Binance Hack: $6.3 Billion Stolen, Withdrawals Suspended. What Users Should Do

Short answer: Late on Thursday, October 29, 2026, attackers drained about $6.3 billion from Binance's hot wallets; TRM Labs puts the outflow at around $6.36 billion across ten blockchains, most of it within about 20 minutes. Binance disclosed the incident on October 30, suspended withdrawals (deposits were not affected) and said it has reserved more than $6.34 billion of company funds to cover all losses. About $3 billion has been frozen on-chain, mostly stablecoins frozen by their issuers. Binance's initial investigation points to a compromised laptop of a DevOps engineer. TRM Labs and Chainalysis link the attack to TraderTraitor, a North Korean state hacking group.

What happened at Binance?

According to Binance, the attack began with a compromised laptop belonging to a development and operations engineer, which allowed the attacker to submit unauthorized withdrawals from the exchange's hot wallets. A later review found additional points of breach. Co-CEO Richard Teng called it "a complex attack" carried out by more than one person and said the attacker used a self-destruct mechanism that destroyed tooling and traces, complicating the investigation.

Hot wallets are the online wallets an exchange uses to process withdrawals; most user assets sit in offline cold storage. Binance says user funds are safe and that the losses come from the exchange's own operational balance, which it is replenishing from company money. Fundstrat's Sean Farrell told Yahoo Finance it "does not currently appear to be a solvency event for Binance".

Key facts

Why it is the largest crypto hack ever

The previous record was the February 2025 theft of about $1.5 billion from Bybit, which the FBI attributed to the same TraderTraitor group. The Binance theft is more than four times that in dollar terms. Binance founder Changpeng Zhao noted that Mt. Gox lost more bitcoin by count, but in dollar value nothing comes close. It also lands in a year of large exchange incidents, including the $387.5 million Bitget hot wallet hack in September.

Elliptic estimates that about 44% of the stolen assets were frozen, almost all of them stablecoins. That is the clearest illustration so far of a trade-off that rarely gets attention: centrally issued stablecoins can be frozen, which helps victims of theft and also means an issuer can block any address. Over $3 billion in assets the issuers cannot freeze, such as ETH and BTC, remained under the attackers' control, and analysts already see signs of laundering.

What to do if you have funds on Binance

1. Do not panic-sell inside the exchange. Binance says user balances are covered. Selling at a discount during a suspension locks in a loss you may not have.
2. Watch only official channels. Phishing spikes after every big hack: fake "compensation" forms, fake support, fake withdrawal links. Binance will not ask for your password, 2FA codes or seed phrases.
3. Do not send new deposits until withdrawals are working again, unless you have a specific reason.
4. When withdrawals reopen, move what you do not need to trade to a wallet you control. Our guide to self-custody security covers the setup.
5. Keep alternative routes. For swaps that do not leave your coins on any exchange, compare non-custodial services in Changerella App or the exchangers list; read how to vet an exchanger first.

FAQ