Binance's $6.3 Billion Hack Explained: What Happened and Is Your Crypto Safe?

Binance, the world’s largest cryptocurrency exchange by trading volume, disclosed on October 29, 2026 that it was investigating a “potential security issue” with an estimated total impact of approximately $6.3 billion — the largest cryptocurrency theft ever reported, according to multiple outlets including CNBC, NBC News, and NPR. Binance has said user funds remain safe and that it has set aside reserves to cover the loss, but it temporarily suspended withdrawals and the full picture — including who is responsible and how much will ultimately be recovered — is still coming into focus.

Here’s what’s actually known so far, what’s still unconfirmed, and what it means if you hold crypto on an exchange.

What happened on October 29

Binance said it first flagged a “potential security issue” on Thursday, October 29, 2026, and later confirmed the incident publicly, posting on X that “the estimated total impact sits at around $6.3B,” per reporting from NBC News and Forbes.

Blockchain analytics firm TRM Labs, in a detailed writeup, estimated that about $6.36 billion left Binance-controlled wallets across ten different blockchains, with most of the outflow happening in a roughly 20-minute window starting around 20:05 UTC. Chainalysis gave a slightly different estimate, putting the value of assets drained at roughly $5.9 billion at the moment of the theft — a reminder that these figures are calculated from fast-moving on-chain data and can shift depending on which prices and timestamps are used.

Binance’s own explanation of how the attackers got in has shifted since the disclosure. The company initially pointed to a compromised employee laptop that may have given attackers access to internal systems used to approve withdrawals. It later said its “subsequent investigation has uncovered additional points of breach,” without giving further detail, according to the same CNBC and NBC reporting. That kind of evolving explanation is common in the first 24-48 hours after a major breach, but it also means the root cause isn’t fully settled yet.

How much has been frozen or recovered

Binance said it had frozen roughly $3 billion worth of the stolen assets on-chain in the hours after the theft, per CNBC’s reporting. An earlier report from Al Jazeera cited a frozen figure of about $2.54 billion, underscoring that the recovery total has been a moving target as the investigation progresses.

Stablecoin issuers Circle (USDC), Tether (USDT), and Ripple moved to help freeze funds tied to the hack once wallet addresses linked to the theft were identified, according to CNBC. Freezing stablecoins at the issuer level — something Tether and Circle have done in past hacks like the Bitget theft and the Bybit hack — only works on funds that are still sitting in identifiable addresses; once an attacker swaps into Bitcoin, privacy tools, or cross-chain bridges, issuers lose the ability to freeze that value.

Separately, Binance said it has set aside about $5 billion of its own funds to cover losses and is working with trading partners to acquire an additional $1.34 billion in cryptocurrency to make affected balances whole, per NBC News. Binance has repeatedly said “user funds remain safe,” but it’s worth being precise about what that means in practice: unlike a bank deposit, money held at a crypto exchange isn’t backed by government deposit insurance. The “safe” claim rests on Binance’s balance sheet and its willingness (and ability) to cover the gap, not a regulatory guarantee.

Who’s being blamed

Two of the industry’s most-cited blockchain forensics firms have pointed in the same direction. Chainalysis said the attack “appears to be the work of” TraderTraitor, a North Korea-linked cybercrime operation, and TRM Labs said it has “high confidence” the hack was orchestrated by the same group, according to coverage summarized across CNBC and CBC.

TraderTraitor isn’t a new name. U.S. authorities, including the FBI, have previously attributed the $1.5 billion Bybit hack in February 2025 to the same group, which is tracked under several aliases by different agencies and vendors — including Lazarus Group, APT38, BlueNoroff, and Stardust Chollima — according to a 2025 FBI advisory covered by Security Affairs. These groups are widely understood by Western law enforcement to fund North Korean weapons programs through cryptocurrency theft.

It’s important to note that this attribution, while coming from credible security firms, has not yet been confirmed by a formal law enforcement attribution (such as an FBI or Treasury statement) the way the Bybit hack eventually was. Binance itself has not named a specific attacker in its public statements. Treat the North Korea link as the leading theory backed by two independent analytics firms, not yet an established fact.

How this stacks up against crypto’s other biggest hacks

Hack	Date	Estimated loss	Status / cause
Binance	Oct 2026	~$6.3 billion	Disclosed; TraderTraitor (North Korea) suspected; ~$3B frozen
Bybit	Feb 2025	~$1.4-1.5 billion	Confirmed TraderTraitor/Lazarus; exchange covered losses via loans
BNB Bridge	Oct 2022	~$570 million	Cross-chain bridge exploit
Ronin Network	Mar 2022	~$540-625 million	Lazarus Group; Axie Infinity’s bridge
Poly Network	Aug 2021	~$610 million	Cross-chain bridge bug; most funds later returned
Coincheck	Jan 2018	~$530 million	Exchange hot wallet breach
Mt. Gox	2011-2014	~$460-470 million	Exchange insolvency; still being resolved today
Bitget	Sep 2026	~$387.5 million	Covered in our September hacks roundup

Figures above are widely cited industry estimates and vary slightly by source depending on how losses are valued and in which currency at what time. What’s consistent across rankings compiled by outlets like Benzinga is that, if the $6.3 billion figure holds up, this single incident is larger than the Bybit, Ronin, Poly Network, Coincheck, and Mt. Gox hacks combined.

What this means if you hold crypto

This hack doesn’t change how Bitcoin, Ethereum, or any other blockchain works — the theft happened at the exchange layer, not because of a flaw in the underlying networks. But it’s a sharp reminder of a distinction that’s easy to lose sight of when prices are moving: when you hold crypto on an exchange, you’re trusting that exchange’s internal security, not just the blockchain’s. The common industry phrase for this is “not your keys, not your coins” — if you don’t control the private keys to a wallet, you’re relying on whoever does.

That doesn’t mean exchanges are unsafe to use for trading, and Binance has a long track record of covering losses from past incidents, including a smaller 2019 hack where it used its SAFU insurance fund to reimburse affected users in full. But it does mean concentration risk is real: holding large amounts of crypto on any single platform, exchange or otherwise, carries a different risk profile than self-custody in a hardware wallet, and neither choice is risk-free (self-custody shifts the risk to losing your own keys or falling victim to phishing, as covered in our pieces on recent hardware wallet incidents).

This is not financial advice, and nothing here should be read as a recommendation to buy, sell, or move funds in a panic. If you’re deciding how to store crypto, it’s worth researching the tradeoffs between exchange custody and self-custody directly rather than reacting to headlines, and consulting a professional for anything involving significant sums.

What to watch next

A few things will determine how this story develops over the coming days and weeks:

• Whether the frozen/recovered total keeps climbing. Numbers reported so far (from roughly $2.54 billion to $3 billion) have already shifted once; expect further updates as stablecoin issuers and exchanges trace and freeze more addresses.
• Whether Binance resumes full withdrawals. The company suspended withdrawals while investigating; how quickly and smoothly it restores normal service will be a signal of how contained the breach actually was.
• Whether law enforcement formally attributes the attack. The TraderTraitor/North Korea link currently comes from private security firms, not a government agency. A formal FBI or Treasury attribution, as happened with Bybit, would carry more weight.
• Regulatory response. A theft of this size, especially if North Korean state-linked actors are confirmed, is likely to draw scrutiny from U.S. and international regulators already focused on exchange security standards.

We’ll continue tracking verified developments on this story as they’re confirmed by credible sources.