Skip to content
audiotale.net
Sign in
NewsNews

Binance $6.3 billion hack: what Binance, TRM Labs and Chainalysis say so far

Binance estimates a $6.3 billion security incident, blames a compromised DevOps laptop and promises to cover losses; analysts point to North Korea.

audiotale.net team

· 6 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What happened
  3. Background
  4. The numbers
  5. What it means
  6. What we don't know yet
  7. What to watch next
  8. Sources

Binance says a security incident on 29 October 2026 had an estimated financial impact of about $6.3 billion. Blockchain analytics firm TRM Labs puts the amount at about $6.36 billion and calls it the largest crypto theft on record, roughly four times the Bybit hack of February 2025. Binance says user funds are safe and that it will cover all losses. Who did it, and exactly how, is still being established, though TRM Labs and Chainalysis both point to North Korea.

Key points

  • Binance estimates the impact of the incident at about $6.3 billion; TRM Labs counts about $6.36 billion drained from wallets on ten blockchains.
  • BleepingComputer reports that most of the money left within about 20 minutes starting at 20:05 UTC on 29 October.
  • Binance says the first findings point to a compromised laptop belonging to a DevOps engineer, but also that it has found "additional points of breach" and is still gathering facts.
  • Binance says it found no evidence of a leaked wallet private key, and will cover all losses from its SAFU fund and company funds.
  • TRM Labs attributes the theft to TraderTraitor, a North Korea-linked group; Chainalysis says it holds that view with "a high degree of confidence". Binance itself has not named anyone.

What happened

Users first noticed funds leaving Binance wallets on 29 October. Binance told TechCrunch it was "aware of reports of a potential security issue" and was investigating, and a spokesperson, Ross O'Leary, said withdrawals had been temporarily suspended on multiple networks as a precaution. Changpeng Zhao, the founder who no longer runs the exchange but is its largest shareholder, wrote on X that it looked like a hack and that he expected user funds to be fully covered.

Early estimates varied widely. TechCrunch's first report relayed outside estimates of at least $2 billion, some as high as $5.7 billion, and said these were unconfirmed. Later on 29 October and into 30 October, Binance gave its own figure of about $6.3 billion, with about $3 billion already frozen on-chain, according to Fox Business and others.

BleepingComputer, citing the incident timeline, says the attacker moved funds out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. Binance suspended deposits and withdrawals; co-founder Yi He wrote that this was while the team conducted security checks, froze funds and worked with law enforcement.

On 30 October Binance co-CEO Richard Teng gave the company's first account of the cause. According to BleepingComputer, Binance linked the theft to a compromised laptop of a DevOps engineer, which let the attacker reach a service container and submit unauthorised withdrawal transactions. Teng also said the attacker did not simply use one engineer's permissions and that this was not a single "one-click" action. Binance said a follow-up investigation had found "additional points of breach", which it did not specify. It said it had revoked authorisations for the affected address and is working with blockchain intelligence partners and law enforcement.

Background

Binance and large exchanges keep most customer assets in "cold" storage and a smaller share in "hot" wallets that sign withdrawals automatically. A breach of the systems that decide what to sign can drain hot wallets without anyone stealing a private key, a point security firm Check Point's Jayant Dave made in comments carried by FinanceFeeds: the attackers, he said, did not break encryption or steal keys but took over the system that tells keys what to sign. That is analysis from outside the company, not a Binance finding.

The previous record was the Bybit theft of February 2025. BleepingComputer, citing TRM Labs, puts it at $1.5 billion; TechCrunch says $1.4 billion. The two outlets differ on the rounding, and either way the new figure is several times larger. TRM Labs links both thefts to TraderTraitor, a North Korean state-backed unit also tracked as Lazarus Group and APT38.

The numbers

Largest crypto thefts on record, by estimated valueUS$ billion
Largest crypto thefts on record, by estimated value (US$ billion)
US$ billion
Binance (Oct 2026)6.3
Bybit (Feb 2025)1.5

Source: BleepingComputer citing TRM Labs; Binance estimate

The figures reported so far differ slightly, so here is where they come from:

  • Binance's own estimate: about $6.3 billion of impact, with about $3 billion frozen (Fox Business).
  • TRM Labs: about $6.36 billion drained from wallets on ten blockchains. BleepingComputer also quotes a Chainalysis figure of $6.4 billion.
  • Frozen funds: BleepingComputer reports that Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins, and that Arbitrum's Security Council froze 8,426 ETH and 74.6 million ARB. Fox Business, citing earlier reports, gives Tether about $1.57 billion, Circle above $800 million and Ripple about $200 million. These are reported figures from different times and are not additive.
  • Still with the attacker: BleepingComputer, apparently relaying TRM Labs data, says the attacker still controls about $2.4 billion, including more than 420,000 ETH and 18,270 BTC. TRM says the attacker sold USDT to market makers and borrowed ETH against USDT on Aave to move faster than the freezes.

Markets moved only modestly: Fox Business reports bitcoin down about 2% to $77,646, ether down about 2% to $2,238.76, and Binance's BNB token down more than 8% to $694.

What it means

For Binance customers. Binance says user funds are safe, that losses will be covered from its Secure Asset Fund for Users (SAFU) and company funds, and that it will publish an updated Proof of Reserves when remediation is complete. Those are promises; the proof has not been published. Deposits and withdrawals were suspended. Timing for resuming them was reported inconsistently (45 hours in one report, no timeline in another), so check Binance's own status updates rather than any single outlet.

For the industry. The reported chain of events, a developer laptop leading to a production service that can authorise withdrawals, is a reminder that custody security depends on engineers' machines as much as on key storage. If the account holds, controls such as isolating signing infrastructure, requiring multiple independent approvals for withdrawals and monitoring for unusual transfer patterns are what is tested. We cannot say which of these Binance had in place; it has not said.

For stablecoin issuers and chains. The freezes show how much of the stolen value sat in assets that a company or a council can freeze. Tether, Circle, Ripple and Arbitrum's Security Council froze funds, and TRM's account of the attacker racing the freezes via market makers and Aave shows the limit of that approach.

What we don't know yet

  • How the attacker got in. Binance has named a compromised DevOps laptop and "additional points of breach" without detail. Teng's account that there is no evidence of a private key leak sits uneasily with FinanceFeeds' report that security firm Blockaid counted eleven Binance hot wallet keys signing the transfers; that reconciliation is unresolved and we could not confirm the Blockaid claim from a primary source.
  • Attribution. TRM Labs and Chainalysis say North Korea's TraderTraitor; Binance has not assigned responsibility, and attribution by analytics firms is an assessment, not a legal finding.
  • The final loss. The $6.3 billion is an estimate of impact. How much is recovered or frozen for good, and how much is cost to Binance, is not yet clear.
  • When withdrawals fully resume and what the Proof of Reserves will show.
  • Whether other exchanges were affected. Nothing we have read says so.

What to watch next

Watch for Binance's promised technical post-mortem, its updated Proof of Reserves, and any further freezes or seizures as TRM Labs and Chainalysis keep tracing the funds. Law enforcement statements, particularly from the US, could also confirm or contradict the North Korea attribution. If you hold funds on any exchange, treat this as a prompt to turn on withdrawal allowlists and anti-phishing codes.

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next