Published: November 1, 2026 | Last updated: November 1, 2026 (the investigation is ongoing)
Binance hack, how it happened: on October 29, 2026, attackers drained about $6.3 billion from the exchange's hot wallets in roughly 20 minutes, the largest crypto theft on record. Binance points to a compromised engineer's laptop. The FBI blames North Korea's TraderTraitor unit. Many technical details are still unconfirmed, and this guide separates what's verified from what's only reported.
Quick answer: The attackers reportedly got in through a compromised laptop belonging to a Binance engineer, reached internal infrastructure, and submitted unauthorized withdrawals. Binance says it has found no evidence that wallet private keys leaked. It has pledged to cover all losses.
Table of Contents
- What happened in the Binance hack?
- Binance hack: how it happened, step by step
- Who was behind the Binance hack?
- Where did the $6.3 billion go?
- How is Binance responding?
- What should crypto users do now?
- Is Binance safe after the hack?
- Frequently asked questions
- What we know so far
- Sources
What happened in the Binance hack?
The breach began on October 29, 2026. Binance said late that Thursday that about $6.3 billion in client assets had been affected, making it the biggest crypto hack ever recorded. The previous record was the $1.5 billion Bybit theft in February 2025.
Blockchain analytics firm TRM Labs put the figure slightly higher, at about $6.36 billion moved out of Binance wallets across 10 blockchains. Most of it left in about 20 minutes.
| Date | What happened |
|---|---|
| October 29, 2026 | Attackers move funds out of Binance hot wallets. Binance suspends deposits and withdrawals. |
| October 30, 2026 | Binance confirms about $6.3 billion affected and says roughly $3 billion is frozen on-chain. |
| October 31, 2026 | The FBI attributes the attack to North Korea's TraderTraitor. Binance says about 90% of affected assets are covered. |
| November 1, 2026 | Binance begins phased withdrawals, starting with the Bitcoin network. It reports roughly 95% coverage. |
The market felt it immediately. Bitcoin dropped more than 4% on Friday as the news spread.
Binance hack: how it happened, step by step
Binance has not published a full technical report. What follows combines the exchange's early findings with outside analysis, and it's labeled accordingly.
Step 1: A compromised engineer's laptop
Binance's initial investigation suggested a hacker made unauthorized transactions after gaining access to an engineer's compromised laptop. Binance has not said how the laptop was breached. Malware, stolen credentials and phishing are the usual routes, but that's general background, not a confirmed detail here.
Step 2: Access to internal infrastructure
Binance's October 30 update said the attacker may have gained access to a service container, an isolated environment that runs an application, and used it to submit unauthorized withdrawals. The worry wasn't just one stolen device. It was that the device became a doorway into systems that process withdrawals.
Step 3: Abusing transaction authorization
TRM Labs said the attackers ordered Binance's wallets to empty into wallets they controlled, a pattern that mirrors the Bybit hack. In plain terms: a crypto wallet is a vault, and signing systems approve who can open it. Control the approval process, and you may not need the keys.
The exchange said it found no evidence that any wallet private key was leaked. Not everyone agrees. Mark Karpeles, the former head of the collapsed Mt. Gox exchange, told Reuters the attackers had probably accessed keys for at least two Binance wallets. That dispute is unresolved.
Step 4: Draining the wallets
Once the withdrawals went through, the money moved fast. One transaction alone reportedly exceeded $2.5 billion, according to a Wikipedia summary of the incident. Binance's own post said staging began well before the theft, with signatures obtained in advance and then executed in one burst.
What's confirmed and what isn't:
| Claim | Status |
|---|---|
| About $6.3 billion affected | Stated by Binance |
| Compromised engineer laptop | Binance's initial finding |
| Service container access | Binance's initial finding, "may have" |
| Signing-system abuse | TRM Labs analysis, not confirmed by Binance |
| Private keys not leaked | Binance's position, disputed by an outside expert |
Who was behind the Binance hack?
The FBI said on Saturday, October 31, that North Korea's TraderTraitor unit carried out the attack. The same unit was behind the Bybit heist.
The early signs pointed that way. Binance noted several features matching earlier North Korea-linked thefts, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that started well before the theft, and pre-obtained signatures executed in one burst.
The FBI also said the group has been converting stolen assets into Ethereum, a common first step before laundering. The identities of individual hackers haven't been made public.
Where did the $6.3 billion go?
About $3 billion was frozen within a day. More than $2.3 billion of that was frozen by stablecoin issuers Tether and Circle, according to Reuters reporting. Tether's CEO said his company alone froze more than $1.5 billion in USDT. Ripple also froze funds tied to the hack.
Why can some assets be frozen and others can't? Stablecoins like USDT and USDC have a central issuer that can block tokens. Bitcoin and Ethereum have no such off switch. Analysts estimated roughly $3.3 billion stayed unfrozen, and Binance hasn't said what happened to it.
How is Binance responding?
It's absorbing the loss. Binance said it will cover the financial impact itself rather than pass it to users, drawing on its SAFU emergency fund, which one analyst valued at about $1.2 billion, and company reserves.
Coverage is rising. The exchange said about 90% of affected assets were restored on October 31 and reported roughly 95% on November 1. Those numbers measure replenishment from Binance's own funds. They do not mean the stolen crypto came back.
It froze everything first. Binance suspended deposits and withdrawals while it investigated, then reopened withdrawals in phases on November 1, starting with Bitcoin.
A full report is promised. Binance has committed to publishing a detailed post-incident report. Until it does, treat the technical story as preliminary.
What should crypto users do now?
You can't fix an exchange's security, but you can limit your own exposure.
- Spread your holdings. Long-term holdings don't need to sit on an exchange. A reputable self-custody wallet works, but you alone are responsible for the recovery phrase. Lose it and the funds are gone.
- Upgrade your 2FA. Use an authenticator app or a hardware key, not SMS.
- Expect scams. Big hacks bring fake "recovery" sites, bogus support agents and phishing links. Nobody legitimate will ask for your password, recovery phrase or one-time codes.
- Use official channels only. Check Binance's own announcements and withdrawal status page, not screenshots on social media.
- Know the difference in risk. The breach hit exchange infrastructure, not necessarily your personal account. A well-secured account still carries exchange-level risk.
Is Binance safe after the hack?
Binance's customer funds appear protected for now, because the company says it will cover the losses and has replenished most of them. That's not the same as a guarantee of safety going forward.
Watch for four things before you decide how much to keep on the platform:
- A technical post-incident report that explains the root cause
- Independent proof of reserves showing assets back customer balances
- Withdrawals working normally across the networks you use
- Consistent updates that match what outside investigators find
Frequently asked questions
How did the Binance hack happen?
Binance's initial investigation points to an engineer's compromised laptop, which let an attacker reach internal systems and submit unauthorized withdrawals. TRM Labs says the attackers abused wallet-emptying authorizations. Binance has not yet published a full technical explanation.
How much was stolen in the Binance hack?
Binance reported about $6.3 billion in affected assets. TRM Labs estimates $6.36 billion across 10 blockchains. It is the largest crypto theft on record, ahead of the $1.5 billion Bybit hack in 2025.
Who hacked Binance?
The FBI attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit, on October 31, 2026. Individual hackers haven't been identified publicly.
Will Binance users lose their money?
Binance says no. It has pledged to absorb the loss using its SAFU fund and company resources, and reports roughly 95% of affected assets covered as of November 1. The remaining amount mostly involves less-liquid tokens.
Are Binance withdrawals open?
Partly. Binance restarted withdrawals in phases on November 1, starting with the Bitcoin network. Availability depends on the coin and network, so check Binance's official status page.
Did the hackers steal Binance's private keys?
Binance says it has found no evidence of a private key leak. A former Mt. Gox executive disputes that, saying keys for at least two wallets were probably accessed. The question remains open.
What we know so far
The October 29 attack was the biggest crypto theft ever recorded, and the FBI has pinned it on North Korea. Binance says a compromised laptop was involved, has frozen about half the stolen value with partners, and is covering the rest from its own funds.
What's still missing is the technical root cause. Until Binance's post-incident report arrives, treat any detailed account as provisional. If you hold crypto on any exchange, tighten your 2FA, avoid recovery scams and check official channels before acting on rumors.
Sources
- Binance says $6.3bn stolen in biggest crypto heist in history: What we know (Al Jazeera, Oct 30, 2026)
- $6.3 billion Binance hack is largest crypto theft on record (CNBC, Oct 29, 2026)
- Binance's $6.3 billion hack: What we know and what comes next (CNBC, Oct 30, 2026)
- Binance resumes withdrawals following $6.3 billion hack (CNBC, Oct 31, 2026)
- A simple explainer of the massive $6.3 billion crypto heist at Binance (NPR, Oct 31, 2026)
- Binance Suspends Deposits, Withdrawals After $6.3 Billion Hack (Bloomberg, Oct 29, 2026)
- Binance Security Incident Update #2 (Oct 30)
- Binance Recovery Update #4: Withdrawals Resume in Phases (Nov 1)