Transfers of about $6.36 billion from Binance wallets in record hack
Key Facts
Binance confirmed a security incident and estimated its total impact at about $6.3 billion in an announcement issued on October 30, 2026, saying it would cover the losses. In a separate analysis, TRM Labs estimated that an attacker moved about $6.36 billion from the platform’s wallets across 10 blockchains on October 29. The company said most of the transfers took place over about 20 minutes, beginning at 20:05 UTC. The platform’s estimate of the total impact therefore differs from TRM’s estimate of the transfers it tracked on-chain, and the two figures are not a single number attributed to the same source. Binance said its partners had frozen about $3 billion in on-chain assets by the time of its announcement.
TRM provided timing and network details for the activity it tracked, saying funds left Binance wallets across 10 blockchains and that most of the transfers occurred in a brief period of about 20 minutes. That period began at 20:05 UTC on October 29, according to the company’s analysis. TRM estimated the transfers at about $6.36 billion, while Binance cited a total impact estimate of about $6.3 billion in its statement the following day. Binance said its partners had worked to freeze the affected assets and that about $3 billion had been frozen on-chain by then. The company said it would use its SAFU fund and its own funds to cover all losses, and said user funds were safe.
In an initial explanation of how the incident occurred, Binance said it may have involved the compromise of a laptop belonging to a DevOps engineer. It added that this may have given the attacker access to a service container and allowed the attacker to send unauthorized withdrawal transactions. The company said it had found no evidence that wallet private keys had been leaked. However, the Associated Press reported that a subsequent investigation uncovered additional points of compromise, after the initial investigation had pointed to the possibility that the laptop was compromised. This means the laptop explanation was presented as an initial possibility, while the agency said other points of compromise emerged at a later stage of the investigation.
TRM attributed the attack with high confidence to North Korea’s TraderTraitor group, saying its estimate of the transfers made the incident the largest cryptocurrency theft it had recorded. The Associated Press also quoted Chainalysis as saying it believed the North Korean TraderTraitor group carried out the hack. The difference in the companies’ wording sets clear limits on the published attribution: TRM described its assessment as high confidence, while Chainalysis said the group was likely responsible. The identification of the perpetrators therefore remained an attribution by blockchain analytics firms, rather than a settled conclusion in Binance’s announcement. Binance said it was working with law enforcement partners to confirm the perpetrators’ identities and pursue them.
The Bybit incident provides context for comparison with previous cryptocurrency platform hacks. The Associated Press estimated that Bybit suffered losses of $1.5 billion in a hack in February 2025, and said the FBI attributed that attack to North Korea and the TraderTraitor group. TRM’s estimate of $6.36 billion in Binance transfers exceeds the Bybit figure cited in the agency’s report, with each estimate remaining tied to the incident and source that reported it. In a broader context, the agency quoted South Korea’s intelligence service as estimating in December 2022 that North Korean hackers had stolen virtual assets worth 1.5 trillion won, or $1.1 billion, over the previous five years. The estimate said more than half of that amount was stolen in 2022 alone.
On services, the Associated Press reported that deposits were unaffected, while withdrawals were temporarily suspended during the security review. The agency said Binance had begun restoring assets to users and that withdrawals were expected to resume within a day or two as of October 30, 2026. The platform pledged to cover the losses from its SAFU fund and company funds, while saying user funds were safe. The available materials did not specify when withdrawals would resume after that expected window. Binance said it would publish a detailed technical review after the investigation was complete and the facts had been verified, and would update its proof of reserves after processing was complete.