$6.3 Billion Gone in 20 Minutes: Inside the Binance Crypto Heist
Hackers siphon a record $6.3B from Binance corporate wallets in 20 minutes. The exchange pauses withdrawals, vows to cover all losses, and points to North Korea's TraderTraitor.
$6.3 Billion Gone in 20 Minutes: Inside the Binance Crypto Heist
Binance, the world’s largest cryptocurrency exchange, said on Friday, October 30 that hackers stole more than $6 billion from one of its own online wallets in an attack that blockchain investigators believe may be the biggest cryptocurrency theft on record. The company has paused withdrawals, frozen about $3 billion of the stolen assets so far with help from industry partners, and promised to cover every loss using its SAFU and company funds; its latest update says withdrawals should resume within 45 hours, while deposits remain unaffected.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected. The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far. We will continue to provide further updates through official Binance channels as more verified information becomes available.
— Binance (@binance)
What was Taken, and Who is Accused
Blockchain intelligence firm TRM Labs said the attacker moved about $6.36 billion from Binance wallets across ten blockchains, with most of it leaving in roughly 20 minutes. TRM said it had “high confidence” that the attack was carried out by TraderTraitor, which it described as North Korea’s elite hacking group, because several features resembled earlier North Korea-linked thefts, announced by Ari Redbord, Head of Policy at TRM.
@trmlabs is attributing the record $6.36 billion Binance hack to North Korea's TraderTraitor.
— Ari Redbord (@ARedbord)
Chainalysis, a leading blockchain data and analytics company, also posted on X, formerly Twitter, believing that TraderTraitor was likely behind the hack. Binance has not confirmed who was responsible; a spokesperson said it is working closely with law-enforcement partners to identify the criminals and bring them to justice.
The Binance exploiters are rushing to stay a step of stablecoin freezes. One method we’re tracking involves stashing their stablecoins in DeFi protocols. Then claiming them back on new, clean addresses. This method has been used on the Tron blockchain since the early hours of the $6.4 billion attack. It involves swapping TRX for stablecoins, then exchanging those stablecoins for depository receipt tokens. Unlike the stablecons they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whomever holds them. That’s an edge for prospective hackers and money launderers. Especially North Korean threat actors, who have used this method on other heists, too. Here's how North Korea's TraderTraitor group moved $500K. Step by step. Step 1: Start with TRX. The hackers moved TRX into a swap wallet, positioning the funds for the next stage of the laundering process. Step 2: Swap into stablecoins. The hackers converted TRX into stablecoins through a DeFi exchange. The stablecoin offers liquidity and stability, with a catch: risk of freezing. The longer you hold illicit funds in stablecoins, the more likely its centralized issuer freezes your tokens. Circle and Tether have already contributed to $2.8 billion in freezes so far. This creates a critical vulnerability for the hackers and a potential intervention point for investigators. This is a dilemma for hackers — how to exploit stablecoin liquidity without the risk of freezing. Steps 3 and 4: Move the stablecoins: To solve the dilemma, the hackers moved the stablecoins and deposited them in a DeFi lending protocol. In return, they received a deposit token that could not be frozen. Rather than holding stablecoin directly, they now held a token representing a claim on pooled assets. They can now transfer the claim to the asset without risking a freeze. Steps 5 and 6: Move the claims token: The hacker moved their claim tokens to a new, clean wallet that was not tainted by association. That new wallet then converted the deposit token back to stablecoin. Steps 7 and 8: Bridge the funds. The hackers then exfiltrated their assets from the Tron blockchain via a bridge, swapping freezable stablecoins on one side with unfreezable ETH on the other. Now the exploiter is free of worry of a freeze. Of course, exchanging stablecoins for ETH does not make the hackers bulletproof. Chainalysis investigators analyze patterns like this to keep up with the hackers in real-time. We will continue to monitor how the blockchain is used and misused.
— Chainalysis (@chainalysis) October 31, 2026
Binance Says Customer Money Not Touched
Binance Co-CEO Richard Teng sought to reassure customers that the hack affected Binance’s own “hot wallet,” an internet-connected wallet used for day-to-day transactions, rather than customer funds. He said most customer assets are kept in “cold wallets”, which are offline and used for secure storage, and are moved into hot wallets only when someone withdraws money.
In simpler terms, Binance said the money hackers took belonged to the company, not to individual customers. The company says deposits were unaffected, and that it will make users whole.
Teng said investigators initially thought a compromised laptop may have been involved, but later found further “points of breach”. He described the attack as complex, involving more than one person and a “self-destruct mechanism” that erased tools and traces as the attackers went, making it harder to investigate.
An update on the security incident. https://t.co/qn2804fO5z
— Richard Teng (@_RichardTeng) October 30, 2026
How Attackers Got In
Teng explained that the attackers used a known crypto protocol called EIP-7702 to obtain on-chain approval to control a Binance hot wallet. Crucially, he said that approval did not go through Binance’s normal approval controls, which is why the exchange switched off withdrawals while it rebuilt, tested and secured its systems.
Cybersecurity expert Kok Tin Gan, co-founder and chief executive of NyxLab, told global news agency AP that the incident appeared to involve a single signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet. His comments highlight why the case has raised questions about whether stronger safeguards should have been in place.
Binance’s Rescue Plan
Binance said it has set aside more than $6.34 billion of company funds to cover the stolen assets. Of that, $5 billion is already held in the same types of tokens that were stolen, including USDC, USDT, bitcoin, ether, and BNB. The company said it is buying the remainder through normal markets and private over-the-counter deals.
https://t.co/eeLPCUjIxR
— Binance (@binance) October 30, 2026
The exchange says it will publish a full Proof of Reserves report by Monday (November 2) to let the public verify that customer assets are backed. It hopes to provide an initial view before then, and is encouraging worried customers to check their Binance accounts and contact customer service with questions.
Binance is also carrying out a company-wide security review of endpoints, cloud systems, key management and signing processes. It says it is working with law enforcement, blockchain-intelligence firms, token issuers and other exchanges to trace and recover the stolen funds.
Washington is Watching
President Donald Trump told reporters at the White House on Friday that US officials were investigating the Binance hack. Asked whether North Korea was involved, he said: “We’re looking at that,” reports AP.
Further stating that the suspected North Korean link matters because North Korea has increasingly used crypto theft and other cybercrime to raise foreign currency. South Korea’s spy agency said in December 2022 that North Korean hackers had stolen an estimated $1.1 billion in cryptocurrency and other virtual assets over five years, with more than half stolen in 2022 alone.
Why this Hack is Historic
Even though roughly half the stolen assets have been frozen, independent crypto analyst Garrick Hileman told AP there are signs that hackers are already moving and converting some of the rest. He compared the process to money laundering: stolen crypto can be mixed with other digital assets through “mixers” or “tumblers”, making it harder to follow.
TRM and several other crypto firms and experts have called this the largest cryptocurrency theft on record. Binance founder Changpeng Zhao wrote on X that, although the hack may be the largest in dollar terms, earlier incidents such as the Mt. Gox collapse involved a larger amount of bitcoin.
Saw a few discussions about size of hack, why impact to bitcoin price is small, etc. π $6.3 billion is the biggest in USD terms, but not in BTC terms. MtGox was 650,000 BTC! Other important numbers to consider: % of bitcoin (in relation to BTC total supply), ie, market impact. MtGox is big there again at 5%+. Number of users impacted, and % of user assets impacted. MtGox (the largest CEX at the time) and FTX (not small) were all near 100% of users and their asseets. Most important: Who is impacted? Does the platform cover it all? (only one victim), as in recent two CEX cases and Binance. Obviously, still a major disaster for the industry, Binance (and me). It hurts, but we survive. Most importantly, we protect our users. (image from @MatthewRoszak)
— CZ πΆ BNB (@cz_binance) October 30, 2026
The previous record-setting case was the $1.5 billion hack of exchange Bybit in February last year. The FBI said North Korea and TraderTraitor were responsible for that attack, and TRM pointed to similarities between it and the Binance breach.
What Happens Next
For ordinary users, the key questions may be: can they withdraw their money soon, and can Binance prove that customer funds are safe? Binance says withdrawals are expected to return within 45 hours, subject to rigorous testing, and has promised a public Proof of Reserves by Monday.
For the wider crypto industry, the breach is a warning about the risks facing even the largest platforms. “A cyber attack of this level is a matter of when, not if, particularly alongside the rise of AI,” said Andy Ward, senior vice-president at Absolute Security.
Binance, which is often described as the world’s biggest cryptocurrency exchange, has long faced scrutiny over allegations connected to crypto crime, but this time it is the victim. The coming days will show whether its promise to absorb a multi-billion-dollar loss and restore trust can withstand both market pressure and public scrutiny.
