First posted on Instagram
Binance, the world's largest cryptocurrency exchange, has confirmed a security incident affecting about $6.3 billion in digital assets, saying roughly $3 billion has already been frozen on-chain with the help of blockchain partners. The exchange said it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, and that user funds are safe.
The bulk of the theft unfolded in about 20 minutes, beginning shortly after 20:00 GMT on Thursday, October 29, 2026, across wallets Binance uses to process transactions, spanning ten blockchains, according to blockchain analysis firm TRM Labs. On Ethereum, the attacker used 50 pre-signed EIP-7702 authorisations targeting the Binance 14 hot wallet, moving 167,464 ether, about $1.6 billion in USDT and more than 60 other tokens in a single transaction.
Binance's initial investigation suggested the incident may have involved a compromised laptop belonging to a DevOps engineer, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. The exchange said it found no evidence of any wallet private key leak. In a later update, Binance said its investigation had uncovered additional points of breach, with co-chief executive Richard Teng describing it as a complex attack rather than a single "one-click" action.
A race to freeze the stolen funds began within minutes. Tether froze more than 1.567 billion USDT and Circle froze about 800 million USDC linked to the incident, with further freezes by Ripple and the Arbitrum Security Council, bringing the frozen total to roughly $3 billion. About $2.4 billion in bitcoin and ether cannot be frozen by any issuer, and TRM Labs estimated the attacker still controls more than 420,000 ether and 18,270 bitcoin.
TRM Labs, which traced about $6.36 billion leaving Binance wallets, and Chainalysis both attribute the attack with high confidence to TraderTraitor, a North Korea-linked hacking group the FBI blamed for the $1.5 billion Bybit theft in February 2025. Binance itself has not named a culprit, and North Korea routinely denies involvement in cryptocurrency thefts.
Binance initially suspended deposits and withdrawals while security checks were completed. It later said deposits were operating normally, while withdrawals would remain paused until its team completes a security revamp of the withdrawal service, with withdrawals expected to resume within about 48 hours. Binance.US and Coinbase have said they were not affected. Binance said it will publish a detailed technical post-mortem once the investigation is complete and an updated Proof of Reserves once remediation is complete, and that it is working with law enforcement partners to trace and recover the funds.
At about $6.3 billion, the theft is the largest cryptocurrency heist on record, roughly four times the $1.5 billion taken from Bybit in February 2025.