On October 29, 2026, Binance, the leading crypto exchange by trading volume, experienced a security breach. The company estimates the total impact at roughly $6.3 billion. If confirmed, this would represent the largest crypto theft recorded, exceeding four times the $1.46 billion taken from Bybit in February 2025. This article outlines current knowledge about the attack’s method, scale, possible actors, and user considerations.
What Happened to Binance?
According to blockchain analytics firm Elliptic, unauthorized withdrawals occurred from Binance “hot wallets” across 11 blockchains. Elliptic reports the first transfer at about 20:05 UTC, when 233 million XRP left the exchange. Within roughly 30 minutes, wallets on Ethereum, Bitcoin, Solana, Tron, Base, and other networks were drained. A second wave followed after 23:00 UTC.
Elliptic estimates $6.43 billion, while Arkham calculates $6.01 billion across nine blockchains. Binance’s figure of about $6.3 billion reflects an estimated impact rather than a confirmed loss. The exchange notes the numbers may shift as the investigation proceeds.
How Did the Attack Happen?
Binance’s early findings suggest the breach “may involve a compromised DevOps engineer’s laptop.” A DevOps engineer supports the firm’s technical systems. Binance states the laptop allowed access to a “service container,” an isolated software segment, enabling unauthorized withdrawals. The exchange found no indication that any wallet’s private key was exposed.In a later update, Binance reported “uncovered additional points of breach” and characterized the event as “a complex attack.” Co-CEO Richard Teng noted it “was not a single ‘one-click’ action.” Elliptic’s on-chain analysis indicates the attacker prompted Binance’s own systems to approve transactions rather than seizing its keys. The precise method remains unconfirmed. Binance has pledged a detailed technical post-mortem after its inquiry concludes.
How Much Was Stolen and What Happened to the Funds?
Stablecoins, tokens tied to the US dollar, formed a major portion of the impacted assets. Their issuers can freeze them, which reduced some damage. According to Elliptic:
- Tether froze the attacker’s primary Ethereum wallet 37 minutes after the stolen USDT arrived.
- Circle froze roughly $823 million in USDC.
- Ripple, Paxos, First Digital, and others froze additional tokens, while the Arbitrum Security Council took emergency steps.
Binance states about $3 billion has been frozen on-chain so far. Elliptic has independently verified $2.84 billion. Bitcoin, XRP, Solana, and other native coins lack a central issuer, so no one can freeze them. Elliptic estimates the attacker still holds around $3.3 billion in assets that cannot be frozen.
Who Is Behind the Attack?TRM Labs expressed “high confidence” that TraderTraitor executed the breach. TraderTraitor is a North Korea-linked group tied to the Lazarus Group, and Elliptic has also linked the theft to North Korea. It cited a shared laundering address connected to the September 2026 Bitget exploit and methods resembling the Bybit hack.
Elliptic urged caution because the overlap in funds is slight. No government agency has confirmed responsibility, and Binance reports its inquiry “has not attributed responsibility to any individual.”
How Has Binance Responded?
Binance halted deposits and withdrawals, revoked access for the affected addresses, and coordinated with law enforcement and blockchain intelligence firms. The exchange states it will cover all losses from its SAFU fund—an emergency reserve—and company resources, asserting that “user funds are safe.”
Deposits are functioning normally. As of Friday morning, Binance expected to restore withdrawals within 45 hours. It also intends to release an updated Proof of Reserves, a report showing sufficient assets to cover customer balances, after repairs are finished.
What Does the Incident Mean for Crypto Users?
This breach seems not to have broken cryptography. Early findings suggest it targeted people and internal systems around the wallets, a pattern Elliptic observed in the Bybit hack. That highlights how much a centralized exchange’s safety relies on access controls, internal permission separation, and strict security procedures.
When you keep crypto on a centralized exchange, the exchange holds it for you—a setup called custody. Your access then depends on the company’s security and choices, such as pausing withdrawals. Non-custodial services differ: you keep your coins in your own wallet and control the private keys, shifting security responsibility to you.Significant breaches often precede scams. Rely exclusively on Binance’s official channels for updates. Stay alert for fake support accounts, phishing links, and offers to “recover” funds, since genuine support will never request your seed phrase or private keys.
Remember to conduct your own research before purchasing any crypto. The views and opinions in this article belong solely to the author.
