Binance Suffers Record $6.3 Billion Hack — Possibly the Largest Crypto Theft in History

The world’s largest cryptocurrency exchange, Binance, has confirmed a major security incident that impacted an estimated *$6.3 billion* in digital assets on October 29, 2026. If the figure holds, it would be the biggest crypto heist on record — roughly four times larger than the $1.5 billion Bybit hack of February 2025.

What Happened

According to Binance’s preliminary findings, the attack appears to have begun with the compromise of a DevOps engineer’s laptop. This gave the attacker access to an internal service container, from which unauthorized withdrawal transactions were submitted.

Co-CEO *Richard Teng* said in a direct statement:

 “Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions. To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual. So far, we have found no evidence of any wallet private key leak.”

Binance later said its investigation had uncovered *additional points of breach* beyond the initial laptop compromise. Most of the funds left Binance hot wallets across roughly 9–11 blockchains in about 20 minutes, starting around 20:05 UTC on October 29.

Seems token recovery already began.

Another little detail in addition to the effort described, users pay trading fees on Binance in the coins they trade, so Binance's naturally accumulates all tokens they list.

Your funds are SAFU! https://t.co/fGlRUeMUHQ

— CZ 🔶 BNB (@cz_binance) October 30, 2026

Types of Assets Stolen
The $6.3 billion was not a single cryptocurrency. It was a multi-chain drain from Binance hot wallets. On-chain analysis from firms including Elliptic, Bitquery, and Arkham shows the following major components:

– Ethereum (largest share, approximately $3.7–3.8 billion): Large amounts of ETH, roughly 1.6–1.9 billion USDT, about 823 million USDC, plus dozens of other tokens (including PEPE, UNI, ENA, LINK, wBETH and more).
– Bitcoin: Around **18,270 BTC* (roughly $1.4–1.5 billion).
– TRON: Significant USDT and TRX.
– Other chains: Solana (SOL), XRP Ledger, Arbitrum, and smaller amounts on additional networks.

Stablecoins (especially USDT and USDC) formed a very large portion of the total. This is why issuers were able to freeze a substantial share quickly. The remaining unfrozen assets are mostly *ETH and BTC*, which cannot be frozen by token issuers.

Binance’s Official Response
Binance has repeatedly stated that user funds are safe and that it will cover all losses.

Key points from the exchange and its leadership:

– Losses will be covered from the *SAFU (Secure Asset Fund for Users)* and company funds.
– Approximately *$3 billion* has been frozen on-chain so far (with help from blockchain partners).
– Deposits remained largely unaffected / operating normally in later updates.
– Withdrawals were temporarily suspended while security checks and a withdrawal-service revamp were carried out. Binance expected to begin resuming withdrawals within roughly 45–48 hours.
– No evidence of private key leakage.
– The company is working with law enforcement and blockchain intelligence firms and will publish a detailed technical post-mortem once facts are fully verified.

Yi He (co-CEO) also confirmed that Binance would cover “all hacking losses.” Changpeng Zhao (CZ) publicly stated that user funds would be covered.

Freezes and Recovery Efforts
Stablecoin issuers acted quickly:
– Tether froze nearly $1.57 billion.
– Circle froze more than $800 million.
– Additional freezes came from Ripple, World Liberty Financial, and others, bringing the total frozen amount to roughly $2.7–3 billion.

Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored unit linked to the broader Lazarus Group. The same group has been linked to previous large exchange hacks, including the 2025 Bybit incident. TRM Labs described the Binance attack as a “watershed moment.”

Market Impact

Cryptocurrency prices fell after the news. Bitcoin dropped to the $76,000–$77,000 range, with Ether and other major assets also declining. The incident has renewed questions about the security of centralized exchanges, even as Binance emphasizes that customers will be made whole.