AI-assisted research analysis by FutureKnowledge. Sources checked 30 October 2026. This is not investment advice.
Reviewed by FutureKnowledge: figures, dates and attributions were checked against the linked sources before publication.
Binance, the world’s largest crypto exchange, says a hack on 29 October had an estimated impact of $6.3 billion, the largest crypto theft on record, with about $3 billion frozen so far.
What happened in the Binance hack
In a security incident update dated 30 October, Binance said its initial investigation suggests a DevOps engineer’s laptop was compromised, giving an attacker access to a service container used to submit unauthorised withdrawal transactions. It said it had found no evidence of a wallet private key leak, estimated the total impact at about $6.3 billion, and said roughly $3 billion had been frozen on-chain with blockchain partners. Deposits and withdrawals were suspended and the affected address authorisation revoked.
The first public signs came on Thursday, when users reported funds draining from Binance wallets and the exchange paused withdrawals on several networks as a precaution, TechCrunch reported. Blockchain analytics firm TRM Labs said about $6.36 billion left Binance wallets across 10 blockchains, most of it within roughly 20 minutes, according to Forbes.
The mechanics described by TRM, as summarised by The Hacker News, involved preparation over at least 36 hours, then a single transaction at 20:20 UTC containing 50 pre-signed authorisations, followed about three and a half minutes later by an instruction sending the hot wallet’s balance to an attacker address. Binance co-chief executive Richard Teng said it was not a “one-click” action and that the company had not attributed responsibility to any individual. Binance later said it had found further points of breach beyond the laptop.
How big is the $6.3 billion Binance hack?
Estimates differ by source and timing. Chainalysis put the theft at about $5.9 billion at the time it happened, roughly four times the $1.5 billion stolen from Bybit in February 2025, the previous record, Forbes reported. Elliptic estimated $6.43 billion. At one point the attacker’s wallets held more than $5.7 billion, including about $1.5 billion in bitcoin and $1.5 billion in USDT, according to Arkham data cited by CoinDesk. Binance’s own figure of about $6.3 billion is used here as the headline number.
Relative to Binance’s size, the loss is significant but not existential on the figures available. CoinDesk, citing DefiLlama, said Binance held about $144 billion in assets before the hack, so the theft is around 4% of that.
Freezes and who pays
Stablecoin issuers acted quickly. Tether chief executive Paolo Ardoino said Tether froze more than 1.56 billion USDT, and Circle chief Jeremy Allaire said Circle froze more than 800 million USDC, Forbes and CoinDesk reported. The Hacker News said Tether, Circle, Ripple and World Liberty Financial together froze about $2.67 billion in stablecoins, and Elliptic counted about $2.84 billion frozen in total. Volatile assets such as bitcoin and ether cannot be frozen this way, which is why most of the remaining exposure sits in BTC and ETH.
Binance said it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, and that user funds are safe. SAFU holds about 15,000 BTC, worth roughly $1.17 billion, Forbes reported citing The Block. Binance plans to publish a technical post-mortem and an updated proof of reserves, and expects withdrawals to resume within 48 hours, according to The Hacker News and TheStreet. The stablecoin freezes add to the policy debate FutureKnowledge covered when the OCC finalised its GENIUS Act stablecoin rule.
Who is behind it
TRM Labs and Chainalysis both attributed the attack to North Korea with high confidence, linking it to the group known as TraderTraitor; Chainalysis said funds from September’s Bitget exploit were mixed with the Binance proceeds. Elliptic urged caution, citing differences in laundering methods and the lack of a published root cause. Binance itself has not attributed the attack. Attribution should be treated as provisional until officials or Binance confirm it.
Market reaction
Bitcoin fell about 4.8% to below $77,000 and BNB about 8% as news spread, CoinDesk reported. On 30 October, bitcoin was down 3.3% at about $77,283, TheStreet reported, on a day when US tech stocks were also falling. Crypto prices were already under pressure from rate expectations after the Fed held rates with two officials backing a hike.
How it affects India and crypto users
Indian crypto users who hold assets on offshore exchanges face the same immediate issue as users elsewhere: funds cannot be withdrawn until Binance reopens the service. More broadly, the hack is a reminder that exchange custody carries operational risk that is separate from price risk, and that recovery depends on an exchange’s own reserves and its willingness to pay.
Who is more or less exposed
- More exposed: users and trading firms with balances held on Binance during the withdrawal pause; holders of exchange-linked tokens such as BNB; lending protocols the attacker used, such as Aave, which CoinDesk said the attacker borrowed against.
- Less exposed: holders who self-custody; holders of stablecoins whose issuers can freeze stolen tokens; users of exchanges with no link to the incident.
Scenarios to watch
The table below sets out conditional scenarios, not predictions.
| If… | Then a plausible outcome is… |
|---|---|
| Withdrawals resume within 48 hours and losses are fully covered | Confidence could stabilise, though some outflows from Binance are likely as users test access |
| Withdrawals are delayed or the post-mortem reveals wider breaches | Pressure on BNB and on exchange balances could deepen |
| Frozen stablecoins are returned to Binance | Net losses could fall well below the headline $6.3 billion |
| Attackers launder BTC and ETH through mixers or bridges | Recovery of the remaining assets could be limited, and regulators may press harder on exchange security |
What to watch next
- Whether Binance meets its 48-hour target to reopen withdrawals.
- Binance’s technical post-mortem and updated proof of reserves.
- Movement of the roughly 18,270 BTC that analysts are tracking from attacker wallets.
- Any official US statement on North Korean involvement and regulatory responses on exchange security.
Bottom line
The Binance hack is the largest crypto theft on record by a wide margin. Fast stablecoin freezes have limited the damage, and Binance has pledged to cover all losses from its reserves. The key tests now are whether withdrawals reopen on schedule and whether the post-mortem shows the breach is fully contained.
Method note
This analysis compared Binance’s official security incident update with reports from CoinDesk, Forbes, TechCrunch, The Hacker News and TheStreet, which in turn cite Chainalysis, TRM Labs, Elliptic and Arkham. Loss estimates vary by firm and timing; Binance’s figure is used for the headline. Attribution to North Korea comes from analytics firms and has not been confirmed by Binance.