On October 29, 2026 attackers drained Binance hot wallets across about ten blockchains. Binance estimated the impact at about $6.3 billion, said it would cover all losses from company funds and paused withdrawals. Blockchain analysts attributed the attack to a North Korean hacking unit. If the figures hold, it is the largest crypto theft on record.
As of 31 October 2026 Binance withdrawals remain paused while the exchange completes security checks. Binance has said it will restart withdrawals in phases and absorb the losses with more than $6.34 billion in company funds, and that about $3 billion has been frozen with partners. No official government attribution has been reported.
TRM Labs said the operator wallet received three small withdrawals from the Tornado Cash mixer on the morning of 28 October, at least 36 hours before the theft, and later tested the attack code on its own wallets.
Between 20:05 and 20:09 UTC five Binance wallets on the XRP Ledger sent 233.46 million XRP to one attacker address, according to TRM Labs. Binance wallets on Solana and Optimism were drained shortly after.
At 20:20 UTC a Binance Bitcoin hot wallet sent 18,270 BTC and a Tron hot wallet sent 612.7 million USDT within two minutes, TRM Labs said. On Ethereum the attacker submitted one transaction carrying 50 pre-signed EIP-7702 authorizations that turned a Binance hot wallet into a sweeper it controlled.
About three and a half minutes after the authorizations, the full Ethereum hot wallet balance was sent out, including 167,464 ETH and 1.615 billion USDT, according to TRM Labs. Further sweeps followed until 23:56 UTC.
Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC and Circle froze 823 million USDC at 21:04 UTC, TRM Labs said. Tether chief executive Paolo Ardoino later said Tether had frozen more than $1.56 billion in total.
Ripple froze a wallet holding 40.5 million RLUSD at 22:01 UTC and World Liberty Financial froze 27.8 million USD1 at 22:10 UTC, according to TRM Labs. Before Ripple's freeze about 48 million RLUSD had been sold on decentralized exchanges.
On the evening of 29 October Binance co-founder Changpeng Zhao posted on X that it looked like a hack on Binance, Forbes reported.
Binance described a security incident affecting about $6.3 billion in assets, temporarily suspended withdrawals while security checks were completed and said it would cover all losses from its SAFU fund and its own funds. Its initial view was that a compromised DevOps engineer's laptop gave the attacker access to a service container. The Hacker News dates the announcement to 29 October and Forbes describes a statement early on 30 October.
Binance said at 23:35 UTC that verified frozen funds had reached $2.54 billion, according to TRM Labs.
TRM Labs attributed the theft to TraderTraitor, a North Korean hacking unit, saying it made the judgment with high confidence. The FBI had attributed the February 2025 Bybit hack to the same group. Binance had not commented on the attackers' identity.
Arbitrum's Security Council forced transfers of 8,426 ETH and 74.6 million ARB out of the attacker's Arbitrum wallet, TRM Labs said.
Elliptic put verified freezes at $2.84 billion as of 08:00 UTC, mostly USDT and USDC, and said the attacker still controlled about $3.33 billion across roughly 43 wallets that issuers cannot freeze. Chainalysis estimated about $5.912 billion stolen at the time of theft.
In an update on X, Binance said investigators had found additional points of breach and that outflows had stopped after withdrawals were suspended. Co-chief executive Richard Teng said the attacker did not simply use one engineer's permissions.
After Elon Musk posted a grimacing emoji about Binance's losses, Changpeng Zhao replied on X asking him to stop, CoinDesk reported.
Bitcoin traded near $76,800, down about 4 percent over 24 hours, as crypto stocks fell at the open. CoinDesk reported Coinbase down 12 percent after weak third quarter results and Circle down 9.5 percent.
Aave reopened its V3 and V4 markets after a precautionary freeze linked to the hack. Founder Stani Kulechov said the protocol was not affected by the attack. TRM Labs had reported that a second attacker wallet borrowed about 19,760 ETH on Aave.
Co-chief executive Richard Teng said Binance had reserved more than $6.34 billion of company funds, already held about $5 billion in the affected tokens and was buying the rest. He said customer funds were not touched, most user assets are in cold storage and the attack involved more than one person, CoinDesk reported.
Bitcoin fell below $77,000 as the Nasdaq extended its loss to 3.4 percent, CoinDesk reported, with the Binance hack and a technology sell-off weighing on markets.
A second security incident update signed by co-chief executives Yi He and Richard Teng set out a recovery plan: a phased withdrawal restart in about 34 hours subject to security checks, an initial proof of reserves snapshot within 12 hours with results expected by 2 November, and further technical findings within about 48 hours followed by a post-mortem.
The US Department of Justice alleged that Binance prioritised growth and profits over compliance with US law, failed to maintain an effective anti-money laundering progra...
FTX was a cryptocurrency exchange founded by Sam Bankman-Fried and Gary Wang that began raising money from investors in 2019 and was based in the Bahamas. It collapsed in...
Elon Musk co-founded OpenAI as a nonprofit in 2015 and left its board in 2018. He sued in 2024, alleging OpenAI and Sam Altman abandoned its charitable mission, and led a...
The SEC alleged that Musk failed to file a beneficial ownership report by 24 March 2022 after acquiring more than 5 percent of Twitter's common stock, in violation o...
Last updated 31 October 2026. Spotted an error? See corrections. Every event links to the record it comes from. Allegations are attributed to whoever made them.