Binance Hack: $6 Billion Stolen in Largest Crypto Theft on Record as Withdrawals Stay Frozen
Binance, the world’s largest cryptocurrency exchange, suspended withdrawals after hackers drained an estimated $6 billion from its digital wallets on Thursday, 29 October 2026, in what blockchain investigators describe as the largest cryptocurrency theft on record.
The exchange said on Friday that it would cover all customer losses from its own funds and an emergency assets fund, while about $3 billion of the stolen assets had already been frozen on blockchain networks. Withdrawals were expected to resume by Sunday morning, according to Binance co-founder Yi He.
How the breach unfolded
According to an initial investigation described by Binance late on Thursday, the attack ran through an engineer’s laptop, which gave an attacker access to a service container and allowed unauthorised withdrawal transactions to be submitted. The company said it found no evidence that wallet private keys had leaked, and it revoked the affected address authorisation.
Blockchain intelligence firm TRM Labs said the first small, discreet withdrawals began on Wednesday morning and continued into Thursday, before larger transfers from wallets used to process customer withdrawals ran for about 20 minutes on Thursday evening. The stolen funds spanned Bitcoin, Ethereum, Solana and dollar-backed stablecoins including USDT and USDC.
Binance founder Changpeng Zhao, who no longer runs the company but remains its largest shareholder, said on X that he expected user funds to be fully covered. The exchange also said it would publish a detailed technical report and an updated proof of reserves once its investigation was complete.
The numbers, and why they differ
Estimates of the haul vary because crypto prices move and tracing is still under way, so no single figure should be read as final yet. Chainalysis put the amount stolen at $5.912 billion at the time of the theft, while Binance and other reports have described the impact at about $6 billion to $6.3 billion.
| Measure | Figure reported on 30 October 2026 | Source of estimate |
|---|---|---|
| Total stolen | About $6 billion to $6.3 billion | Binance and industry reports |
| Chainalysis estimate | $5.912 billion | Chainalysis |
| Assets frozen | About $3 billion | Binance, via blockchain partners |
| Tether frozen | About $1.56 billion | Tether |
| Circle-frozen funds | About $800 million | Circle |
| Bitcoin early on Friday | Down 4.5% to $76,664 | Market reports |
| Ether early on Friday | Down 5.2% | Market reports |
| BNB early on Friday | Down 7.1% | Market reports |
The freeze is the reason the race to recover funds matters as much as the theft itself. Once stablecoin issuers and networks freeze tokens, those amounts cannot be moved by the hackers, and Binance said the verified frozen total could still rise as investigators trace more assets.
Who investigators point to — and what is not proven
TRM Labs attributed the heist to TraderTraitor, an elite North Korean hacking unit, based on what it called robust on- and off-chain intelligence, and Chainalysis told CNN it had high confidence North Korea was behind the attack. Pangolin Intelligence, a Singapore-based blockchain-tracking firm, reached the same conclusion from on-chain activity correlated with earlier incidents.
That attribution is not yet a formal finding by Binance or US authorities. Binance said its investigation had not attributed responsibility to any individual, and the FBI said on Friday that it was aware of the incident and engaged with partners to understand its scope, while the US Secret Service said its investigators were working around the clock with private-sector partners to freeze, trace and recover the funds.
North Korea has previously denied hacking allegations, and CNN reported it had sought comment from North Korea’s mission at the United Nations. If the North Korean link is confirmed, the theft would dwarf the previous record: North Korean hackers were blamed for stealing about $1.4 billion to $1.5 billion from the Bybit exchange in 2025.
What it means for ordinary crypto holders
For users, the immediate effect is practical rather than abstract: withdrawals and deposits were temporarily suspended while security checks were completed, and Binance.US was not affected, according to live updates on the incident. Binance’s repeated message to customers has been that user funds are safe and losses will be covered, a pledge that will be tested when withdrawals reopen and the promised proof of reserves is published.
The wider market felt the shock at once, with more than $1.5 billion in leveraged cryptocurrency positions liquidated over 24 hours. The sell-off landed in a week already crowded with market-moving news, from the Federal Reserve’s October rate decision to Alphabet’s third-quarter earnings, a reminder that crypto no longer trades in isolation from the rest of the financial system.
Security researchers also warned users to beware of scams exploiting the incident, with Binance itself cautioning customers not to trust unofficial links, messages or requests for account information. The full account of how the attackers got in, first reported in TechCrunch’s coverage of the paused withdrawals and in CNN’s report on the suspected North Korean heist, is still developing, and the frozen-funds total is likely to change as the tracing continues.
