Binance Hack: $6.3 Billion Drained Across 10 Blockchains in the Largest Crypto Theft on Record

Binance, the world’s largest crypto exchange, has confirmed a security incident with an estimated total impact of about $6.3 billion, which makes it the largest crypto theft on record and roughly four times the size of the $1.5 billion Bybit hack in February 2025.

The attacker moved funds out of Binance wallets across ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on October 29. Blockchain intelligence firm TRM Labs has since attributed the attack to North Korea, while Binance says it will cover every dollar of user losses.

User funds are safe.

Binance will cover all hacking losses.

Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.

We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.

— Yi He (@heyibinance) October 30, 2026

This report looks past the headline numbers to explain how the attack worked, why the freezes caught only part of the money and what it will take to recover the rest, with every figure tied to its source.

The numbers, side by side

Different parties have published different figures, but because they are measuring slightly different things at different times, none of them is necessarily wrong.

TRM notes that its figures reflect what it saw on-chain as of October 30 at 00:30 UTC, so these numbers will keep moving as the freezes continue.

Where the money came from

TRM broke the losses down by network:

Key moments (all times UTC)

October 28, morning. The attacker’s operator wallet received three small withdrawals from Tornado Cash, a privacy service that hides crypto transaction trails.

October 29, earlier in the day. The operator deployed attack code, tested it on two wallets, then rehearsed the final version on a third wallet. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.

20:05 to 20:09. Five Binance wallets on the XRP Ledger sent 233.46 million XRP to one attacker address.

20:20. A Binance Bitcoin hot wallet sent 18,270 BTC to an attacker address, which immediately began splitting it into round 1,000 BTC and 100 BTC pieces. In the same minute, the attacker took control of a Binance Ethereum hot wallet (explained below).

21:01. Tether froze 971.1 million USDT in the main receiving wallet, 37 minutes after the main Ethereum sweep.

21:04. Circle froze 823 million USDC in the main receiving wallet, in coordination with law enforcement.

21:19. Binance said it was aware of reports of a potential security issue and was investigating.

22:15. Binance halted withdrawals.

23:05. A second wave hit Binance wallets on Avalanche and Polygon.

23:11. Binance suspended Binance Alpha trading.

23:35. Binance put the verified frozen total at $2.54 billion.

October 30, 00:08. Arbitrum’s Security Council used its emergency powers to force two transfers out of the attacker’s wallet on Arbitrum.

00:13. Binance said all deposits and withdrawals were temporarily suspended.

04:17. Binance cofounder Yi He posted a service update saying withdrawals should begin resuming within 48 hours and that deposits were operating normally.

**Service Update**

Deposits remain unaffected and continue to operate as normal.

Our team is currently working on enhancements to the withdrawal service and related address controls. We expect to begin resume withdrawal services in the next 48 hours.

We will continue to share updates through official Binance channels as progress is made.

— Yi He (@heyibinance) October 30, 2026

READ ALSO: Crypto Security Has Come a Long Way, So Have the People Trying to Break It

How it happened

Binance’s explanation

According to Binance’s early findings, the incident may have involved a compromised DevOps engineer’s laptop, which gave the attacker access to a service container and let it submit unauthorized withdrawal transactions. The exchange added that it found no evidence that any wallet private keys were leaked.

What the on-chain evidence suggests

TRM’s analysis, however, points to something wider than a single laptop. The affected wallets ran on different chains with different key types and signing schemes, yet all of them produced valid signatures for the attacker within about half an hour, which TRM reads as a sign that the attacker had gained the ability to make Binance’s hot wallet signing system sign whatever transactions it wanted, across chains.

These two accounts aren’t necessarily in conflict, since a laptop could easily have been the entry point and the signing system the real target. Until Binance publishes its root cause analysis, though, neither can be confirmed.

Where experts disagree

Security firm Blockaid’s assessment lines up with Binance’s. Its CEO, Ido Ben-Natan, said the evidence points to key misuse, meaning the attacker compromised the signing system and got it to approve malicious transactions without ever extracting a private key.

Mark Karpeles, the former head of Mt. Gox, sees it differently. He told Reuters the attacker appears to have obtained valid delegations for both Binance 14 and Binance 16, which he believes means the attacker likely found the private key those addresses use. If he is right, that would cut directly against Binance’s finding of no key leak, and only Binance’s root cause report is likely to settle the question.

EIP-7702, in plain English

On Ethereum, the attacker relied on a newer feature rather than ordinary transfers. Known as EIP-7702 and introduced with Ethereum’s Pectra upgrade in May 2025, it lets a regular wallet hand its behaviour over to a smart contract by signing an authorization.

Every Ethereum wallet keeps a running transaction count called a nonce, and an authorization only works at the exact count it was signed for. A busy exchange hot wallet sends withdrawals all the time, so that count never stops moving. The attacker got around this by submitting 50 authorizations covering 50 consecutive counts, all signed in advance as a batch, so one was certain to still be valid when the transaction ran.

Three minutes and 24 seconds after taking control, the attacker emptied the wallet in a single transaction of 167,464 ETH and 63 tokens, including 1.615 billion USDT. Because the delegation stayed in place, it was able to keep sweeping fresh funds as they arrived, doing so again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.

Who froze what

The race against the freezes

Because stablecoins can be frozen by their issuers while ETH and BTC cannot, the attacker rushed to swap what it could, even at a heavy loss.

About 325 million USDT was sold to market makers through UniswapX and similar contracts for about 122,300 ETH, a discount of more than 10% to the market price. Another wallet put 60 million USDT into Aave and borrowed about 19,760 ETH against it before Aave froze the affected markets, and on Tron, 300 million USDT went into the JustLend lending protocol.

According to TRM, this reliance on large swaps through market makers and lending protocols marks a change from the bridge heavy laundering that followed Bybit.

The Aave move, and what it actually achieved

A post by X user cryptoblaney called the attacker’s use of Aave one of the smartest moves in crypto, arguing that while Tether and Circle froze billions, the attacker had already put USDT into Aave, borrowed ETH against it and walked away with coins no issuer can freeze. 

The Binance hacker might have just pulled off one of the smartest moves I’ve seen in crypto.

First, Tether froze $1.5 billion in USDT.

Then Circle froze another $800 million in USDC.

At that point, it looked like the hacker’s money was trapped.

But apparently, he had already planned for that.

Instead of holding the stolen USDT in a wallet, he allegedly deposited it into Aave and used it as collateral to borrow ETH.

Then he walked away.

That’s where the story gets crazy.

Tether can freeze the USDT sitting in the wallet.

But it can’t freeze the ETH he already borrowed.

So now Aave is left holding frozen collateral, while the hacker is sitting on liquid ETH.

And unless the protocol can recover it somehow, he may not even need to pay the loan back.

Two companies froze billions of dollars in seconds.

But someone who understood how to use DeFi may have found a way around both of them.

Pretty insane when you think about it.

— BLANEY (@cryptoblaney) October 30, 2026

The post gets the mechanism right: according to Aave risk provider LlamaRisk, the attacker deposited 60 million USDT into Aave and borrowed 19,762 wrapped ETH, worth about $44.6 million, between 20:58 and 21:01 UTC, and Marc Zeller of the Aave Chan Initiative said the loan went through before Tether froze the attacker’s address.

Where the post overstates things is the scale, because the USDT and USDC that Tether and Circle froze were sitting in the attacker’s main receiving wallet rather than in Aave. Nor is Aave left holding a loss, since the position held about $59.9 million in collateral against $43.8 million in debt, and Zeller said the protocol will be fine. The cost falls instead on Aave’s users, who face frozen markets across its V3 and V4 deployments, which LlamaRisk says will stay shut until the attacker’s funds stop moving.

Even so, the post makes a fair point about the limits of freezes, which only work on assets that have an issuer and leave a window measured in minutes. Anything freezable that gets swapped or borrowed against before the freeze lands ends up out of reach.

Who is behind this attack?

TRM attributes the attack with high confidence to TraderTraitor, North Korea’s elite hacking unit, based on on-chain and off-chain intelligence. The FBI named the same group as responsible for the Bybit hack. Investigator ZachXBT and security firm Blockaid have also alluded to North Korea as the likely backers of heist.

TRM lists the fingerprints that match earlier North Korean heists, including Bybit and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then used in one burst.

Investigator ZachXBT also reportedly linked the attacker to the recent $388 million Bitget hack, which was attributed to North Korean affiliated hackers.

INTERESTING: The Biggest Crypto Criminals in History and How They Were Finally Caught

Can the money be recovered?

Freezing stolen funds and actually getting them back are two different things. As TRM’s Ari Redbord told CNBC, “A freeze stops the money from moving, and recovery follows through legal process.” Chainalysis’s Eric Jardine added that there is no standard timeline, since a freeze can happen fast while getting the funds back can take months or years.

Even so, Binance starts from a far stronger position than past victims, with roughly 42% to 48% of the stolen total frozen within hours. Bybit, by comparison, had recovered about 3.2% of its $1.5 billion theft by August 2026, or about 5.3% if frozen funds are counted.

One route to recovery is catching funds at a chokepoint, since stolen crypto eventually has to pass through a centralized exchange, OTC desk or swap service, and investigators can step in when it reaches one that cooperates. Binance has done this for other victims before, recovering $5.8 million from the Ronin hack that had been spread across more than 86 accounts on its platform.

How much of the haul stays within reach also depends on the asset. ViaBTC’s Jeff Ko told Reuters he expects much of the stolen BTC to stay effectively locked, possibly for years, because every coin is traceable and Bitcoin has no mixer as deep or liquid as Tornado Cash, whereas ETH is far easier to launder.

Courts offer another path, and Bybit’s case shows what civil litigation can do. The exchange sued North Korea, the Reconnaissance General Bureau, the Lazarus Group and 20 unidentified defendants in federal court in Washington and won a partial preliminary injunction. Expedited discovery lets it request customer identities and transaction records from exchanges and other intermediaries, and because collecting from North Korea itself is unlikely, the orders aimed at wallets, account holders and service providers do most of the work.

Law enforcement can also go after the laundering services themselves. German authorities seized €34 million and shut the eXch exchange in May 2025 over funds linked to the Bybit theft, and German and Swiss authorities later closed Cryptomixer and seized €25 million in Bitcoin.

Bounties can help too, as Bybit found after offering up to 10% of any funds frozen or recovered; it had paid more than $2.3 million to 13 bounty hunters by September 2025.

Whatever is not recovered falls to Binance itself, and if the frozen stablecoins are eventually returned, its SAFU fund, worth about $1.2 billion according to CNBC, could cover roughly a third of the remaining losses, with company funds making up the rest.

Binance’s response

Binance has declared it will cover all losses using its SAFU user protection fund and company funds, and will publish updated proof-of-reserves once its response is complete, along with a detailed technical postmortem once the investigation is finished and the facts are verified. It has also revoked authorizations for affected addresses and is working with investigators and blockchain analytics firms to trace and recover the funds.

Co-founder Changpeng “CZ” Zhao said it “does look like a hack” and thanked Tether and Circle for quickly freezing about $971 million and $823 million in stablecoins.

User funds are safe!

It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).

I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.

— CZ 🔶 BNB (@cz_binance) October 29, 2026

Binance.US, a separate cryptocurrency exchange from the global Binance platform (Binance.com), has said it was not affected.

Binance’s messaging on services has not been entirely consistent, either. At 00:13 UTC, it said all deposits and withdrawals were suspended, but Yi He later said deposits were unaffected, and her withdrawal estimate covers only when restoration begins rather than when full service returns.

Market reaction

Bitcoin hit a six-week low and was last down 3% at $76,469.82, according to Reuters, while The Block put it at $76,664 at 10 p.m. ET on Thursday, with BNB down 7.1% at $698.65.

What the crypto community is saying

“One DevOps engineer’s laptop equals $6.3 billion” has become the most repeated line online. Many users question how a single compromised device could lead to withdrawals at this scale on the world’s largest exchange, and ask where the multi-person approvals, hardware security modules and restricted signing processes were, with X user payloadartist among the accounts driving that skepticism.

So the Binance hack happened due to a DevOps’ engineer who got pwned.

Pretty interesting how that could lead to $6.3B loss, didn’t they have other defence-in-depth measures to prevent loss of funds? 🤔

#Binance #BinanceHack https://t.co/BiozIOiF6z

— payloadartist (@payloadartist) October 30, 2026

“Not your keys, not your coins” is everywhere, with self-custody advocates treating the hack as proof of their case.

Some users have floated inside-job theories, although the onchain record runs counter to them: the attacker funded its wallet through Tornado Cash and rehearsed its code on test wallets more than a day before the theft.

Elon Musk also weighed in, replying to a post about the attacker’s Aave borrowing that superintelligent AI agents will at some point do this to get money for themselves rather than for a human, though he did not suggest AI played any part in this attack.

@cryptoblaney Super intelligence agents will at some point do this to gain currency for themselves, not a human

— Elon Musk (@elonmusk) October 30, 2026

Others are relieved that issuers froze funds quickly and that Binance is covering losses, which lowers the risk of an FTX-style collapse. Still, many say they will hold judgment until they see the root cause and fresh reserve data.

What to watch next

Withdrawals. Yi He’s window points to restoration starting by about 04:17 UTC on November 1.

Proof of reserves. Binance has promised an updated report after remediation.

Root cause. Whether Binance confirms the laptop as the entry point and addresses TRM’s signing system assessment.

The remaining $2.4 billion. TRM expects the attacker to move next through cross-chain bridges, swap services and OTC brokers, and is watching the Bitcoin split outputs and the ETH consolidation wallets.

A bounty. Whether Binance launches a recovery bounty like Bybit’s 10% program.

FAQs

Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.

Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.