Binance hack: $6.3 billion stolen in the biggest crypto heist ever. What happened

The Binance hack is now the largest theft in crypto history. Starting at about 8:05 PM UTC on 29 October (1:35 AM IST on 30 October), attackers pulled roughly $6.3 billion out of Binance's hot wallets on 10 blockchains in about three hours, according to TRM Labs and Binance's own estimate. That is about four times the previous record, the roughly $1.5 billion taken from Bybit in February 2025. About $3 billion has already been frozen, and Binance says it will cover every user loss.

What happened in the Binance hack?

The first theft hit the XRP Ledger at 20:05 UTC, when five Binance wallets sent out 233.46 million XRP in four minutes. Fifteen minutes later Binance's Bitcoin hot wallet sent 18,270 BTC, and at about 20:23 UTC its Ethereum hot wallet was swept of 167,464 ETH and 63 tokens, including 1.6 billion USDT, TRM says. Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon followed, the last of them around 23:05 UTC.

Binance suspended withdrawals on several networks at about 22:32 UTC, TechCrunch and Cointelegraph reported. Its spokesperson told TechCrunch that user funds are "completely safe".

Chart: NextDiff, from TRM Labs data as of 00:30 UTC, 30 October

How did the hackers get in?

Binance's initial investigation, quoted by CoinDesk, points to a compromised DevOps engineer's laptop. From it, the attacker reached a service container that could submit withdrawal transactions, and used it to send unauthorised ones. Binance says it found "no evidence of any wallet private key leak".

In plain English: the attacker didn't need to steal the keys. They got into the system that asks for withdrawals to be signed, so the wallets signed them as if they were normal.

TRM's on-chain analysis adds detail for Ethereum. There the attacker used EIP-7702, an Ethereum feature added in the Pectra upgrade in May 2025 that lets an ordinary account temporarily run smart-contract code. One transaction carried 50 pre-signed authorisations for consecutive nonces, so at least one would be valid, and it pointed the hot wallet at a sweeper contract the attacker controlled. The wallet was emptied 3 minutes 24 seconds later. On the nine other chains the money left through ordinary signed transfers, which TRM says points to a compromise of Binance's hot-wallet signing infrastructure. Binance has promised a detailed post-mortem but has not published one yet.

Image: TRM Labs (Binance hack analysis, 30 October 2026)

Who is behind it?

TRM attributes the attack with "high confidence" to TraderTraitor, the North Korean unit behind the Bybit theft. It cites Tornado Cash withdrawals that funded the attacker's wallet at least 36 hours earlier, the staging pattern and the pre-signed approvals. Chainalysis's Jonathan Levin says TraderTraitor is "likely", and investigator ZachXBT named the Lazarus Group. No government has formally attributed the hack yet.

How much has been frozen?

More than many expected. Tether froze about $971 million in USDT within an hour of the first theft, Circle froze about $823 million in USDC, and Ripple, World Liberty and the Arbitrum Security Council froze smaller amounts, according to TRM's timeline. Binance put the verified frozen total at $2.54 billion at 23:35 UTC and later at about $3 billion. TRM estimates about $2.4 billion is still with the attacker, including more than 420,000 ETH and the 18,270 BTC.

That split is the story's twist: stablecoins can be frozen by their issuers, while bitcoin and ether cannot, so most of what the attacker still holds is in coins nobody can stop.

Is my money on Binance safe?

Binance says yes. Co-CEO Yi He said on X that Binance will cover all hacking losses, and founder Changpeng Zhao said user funds are safe, CoinDesk reports. The cover would come from Binance's SAFU emergency fund and company money. In an update at 05:01 UTC on 30 October (about 10:30 AM IST), Binance said withdrawals were paused for a security overhaul and should resume within 48 hours, and that deposits were operating normally.

If you hold crypto on any exchange, this is a good moment to check that 2FA is on, that withdrawal-address allowlisting is enabled, and to watch only Binance's official channels: scammers use hacks like this to send fake "refund" links.

Why it matters

Markets fell: bitcoin dropped about 5% to below $77,000, ether 5.7% and BNB about 8%, CoinDesk and Cointelegraph report. The bigger lesson is for anyone who ships software. The attackers did not break the vault; they went around it. One engineer's laptop was enough to reach a system trusted to move billions, the same lesson as the PHP2Shell flaw: the weakest link is often the infrastructure around the crown jewels. Expect exchanges to add hardware-isolated signing, withdrawal rate limits and stricter checks on EIP-7702 delegations.

What's next

Watch for Binance's technical post-mortem, the restart of withdrawals, whether the remaining $2.4 billion moves through mixers or bridges, and any formal attribution from the US FBI. Totals may still change as more transfers are traced.