Binance Confirms Record $6.36B Breach, Halts Withdrawals on Every Major Network

Binance Confirms Record $6.36B Breach, Halts Withdrawals on Every Major Network

Binance confirmed on Thursday night that roughly $6.36 billion in customer assets had left its hot wallets across ten separate blockchains, making the binance hack the largest cryptocurrency theft ever recorded and forcing the world's biggest exchange to suspend deposits and withdrawals on every major network it operates.

The movement began at 20:05 UTC and was effectively finished by 20:30. Within that window, wallets controlled by Binance on the XRP Ledger, Solana, Bitcoin, Tron and Ethereum were emptied to addresses held by a single attacker. A second wave followed just under three hours later on Avalanche and Polygon. Bitcoin fell below $77,000, its lowest level in more than a month, and roughly $1.5 billion in leveraged positions were liquidated.

The figure dwarfs the $1.5 billion Bybit hack of February 2025 — until this week the largest on record — by a factor of more than four. Elliptic's chief scientist described it as "almost certainly the single largest known theft of any kind." Blockchain intelligence firm TRM Labs, which traced every transfer, attributed the attack to TraderTraitor, North Korea's elite hacking unit, with high confidence. The FBI formally confirmed that attribution on Saturday.

By Sunday, Binance had replenished roughly 90% of what was taken, drawing on its Secure Asset Fund for Users, its Futures Insurance Fund, a bitcoin reserve and corporate treasury funds. Withdrawals reopened in phases on 1 November, beginning with the Bitcoin network, then Ethereum and BNB Smart Chain. The company has promised a proof-of-reserves snapshot by 3 November.

None of that changes what happened in the first twenty minutes, when an exchange with hundreds of millions of registered users discovered that its hot wallet signing system would sign whatever it was asked to sign.

[IMAGE 1 — Binance logo on a phone screen with red price chart]
Alt: Binance logo on a phone screen with red price chart after the $6.3 billion hack

What Binance actually said

The first public signal was vague. At around 20:30 UTC, Binance posted that it was "investigating a potential security issue" and had suspended withdrawals on several networks as a precaution. Twenty minutes later it confirmed a "security incident." Co-CEO Richard Teng followed with a statement pinning the entry point on a compromised DevOps engineer's laptop, which he said gave an attacker access to a service container where unauthorised withdrawal transactions were submitted.

He framed the operation as sophisticated. The hack was "not a simple 'one-click' action," he said, but a "more complex attack process" carried out by more than one person, with a "self-destruct mechanism" used to cover tracks.

Within twenty-four hours, Binance had found "additional points of breach" and stopped describing the incident as a laptop problem. Teng acknowledged the gap directly, noting that users were asking how the exchange could prove individual balances were untouched. Binance's answer was procedural rather than technical: a proof-of-reserves snapshot taken on 31 October, published in full two days later, allowing users to verify backing at a minimum 1:1 ratio.

Binance.US, which serves American residents and runs on separate infrastructure, said it was unaffected.

Twenty minutes, ten chains

The precision of the timeline is the part that has unsettled security engineers most. On-chain records show preparation beginning at least 36 hours earlier, with three small Tornado Cash withdrawals funding an operator wallet on the morning of 28 October. A first version of the exploit code was deployed and tested on two wallets early on 29 October. A final version was rehearsed on a third wallet that afternoon, then the test funds were routed back to the operator. Four hours later the same code was installed on a live Binance hot wallet.

The theft ran as follows, all times UTC:

• 20:05–20:09 — Five Binance wallets on the XRP Ledger send 233.46 million XRP to one attacker address, leaving only minimum balances

• 20:10 — Solana and Optimism wallets drained

• 20:20 — A Bitcoin hot wallet sends 18,270 BTC, split into 1,000 BTC and 100 BTC pieces inside a single block

• 20:20 — The Ethereum hot wallet executes 50 pre-signed EIP-7702 authorizations

• 20:22 — A Tron hot wallet sends 612.7 million USDT and 46.4 million TRX

• 20:23:24 — A sweeper drains the Ethereum wallet: 167,464 ETH and 63 tokens in one transaction

• 20:41 to 23:56 — Six further sweeps of the same wallet as new funds arrived

• 23:05 — Second wave: Avalanche and Polygon wallets drained

Every XRP wallet was left holding only its minimum reserve. The Bitcoin transfer was peeled immediately, a technique that fragments a large balance into round numbers to make tracing harder. And on Ethereum, the wallet kept getting refilled and re-swept for three and a half hours, meaning inbound customer deposits were being captured in real time.

[IMAGE 2 — Timeline graphic]
Alt: Timeline of the 29 October 2026 Binance hack from 20:05 to 23:05 UTC

Where the money went

TRM valued each transfer at the price of the asset at the moment it moved. The total was $6.36 billion; at current prices the same assets are worth about $6.23 billion.

Ethereum accounted for the largest share, roughly $3.79 billion, including 200,630 ETH and 185 tokens — among them 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. Bitcoin outflows were 18,270 BTC, about $1.47 billion. Tron lost $628 million. The XRP Ledger lost $296 million. Solana lost $96 million. Arbitrum, Optimism and Base combined for about $39 million, including 74.6 million ARB. Avalanche and Polygon accounted for $28 million and $10 million respectively.

The composition matters. Nearly half the stolen value was in stablecoins — the only class of crypto asset a central issuer can freeze. That is the single reason the final loss did not match the headline figure.

How 50 signatures broke a hot wallet

The Ethereum leg is the technically significant one, and it turns on a feature most users have never heard of.

EIP-7702 shipped with Ethereum's Pectra upgrade in May 2025. It lets an ordinary wallet hand control of its own behaviour to a smart contract by signing an authorization. Once signed, every call to that wallet executes the contract's code, and the arrangement persists until the wallet signs a new authorization.

At 20:20 UTC, the operator submitted one transaction containing fifty of those authorizations. Each was signed by the Binance hot wallet and each pointed it at a sweeper contract that would accept instructions only from the operator.

The trick is the nonce. Every wallet keeps a running count of transactions, and an authorization is valid only at the count the wallet has reached at the moment it executes. A busy exchange hot wallet's count climbs constantly. By pre-signing fifty consecutive nonces, the attacker guaranteed that at least one would still be valid when the transaction landed. One matched. That was sufficient.

Three minutes and 24 seconds later, the operator told the compromised wallet to send its entire balance to an address it controlled. The delegation stayed in place. Every subsequent deposit into that wallet was swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56. The wallet also served as executor for a separate Binance smart account, which gave the attacker the ability to pull 823 million USDC from it.

The unanswered question

The initial phishing explanation covered Ethereum and left nine chains unexplained. In the same half-hour window, Binance wallets on the XRP Ledger, Arbitrum, Avalanche, Optimism and Base, a Bitcoin hot wallet, a Tron hot wallet and a Solana wallet all sent funds to the attacker through ordinary signed transfers. A second Ethereum hot wallet moved 28,006 ETH, 55.7 million USDT and 25.9 million RLUSD the same way, with no delegation at all.

Those wallets use different chains, different key types and different signing schemes. All produced valid signatures for the attacker within about thirty minutes.

TRM's assessment is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing, across chains. The batch of fifty pre-signed authorizations suggests the access was either time-limited or had to be requested through a system rather than lifted wholesale from a laptop. Binance has not published a root cause, and until it does, the "compromised engineer's laptop" line explains the doorway but not the building.

The freezes

Stablecoin issuers moved faster than most incident response teams manage in a full day.

Tether froze 971.1 million USDT in the main receiving wallet at 21:01 UTC, thirty-seven minutes after the primary sweep. Later sweeps landed in that same frozen wallet, which now holds 1.175 billion USDT. Tether also froze 205 million USDT across two attacker wallets on Ethereum, 378.7 million USDT on Tron, 8.4 million USDt on Avalanche and 6.2 million USDT0 on Polygon.

Circle froze 823 million USDC at 21:04, in coordination with law enforcement. Ripple froze 40.5 million RLUSD at 22:01 and, critically, also froze RLUSD inside the compromised Binance wallet so new deposits could not be swept — Teng later credited Ripple with stopping roughly $200 million from moving. World Liberty Financial froze 27.8 million USD1 at 22:10.

At 00:08 UTC, Arbitrum's Security Council used emergency powers to force two transfers out of the attacker's wallet on its network, recovering 8,426 ETH and 74.6 million ARB, about $30 million.

Total frozen: approximately $2.7 billion, roughly 42% of what was taken.

Racing the freezes

The attacker knew stablecoins were the weak point and converted them before issuers could act, at heavy cost.

About 325 million USDT was sold to professional fillers and market makers through UniswapX and other intent-based contracts in exchange for roughly 122,300 ETH. That implies an effective price near $2,650 per ETH while ETH traded between $2,300 and $2,350 — a discount above 10%, paid purely for speed. A second wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH against it before the protocol froze the affected markets. On Tron, 300 million USDT went into JustLend.

The result is that the attacker now holds more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion, in assets no issuer can freeze. That residual alone exceeds any previous crypto theft, and it is moving through a Bitcoin peel chain designed to slow investigators down.

Who is TraderTraitor?

TRM attributed the attack to TraderTraitor, the North Korean unit the FBI named as responsible for Bybit in February 2025. The pattern matches earlier state-linked heists: small Tornado Cash withdrawals funding an operator wallet, staging that began days in advance, and signatures obtained ahead of time then executed in a single burst.

North Korea has consistently denied involvement. The regime's cyber apparatus is estimated by Oxford's Dr Edward Howell to fund between 40% and 50% of its weapons of mass destruction programme. Binance's stolen funds are, functionally, a line item in a defence budget.

The laundering is already diverging from the Bybit playbook. Bybit's aftermath leaned heavily on bridges; this one has run through market makers and lending protocols, which are harder to freeze and harder to correlate.

Binance hack refund: what Binance promised

Binance pledged to absorb the entire loss. "Binance will fully cover the financial impact of the funds stolen in this incident," it said, adding that customer funds were "completely safe." It set aside $6 billion and drew on the $1 billion Secure Asset Fund for Users, part of the Futures Insurance Fund and its own treasury to rebuy tokens.

That the SAFU fund had to be touched at all is notable. It exists for exactly this scenario and covers roughly a sixth of what was stolen on its own, which raises uncomfortable questions for smaller exchanges holding similar reserves.

The US Secret Service is assisting with tracking. Binance has not disclosed how much of the $2.4 billion residual it expects to recover, and the honest answer from most investigators is that a large portion will likely never come back.

Market fallout

Bitcoin dropped 5% to $76,944 shortly after midnight UTC, recovering toward $78,000 later. Total crypto market capitalisation fell 1.4% to $2.73 trillion. Robinhood and Coinbase shares both slid.

The reaction was markedly calmer than Bybit's 8% drawdown, and the reason is structural: little of the stolen haul was BTC, and a growing share of bitcoin supply now sits in spot ETFs, corporate treasuries and sovereign holdings well away from any exchange hot wallet. The market read the event as a Binance problem rather than a Bitcoin problem.

Whether that holds depends on what the proof of reserves shows on 3 November. A shortfall would turn a custody story into a solvency story.

What is still unresolved

There is no root cause. There is no confirmed recovery figure. Roughly $2.4 billion remains in attacker-controlled wallets, none of it converted to fiat. The proof of reserves is unpublished. Withdrawals are phased and network-by-network rather than fully restored.

What Binance users should do now

The practical advice has been consistent across every security firm that has weighed in, and it is worth following in order.

Check balances through the official app or a typed-in URL. Never through a link in an unsolicited message.

Expect a wave of fakes. The FBI, McAfee and NordVPN have all warned about emails claiming your funds are at risk, fake support accounts offering help, and messages urging you to move crypto to a "safe" wallet. Binance emails carry an anti-phishing code you set in account security settings — if it is missing, the mail is fake.

Never read out a 2FA code to a caller. If someone on the phone asks you to read a code that just arrived, that code is the key to your account.

Treat "recovery agents" as unverified. Nobody legitimate charges an upfront fee to file a claim on your behalf.

Audit API keys and connected wallets. Old approvals linger, and they are what attackers use once a platform is compromised.

Move long-term holdings to self-custody. An exchange balance is a claim on someone else's hot wallet — as six billion dollars' worth of users discovered at 20:05 UTC on Thursday.

Frequently asked questions

Is my money safe on Binance right now?

Binance says customer funds are fully backed and that it will absorb all losses from its own reserves and treasury. Proof of reserves is due 3 November. Verify balances in the official app only.

Who hacked Binance?

TRM Labs attributed the attack to TraderTraitor, a North Korean state-linked unit, with high confidence. The FBI formally confirmed the attribution on 31 October 2026.

How much was stolen from Binance?

Approximately $6.36 billion across ten blockchains, the largest crypto theft on record. About $2.7 billion has been frozen by stablecoin issuers and Arbitrum's Security Council.

Has Binance resumed withdrawals?

Withdrawals reopened in phases from 1 November, starting with the Bitcoin network, then Ethereum and BNB Smart Chain. Remaining networks are being restored progressively.

Is Binance.US affected?

No. Binance.US said it runs on separate infrastructure and was not affected by the breach.

Will Binance refund stolen funds?

Binance has committed to absorbing the full loss from its own funds rather than passing it to users, and says roughly 90% has already been replenished.

Can stolen crypto be frozen or recovered?

Only stablecoins can be frozen by their issuers, which is why Tether, Circle, Ripple and World Liberty Financial acted within minutes. Bitcoin and ETH already moved to attacker wallets cannot be frozen and may take years to recover.

Should I move my crypto off Binance?

For long-term holdings, yes. Exchange balances depend on the platform's hot wallet security, which is exactly what failed here.

The bigger picture

Jennifer Craven, an international commercial fraud expert at Pinsent Masons, put the systemic risk plainly: if a platform as sophisticated as Binance can be hit like this, regulators will ask what it means for smaller, less mature venues. The Bank of England has separately warned that AI-assisted attackers can find and exploit vulnerabilities faster than institutions can patch them.

Binance will survive this. It has the balance sheet, the freezes were fast, and the withdrawal queue is moving. What it cannot buy back is the assumption that the largest exchange is the safest place to leave your coins. That assumption cost $6.3 billion this week, and the last $2.4 billion of it is still sitting in a wallet nobody controls but one operator in Pyongyang.