At about 4:05 p.m. US Eastern time on Thursday 29 October 2026, the first unauthorised transfer left a Binance hot wallet on the XRP Ledger. Within roughly twenty minutes, according to the blockchain analytics firm TRM Labs, about $6.36 billion had been moved out of Binance wallets across ten blockchains. In Pakistan it was just after 1 a.m. on Friday; in Dubai, just after midnight.
It is the largest cryptocurrency theft ever recorded, more than four times the $1.5 billion taken from Bybit in February 2025. Elliptic's chief scientist went further and said it "is almost certainly the single largest known theft of any kind."
This guide sets out what is known as of 1 November 2026: what happened, how much was taken and from where, how the attackers got in, who is being blamed, and what Binance says it will do for customers. The story is three days old, so where something is a claim or an early finding, we say so.
The short version
- What: About $6.3 billion in crypto stolen from Binance's hot wallets on 29 October 2026, most of it in about 20 minutes.
- Where: Ten blockchains. Ethereum alone accounted for about $3.8 billion and Bitcoin for about $1.5 billion (18,270 BTC).
- How: Binance's preliminary finding is a compromised engineer's laptop, followed by "additional points of breach". Binance says it found no evidence of a private key leak.
- Who: TRM Labs, Chainalysis and the FBI point to TraderTraitor, a North Korean unit the US Treasury links to the Lazarus Group. This is an assessment, not a court finding.
- Recovered: About $3 billion frozen, mostly stablecoins frozen by Tether and Circle.
- Customers: Binance says it will absorb the loss. It reports about 95% of affected assets replenished and began reopening withdrawals on 1 November.
What happened in the Binance hack?
Binance runs two kinds of wallets. Cold wallets hold most customer assets offline. Hot wallets are connected to the internet so that withdrawals can be processed automatically, and they hold enough to meet day-to-day demand. On an exchange the size of Binance, "enough" is billions of dollars.
The attackers did not break the blockchains. They gained the ability to authorise withdrawals from Binance's own hot wallets, then used it on as many chains as they could before they were cut off. Binance halted withdrawals and trading on affected services, and removed the attackers' permissions from its hot wallets a little over four hours after the first transfer.
Binance hack timeline
Times are US Eastern (ET) on 29 October unless stated. Pakistan (PKT) is nine hours ahead and the UAE eight.
| Time (ET) | What happened |
|---|---|
| 4:05 p.m. | First transfer, on the XRP Ledger (TRM Labs; Chainalysis puts the start "around 4:20 p.m.") |
| 4:20 p.m. | Transfers begin on Ethereum and Bitcoin |
| 4:24 p.m. | Main Ethereum transaction, 64 transfers combined |
| ~4:25 p.m. | About $6.3 billion gone across ten chains |
| 5:01 p.m. | Tether freezes attacker wallets; Circle follows three minutes later |
| 7:05 p.m. | Further transfers on Avalanche and Polygon |
| 7:56 p.m. | Last Ethereum transaction |
| 8:10 p.m. | Binance removes the attackers' permissions from its hot wallet |
| 30 Oct, 1:15 a.m. | Attackers move 17,260 ETH to a new address |
| 31 Oct | FBI publicly attributes the theft to TraderTraitor; Binance says 90% of losses replenished |
| 1 Nov | Bitcoin withdrawals reopen, then stablecoins on Ethereum and BNB Chain; 95% replenished |
Sources: TRM Labs, Chainalysis and Binance timelines as compiled by Wikipedia; CBS News; crypto.news.
How much was stolen from Binance, and from which blockchains?
Estimates range from $6.3 billion to $6.4 billion depending on prices at the moment of measurement. The breakdown by chain, as compiled from analytics firms:
| Blockchain | Approximate value stolen |
|---|---|
| Ethereum | $3.8 billion |
| Bitcoin | $1.5 billion (18,270 BTC) |
| Tron | $628 million |
| XRP Ledger | $296 million |
| Solana | $96 million |
| Arbitrum, Optimism, Base | $39 million |
| Avalanche | $28 million |
| Polygon | $10 million |
The Ethereum figure includes large amounts of the dollar stablecoins USDT and USDC that sit on Ethereum. That turned out to matter a great deal, because stablecoins can be frozen by the company that issues them. Bitcoin and ether cannot.
How did the hackers get into Binance?
Binance's first explanation was a compromised laptop belonging to a DevOps engineer, through which the attackers made unauthorised withdrawals. A later internal review found "additional points of breach", and Binance has said it "found no evidence of any wallet private key leak". A full technical report is promised once the investigation closes.
Two further details have come out:
- Binance co-CEO Richard Teng said the attackers abused EIP-7702, an Ethereum upgrade that lets an ordinary wallet temporarily delegate its powers to a piece of smart contract code. Earlier technical write-ups pointed to malicious Ethereum wallet authorisations.
- Kok Tin Gan, chief executive of the security firm NyxLab (which does not work for Binance), suggested one signature may have handed the attacker a full-access token to a hot wallet that never expired. That is outside analysis, not a confirmed finding.
Analysts also believe the attack was prepared at least 36 hours in advance, and Axios reported that the attackers used a self-destruct mechanism that wiped their tools and traces, which slowed the investigation.
The pattern is familiar. The Bybit theft in 2025 also started on a single developer's machine at a supplier. For the practical lesson for any business, see our follow-up: one laptop, $6.3 billion: what the Binance hack teaches every business about security.
Who hacked Binance?
The blockchain analytics firms that track stolen funds converged on one answer within a day:
- TRM Labs attributed the theft to TraderTraitor, which it called North Korea's elite hacking unit: "We make this judgment with high confidence."
- Chainalysis chief executive Jonathan Levin said the hack "was likely done by DPRK group TraderTraitor", citing links to an earlier hack.
- The investigator ZachXBT said the attacker was "likely Lazarus".
- On Saturday 31 October the FBI also named TraderTraitor and said the funds were being prepared for "further laundering stages".
The US Treasury treats TraderTraitor as part of the wider Lazarus Group, the North Korean state hacking operation behind the Bybit, Ronin and many other thefts. We cover who they are and how they work in Lazarus Group and TraderTraitor: the North Korean hackers behind the Binance hack.
One caution: attribution in crypto rests on wallet-tracing patterns, code reuse and intelligence, and an anonymous source quoted by CoinDesk noted the hack was not yet "definitively" attributed. Binance's own co-CEO said early on that the investigation had not identified the attackers.
How much of the stolen money has been frozen or recovered?
About $3 billion has been frozen, according to Binance. Chainalysis puts it at about $2.8 billion and TRM Labs at about $2.7 billion. Most of that is stablecoins:
- Tether froze attacker wallets 56 minutes after the first transfer, and Circle (the issuer of USDC) followed.
- World Liberty Financial froze USD1 and WLFI tokens tied to the attackers.
- The lending protocol Aave froze its markets across 16 networks after the attacker borrowed about $44.6 million in ether against stolen USDT.
What cannot be frozen is the Bitcoin and ether. TRM Labs estimates about $2.4 billion in BTC and ETH will never be recovered. ZachXBT traced funds moving into Ethereum via the cross-chain service THORChain, and the FBI says the hackers are converting the proceeds into ether. As of 30 October none of it had been cashed out into ordinary money, a process that can take weeks or years.
The US Secret Service says it is working with private-sector partners to trace, freeze and recover the funds.
Is my money safe on Binance?
Binance's position is that customers will not lose anything. In a 31 October update it wrote: "Binance will absorb the financial impact of these stolen funds, not our users." Teng said in a video that only Binance's corporate holdings were targeted, and that "your assets are safe".
What Binance says it has done, as of 1 November 2026:
- Set aside more than $6.34 billion from its Secure Asset Fund for Users (SAFU), its futures insurance fund and its corporate treasury.
- Replenished about 95% of the affected assets, with the ten largest (BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC) described as 100% backed.
- Reopened Bitcoin withdrawals on 1 November, followed by USDT, USDC and ETH on Ethereum and USDT, USDC and BNB on BNB Chain. Other networks are opening in phases.
- Taken a fresh proof of reserves snapshot at 00:00 UTC on 31 October, with the full cryptographic proof expected by 3 November.
That is a strong position on paper, and Binance has a balance sheet that NBC put at about $167 billion. But "the exchange says so" is not the same as "verified". We walk through what has and has not been proven in Binance funds after the hack: reserves, withdrawals and the proof of reserves report.
What should Binance users do now?
- Do not panic-withdraw into a scam. Fake "Binance recovery" pages and support accounts appear within hours of every incident. Only use the official app or binance.com, and never share a seed phrase or 2FA code with "support".
- Check your balances in the app and download a statement for your records.
- Expect delays on less common networks while withdrawals reopen in phases.
- Watch for the proof of reserves result and Binance's incident report.
- Rethink concentration. If you hold savings you cannot afford to have frozen for days, consider moving part of them to a hardware wallet you control. Our guide for Pakistani crypto users after the Binance hack covers this step by step.
Frequently asked questions
How much money was stolen in the Binance hack?
About $6.3 billion, with estimates up to $6.4 billion. It is the largest crypto theft on record, ahead of Bybit's $1.5 billion in February 2025.
When was Binance hacked?
On Thursday 29 October 2026, starting at about 4:05 p.m. US Eastern time (about 1 a.m. on 30 October in Pakistan). Most of the money left in about 20 minutes.
Who hacked Binance?
TRM Labs, Chainalysis and the FBI attribute it to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. This is an assessment by investigators, not a court ruling.
Did Binance users lose money?
Binance says no customer will bear the loss and that it is covering it from its own funds. As of 1 November it reported 95% of affected assets replenished.
Are Binance withdrawals working?
They began reopening on 1 November 2026, starting with Bitcoin and then stablecoins on Ethereum and BNB Chain. Other networks are reopening in phases.
Was Binance.US affected?
Reporting so far concerns Binance.com's hot wallets. Binance.US is a separate company; check its own status page if you use it.
Sources
Wikipedia: 2026 Binance hack for the compiled timeline and chain breakdown; CBS News for TRM Labs, Chainalysis and FBI attribution; CoinDesk on attribution; NBC News for Binance's statements and frozen funds; crypto.news for the withdrawal reopening and replenishment figures. Figures as of 1 November 2026.
