EL7.AI
CryptoMediumUpdated×2•Originally published 30 October 2026•Updated 30 October 2026•
4 min read

$6.36 Billion Transferred From Binance Wallets in Record Hack

Key Facts

1TRM said about $6.36 billion in assets was transferred across 10 networks, with most of the transfer taking place in about 20 minutes.
2Binance estimated the total impact at about $6.3 billion and said about $3 billion had been frozen on-chain.
3TRM estimated that the attacker still controlled assets worth about $2.4 billion.
4Bitcoin fell 3% to $76,469.82, and Ether dropped more than 3% to $2,185.83.

TRM Labs said an attacker transferred assets worth about $6.36 billion from Binance wallets across 10 blockchain networks on October 29, 2026, with most of the transfers taking place in about 20 minutes. Binance, in an update published on October 30, estimated the incident’s total impact at about $6.3 billion and said about $3 billion had been frozen on-chain by then. The scale puts the incident, according to TRM, at an unprecedented level among cryptocurrency thefts recorded by the company. TRM attributed the attack with what it described as a high degree of confidence to TraderTraitor, which it said was a North Korean hacking unit. Binance said it had not attributed responsibility to any specific individual or entity and was working with law enforcement and blockchain partners.

The two disclosed figures reflect different estimates of the incident: TRM said assets transferred from Binance wallets totaled about $6.36 billion, while Binance described its figure of about $6.3 billion as the estimated total impact. TRM said the theft was worth about four times the $1.5 billion Bybit hack in February 2025, describing it as the largest recorded cryptocurrency theft. That assessment came as Binance had not disclosed the attacker’s identity, while the blockchain analytics firm presented its attribution to TraderTraitor as a conclusion reached with a high degree of confidence. Coverage of the losses through the SAFU fund and company funds remains part of Binance’s commitment to address the incident’s financial impact. According to the platform’s official support page, the SAFU fund was established in January 2026 with $1 billion in USDC.

TRM said cryptocurrency partners had taken steps to freeze parts of the assets linked to the attack. The company estimated that Tether, Circle, Ripple and World Liberty Financial had frozen about $2.67 billion in stablecoins by its October 30 update, and that the Arbitrum Security Council had moved about $30 million in ETH and ARB beyond the attacker’s control. In a separate estimate cited by the Associated Press, Circle said it had frozen more than $800 million in coordination with law enforcement, while Tether said it had frozen more than $1.5 billion linked to the incident. TRM added that the attacker still controlled assets worth about $2.4 billion, including more than 420,000 ETH and 18,270 BTC, along with smaller amounts on other networks. These figures underscore the importance of cooperation between stablecoin issuers and blockchain networks in tracing funds and restricting access to them.

On the breach, Binance said its initial investigation pointed to the possible involvement of a compromised laptop, but the platform later reported finding additional “points of compromise.” The platform also said it had found no evidence that private wallet keys had been leaked. Binance temporarily suspended withdrawals, while the Associated Press reported that deposits were unaffected and that the company had begun restoring assets to users. The platform expected withdrawals to resume within a day or two of October 30 and said it would cover the losses. The continued suspension of withdrawals meant the incident affected the movement of funds through the platform, while an analyst at HashKey said any disruption to deposits and withdrawals at the largest digital asset trading platform could affect market makers’ ability to move capital between platforms.

The incident was reflected in digital asset prices on October 30: Bitcoin fell to a six-week low and was down 3% at $76,469.82, while Ether dropped more than 3% to $2,185.83, according to Reuters. A trader at GSR said Bitcoin’s average spot bid-ask spread on Binance widened that morning to five times its usual level, and Ether’s to 2.5 times, before narrowing slightly. These moves point to reduced trading liquidity on the platform during the first hours after the news. Binance said it would publish a detailed technical review after completing its investigation and verifying the facts, and would update its proof of reserves after remediation was complete. The company did not set a calendar date for publishing the technical review.