Not investment advice. This article is for informational purposes only. Past performance does not guarantee future results. Consult an independent financial advisor before making financial decisions.
On October 29, 2026, attackers drained roughly $6.3 billion in crypto from Binance, the world's largest crypto exchange, in under three hours. That is the exchange's own estimate. About $3 billion has been frozen on-chain. Binance says it will cover every loss from its SAFU insurance fund and company money, and that customer funds are safe. If you saw "$2 billion" in the headlines, that was an early estimate based on part of the wallets. The real figure turned out three times larger.
It is the biggest theft in crypto history. The previous record was the roughly $1.5 billion hack of Dubai-based exchange Bybit in February 2025. The investigation is still running, so every number below is preliminary as of October 30. Here is what happened in plain words: how one hacked laptop turned into a multi-billion loss, who the suspects are, and what it means for anyone keeping money on an exchange. The most surprising part is why almost half of the loot got stopped. More on that near the end.
What happened: a three-hour timeline
The attack took less than three hours on the evening of October 29, Coordinated Universal Time (UTC). The money left Binance's hot wallets. A hot wallet (an exchange wallet that stays online so it can pay customers quickly) works like a store's cash register. The bulk of the money sits in a safe, a cold wallet with no internet access. The register is always within reach, which is exactly why it is easier to rob.
A security engineer at the firm CertiK rebuilt the sequence from blockchain data and published it on ChainCatcher. Key moments:
- around 20:04 - coins start leaving Binance wallets on XRP, then Solana and Optimism;
- around 20:20 - 18,270 BTC leave on the Bitcoin network while USDT drains on TRON;
- 20:24 - the main hit: about $2.5 billion leaves the "Binance 14" wallet on Ethereum in a single transaction, including about 167,000 ETH and 1.6 billion USDT;
- 21:01 and 21:04 - Tether and Circle freeze their coins sitting at the attacker's addresses;
- 23:36-23:38 - four final attempts to drain the wallet again fail.
Eight blockchains were hit, and this analysis puts the total near $6.28 billion, very close to the exchange's own number. So where did the widely shared "$2 billion" come from?
Why the number jumped from $2 billion to $6 billion
Early watchers saw only part of the picture. On the evening of October 29, TechCrunch reported at least $2 billion drained from hot wallets and noted the figures were unconfirmed and the theft might be ongoing. The "Binance 14" wallet alone lost about $2.5 billion. The rest left on other networks and was added up later.
Current estimates:
- Binance - about $6.3 billion total impact (official statement);
- Chainalysis (a firm that tracks money on blockchains) - about $5.9 billion at the time of theft;
- Arkham (a blockchain analytics service) - the attacker's wallets at one point held more than $5.7 billion;
- Blockaid (a blockchain attack-prevention firm) - about $5.5 billion.
The numbers differ because each count uses different prices and a different set of wallets. We treat Binance's estimate as the reference point, since the exchange sees its own wallets best. It promises a final figure in a detailed technical report.
For scale: before the hack, Binance held about $144 billion in customer assets, according to DefiLlama data cited by CoinDesk. The theft is roughly 4% of that. Think of someone with $144,000 in the bank losing $6,000 from their pocket. It hurts, but it is not bankruptcy. Which leaves the real question: how do you carry that much out of a register guarded by one of the richest companies in the industry?
How it was done: a laptop, a container and one signature
According to Binance, it started with one engineer's laptop. In its October 30 statement, the exchange says early findings point to a compromised laptop belonging to a DevOps engineer (the person who keeps servers and software releases running). From there, the attacker reached a service container (an isolated slice of a server running a single program, like a locked room in an office) and sent unauthorized withdrawal orders in the exchange's name.
We have found no evidence of any wallet private key leak.
- Binance, official update, October 30, 2026, Security Incident Update
A private key (the secret code that gives full control of a wallet) is an exchange's most valuable asset, and Binance stresses that none was stolen. Independent researchers, though, describe one more piece of the puzzle.
It is a feature called EIP-7702, added to Ethereum in its Pectra upgrade. EIP-7702 lets a regular wallet hand a power of attorney to a smart contract (a program that lives on the blockchain and runs fixed instructions). Sign that permission, and the program can act on the wallet's behalf.
According to crypto.news, citing Blockaid, at 20:20:59 the attacker sent 50 such permissions for "Binance 14" in one transaction. Why fifty? Every wallet operation carries a sequence number, like a receipt number at a till, and only the next one in line is accepted. The wallet was busy paying customers, so the next number was hard to predict. The attacker tried 50 in a row. One matched. The wallet handed control to the attacker's program, which four minutes later swept everything in one call, leaving 1 ETH for fees.
Here the sources disagree. Analysts at Threat Landscape point out that such a permission can only be signed with the wallet's own key, which suggests the signing key was compromised. Binance denies any key leak. The two may not contradict each other: an attacker sitting inside an internal system could make that system sign what he needed without ever copying the key out. That is a hypothesis, not a finding. Binance has not named EIP-7702 as the cause, and only its technical report will settle this.
So the how is roughly clear. The next question is bigger: who did it.
Who is suspected: the North Korea trail
Several independent investigators point to North Korean hackers, although nobody has officially confirmed it. According to CoinDesk:
- independent investigator ZachXBT named the Lazarus Group as the likely attacker;
- TRM Labs linked the attack with high confidence to TraderTraitor, a Lazarus subunit;
- Chainalysis CEO Jony Levin said the attack was likely carried out by TraderTraitor, citing links to a previous hack;
- Blockaid CEO Ido Ben-Natan said the tactics and sophistication look like North Korean operations.
The suspicion has history behind it. In February 2025, the FBI formally blamed the same TraderTraitor group for the roughly $1.5 billion Bybit theft. And according to Chainalysis, more than $3.4 billion was stolen from the crypto industry in 2025, with at least $2.02 billion of it taken by North Korean hackers. In other words, this single attack on Binance is almost twice the size of all crypto theft last year.
For customers, though, the more pressing question is who pays.
What happens to customer funds
Binance promises to cover all losses from its SAFU fund and company money. SAFU (Secure Asset Fund for Users, the exchange's own insurance reserve) is money set aside for hacks. CoinDesk estimates it holds about $1 billion in bitcoin, so most of the loss will have to come from the company's own funds.
What we know as of October 30:
- withdrawals are paused during security checks; Binance co-founder Yi He, per crypto.news, expects them to resume within 48 hours;
- reports on deposits differ: the official statement says deposits are paused too, while Yi He wrote that deposits are unaffected;
- the exchange promises a detailed technical post-mortem and an updated proof of reserves (a report showing the exchange holds at least as many coins as customers have in their accounts);
- Binance founder Changpeng Zhao wrote that he no longer runs the exchange but, as a shareholder, expects user funds to be fully covered.
Markets reacted right away. Per CoinDesk, bitcoin fell 4.8% to below $77,000, ether dropped 5.7% and the exchange's own BNB token lost 8%. Now for the question from the top of the story.
Why almost half of the loot was frozen
Because much of it was in stablecoins. A stablecoin (a cryptocurrency pegged to the dollar, so 1 coin is about $1) is issued by a specific company, and that company can technically block its coins at any address. Bitcoin and ether cannot be stopped that way: nobody owns the button.
According to CoinDesk, Tether froze more than 1.57 billion USDT and Circle froze more than $800 million in USDC. Counting other assets, Binance puts the frozen total at about $3 billion. The response took under 40 minutes after the main hit: the wallet was emptied at 20:24, and Tether's block kicked in at 21:01.
The rest, mostly bitcoin and ether, is already being laundered. Chainalysis describes the usual North Korean playbook: split funds into small transfers, push them through bridges (services that move coins from one blockchain to another) and mixers (services that blend many people's coins to hide the trail). The whole cycle usually takes about 45 days. The next six weeks will show how much more can be recovered.
Editorial view: there is an awkward paradox here. Crypto was built as money without middlemen, yet the middlemen did the best job, companies able to freeze other people's coins with a single decision. Today that button saved about $3 billion. The same button could, in theory, lock out an honest owner. We think readers deserve to see both sides, not just the good news.
What to do if you keep crypto on an exchange
The key point: money on an exchange is not directly yours. It is the exchange's promise to give it back when you ask. As long as the exchange is solvent and honest, you never notice the difference. During a hack, it becomes obvious.
A few simple habits lower the risk:
- Get news only from the exchange's official site and accounts. Big hacks are usually followed by fake "compensation forms" and messages posing as support. We covered how to spot a fake site in our guide to six signs of a scam website.
- Turn on two-factor authentication (password plus a code from an app) and a withdrawal address whitelist if your exchange offers one. Then even with your password, money cannot go to a stranger's wallet.
- Keep only what you need for trading on the exchange. Many people move long-term savings to a personal wallet where only they hold the keys.
- Remember that attackers target people, not just code. This hack started with one employee's laptop. Scammers can even fake a voice from a recording just three seconds long.
Today, open the app of any exchange where you hold even a little crypto and check two security settings: is two-factor authentication on, and is there a withdrawal whitelist? It takes three minutes. Binance's register emptied in three hours. Your protection takes less.
Sources
- Binance: Security Incident Update (Oct 30, 2026)
- CoinDesk: Binance loses over $6 billion (Oct 29, 2026)
- CoinDesk: Lazarus Group likely behind Binance hack (Oct 30, 2026)
- TechCrunch: Binance pauses withdrawals (Oct 29, 2026)
- crypto.news: How one wallet trick led to the breach (Oct 30, 2026)
- Threat Landscape: EIP-7702 analysis (Oct 30, 2026)
- ChainCatcher: on-chain timeline (Oct 30, 2026)
- FBI: North Korea Responsible for $1.5 Billion Bybit Hack (Feb 26, 2025)
- Chainalysis: 2025 crypto theft report (Dec 18, 2025)
