Binance hack puts losses at about $6.3 billion, with $3 billion frozen
Key Facts
Binance said its hot wallets were breached at about 20:05 UTC on October 29, 2026, resulting in the loss of an estimated $6.3 billion in tokenized assets. The company put the incident's total impact at the same amount in its initial update and said it had worked with blockchain industry partners to freeze about $3 billion on-chain through October 30. The update distinguishes the value of the assets the company says were lost from the portion that could be frozen. On October 31, the U.S. Federal Bureau of Investigation said North Korea was responsible for stealing more than $6 billion in virtual assets from the platform. The bureau named the activity “TraderTraitor,” while Binance said it would cover the losses from its SAFU fund and corporate funds.
TRM Labs said a tracker moved about $6.36 billion from Binance wallets across ten blockchains, with most of the amount withdrawn over about 20 minutes starting at 20:05 UTC on October 29. The research firm's estimate is higher than Binance's approximate figure of $6.3 billion, but the two figures are estimates from different sources. According to TRM, preparations for the attack began at least 36 hours before the theft, putting the rapid transfers at the end of an operation it said was preceded by preparations. The research firm linked the attack to the North Korean TraderTraitor group with high confidence. TRM described the incident as the largest cryptocurrency theft it had recorded, estimating it at about four times the $1.5 billion Bybit hack in February 2025.
Binance said its initial investigation indicated that a DevOps engineer's laptop may have been compromised, enabling access to a service container and the submission of unauthorized withdrawal transactions. The company added that it had found no evidence that wallet private keys were compromised, saying: “We found no evidence that the private keys of any wallet were compromised.” The updates in its statement disclosed no further details about the course of the investigation or the attackers' identities; on October 31, the FBI separately attributed the attack to North Korea. Binance's account of how the service was accessed remains an initial finding of its investigation, while the bureau's statement on responsibility came later. The platform said user funds were safe and that it would cover the losses from its own resources and the SAFU fund.
Binance temporarily suspended withdrawals for security checks, while saying deposits continued normally. In an October 31 update, the company said it had allocated more than $6.34 billion of its funds to cover the losses and that the share of affected assets it had replenished had risen to about 90%, from about 80% in the previous update. Binance Support then said on November 1 that withdrawals were beginning to resume in stages and that coverage of affected assets had reached about 95%. According to the update, the remaining 5% comprised less-liquid tokens still being replenished, while the announcement set the first phase of withdrawal resumption for that day between 06:00 and 09:00 UTC. The reported figures reflect the company's shift from suspending withdrawals during checks to gradually resuming them, alongside an increase in the share of assets it said it had covered.
In the market, Bitcoin fell 3.2% on the evening of Thursday, October 29, to below $79,000, according to the Associated Press. The agency reported that Circle froze assets linked to the incident worth more than $800 million, and that Tether froze the equivalent of more than $1.5 billion — more than $2.3 billion between the two companies. This coincided with Binance's announcement that it had frozen about $3 billion on-chain with partners; the figures came from different sources and refer to what each said it had frozen. The FBI said TraderTraitor actors were converting the stolen assets primarily into Ethereum. The bureau called on virtual asset service providers, blockchain node operators and decentralized finance services to block transactions linked to addresses used by the attackers to launder the stolen assets.