypto theft on record: attackers drained about $6.3 billion from the exchange's hot wallets in roughly 20 minutes. Binance says customers will not lose money, because it has set aside $6.34 billion of its own to restore balances. Withdrawals were paused while it finished security checks. Blockchain analysts link the attack to North Korea.

What happened in the Binance hack

Late on Thursday, funds started leaving Binance hot wallets on several blockchains at once. The stolen coins included bitcoin, ether, the stablecoins USDT and USDC, and a long list of smaller tokens. Crypto watchers quoted by ABC News counted 30 to 40 different tokens.

The bitcoin part is easy to follow on-chain. According to CoinDesk, about 18,270 BTC left Binance at 20:20 UTC in 11 transactions, all in one block (973,732). The attacker then split the coins into 19 wallets: 17 with exactly 1,000 BTC each, plus two with the remainder. By Friday morning none of those wallets had sent anything on.

How the attackers got in

Binance's first explanation: a DevOps engineer's laptop was compromised. From it, the attacker reached an internal service and submitted withdrawal requests that the system treated as legitimate, so every withdrawal carried a valid Binance signature. Binance says it has found no evidence that any wallet's private key leaked. It later said it had found "additional points of breach", without saying what they were.

That detail matters more than the headline number. The cryptography held. The weak point was a person's computer and the internal tooling around the wallets, which is how most big exchange thefts happen.

Who is behind it

TRM Labs attributes the attack "with high confidence" to TraderTraitor, the North Korean hacking unit the FBI blamed for the $1.5 billion Bybit theft in February 2025. Chainalysis agrees. Chainalysis also says it is seeing laundering techniques it had not observed before: thousands of fast, apparently automated transactions moving funds between destinations. Aidan Larkin of Asset Reality called it "agentic money laundering".

Frozen, recovered, covered

Here bitcoin and stablecoins behave very differently. Tether, Circle and Ripple control their token contracts, so they can blacklist an address within hours. A Binance spokesperson told CoinDesk that about $3 billion had been frozen with the help of industry partners. Bitcoin has no issuer: those 18,270 BTC can only be stopped if they touch an exchange, an OTC desk or a swap service that cooperates. TRM estimates that about $3.4 billion of the loot is beyond anyone's reach.

For customers, the pledge is what counts. Binance says it has committed $6.34 billion of company resources, about $5 billion of it already held in the same tokens that were stolen, with the rest being bought on the market. Its Secure Asset Fund for Users (SAFU), an emergency reserve of roughly $1 billion in bitcoin, comes on top.

If you have coins on Binance

  • Don't panic, and don't click. Every big hack brings fake "refund" and "recovery" emails and DMs. Binance will not ask you for your password, 2FA code or seed phrase. Check announcements only in the official app or on binance.com.
  • Check your balance in the app. Binance says balances are being restored from company funds.
  • When withdrawals reopen, ask yourself why long-term savings sit on an exchange at all. A hardware wallet or a well-backed-up phone wallet removes this whole category of risk. Coins you hold yourself cannot be drained through someone else's laptop.
  • For what stays on exchanges, turn on the withdrawal address whitelist and use an authenticator app, not SMS.

The industry is already arguing about the fix. OKX founder Star Xu called for shared security standards and extra checks on large withdrawals to unknown addresses, so that attackers "should not be able to bypass these fundamental security restrictions". If that becomes standard, big withdrawals will get slower for everyone. That is a fair trade.

The quiet lesson of this week is old: the safest exchange balance is a small one. At the ZOLAK crypto bar you pay from your own wallet, with no account and nothing sitting with us. Earlier this month Binance also announced it is shutting down Binance Pool on 10 November, so if you mine through it, you have two reasons to check your setup this week.

Not financial advice.

Sources

Crypto · Bitcoin