Binance Hack 2026: $6.3 Billion Stolen, Explained
On the night of 29 October 2026, attackers drained roughly $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in about 20 minutes. It is the biggest crypto theft ever recorded, around four times the Bybit hack of February 2025. Binance has suspended deposits and withdrawals, says user funds are safe, and has promised to cover every loss. Blockchain investigators point to North Korea’s TraderTraitor group. This guide explains what happened, how the attack appears to have worked, where the money went, how markets reacted, and what traders and Nepali readers should take from it.
Last updated: 30 October 2026, evening (Nepal time). This is a fast-moving story. Figures differ between sources and will change as investigators finish their work.
Key Takeaways
- Size: Binance estimates the total impact at about $6.3 billion. Analytics firms put it between roughly $5.9 billion and $6.43 billion depending on when and how they count.
- Speed: Most funds left Binance wallets in about 20 minutes, starting around 20:05 UTC on 29 October (01:50 on 30 October in Nepal).
- Entry point: Binance says the breach began with a compromised engineer’s laptop, which gave the attacker access to a service container and let them submit unauthorized withdrawals. It reports no evidence of a wallet private key leak.
- Suspected attacker: TRM Labs, Chainalysis and Elliptic all point to TraderTraitor, a North Korean state-linked group tied to the Lazarus ecosystem. No government has formally confirmed this at the time of writing.
- Recovery: About $3 billion has been reported frozen, including billions in USDT and USDC.
- Users: Binance says it will cover losses from company funds and its SAFU emergency fund.
- Markets: Bitcoin fell to around $77,000 on the news, but analysts do not currently see a meaningful solvency risk for Binance.
In This Article
- What happened to Binance?
- Timeline of the Binance hack
- How the attack appears to have worked
- How much was stolen?
- Who is behind the hack?
- Where did the stolen money go?
- Binance’s response
- Market impact
- Binance’s earlier security incidents
- Lessons for traders and investors
- What this means for readers in Nepal
- How to protect yourself right now
- What happens next
- Frequently asked questions
- Sources
What Happened to Binance?
Late on Thursday, 29 October 2026, billions of dollars in crypto began leaving wallets controlled by Binance. According to blockchain intelligence firm TRM Labs, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon. Elliptic, another analytics firm, counted eleven chains and a slightly higher total of $6.43 billion.
Binance confirmed a security incident, suspended deposits and withdrawals so security checks could be completed, and said it was working with law enforcement and blockchain intelligence partners to trace, freeze and recover funds. Co-founder Changpeng Zhao, who left the CEO role in 2023, wrote on X that it looked like a hack on Binance and said, as a shareholder, he expected user funds to be fully recovered. Co-CEO Yi He later described the event as an exploit.
The incident is the largest theft in the history of digital assets. The previous record was the roughly $1.5 billion Bybit hack in February 2025, which was also attributed to North Korean operators.
Timeline of the Binance Hack
Times below are UTC with Nepal Standard Time (UTC+5:45) in brackets. They come from on-chain analysis by TRM Labs and Elliptic and from Binance’s own statements, and may be refined later.
| When | What happened |
|---|---|
| 28 Oct, morning | The attacker’s operator wallet receives three small withdrawals from Tornado Cash, a mixing service that obscures where crypto comes from (TRM). |
| 29 Oct, early | The operator deploys a first piece of attack code and tests it on two wallets (TRM). |
| 29 Oct, later | A final version is rehearsed on a third wallet, and the test funds are sent back to the attacker (TRM). |
| 29 Oct, about 20:05 UTC (01:50 NPT, 30 Oct) | Main burst begins. Five Binance wallets on the XRP Ledger send 233 million XRP to one attacker address. Most funds move within about 20 minutes (TRM, Elliptic). |
| 29 Oct, shortly after 20:10 UTC | Binance wallets on Solana and Optimism follow (TRM). |
| 29 Oct, about 23:05 UTC (04:50 NPT, 30 Oct) | A second wave reaches Binance wallets on Avalanche and Polygon (TRM). |
| Late 29 Oct | Binance announces a security incident, suspends deposits and withdrawals, and says about $3 billion has been frozen. |
| 30 Oct | Analytics firms attribute the attack to North Korea. Binance says it has reserved over $6.34 billion of company funds to cover the incident. Withdrawals are expected to resume by Sunday, according to Yi He. |
How the Attack Appears to Have Worked
Binance has not yet published a full post-mortem, so everything below is based on its early statements and outside analysis. Treat the technical details as provisional.
Hot wallets: the target
Exchanges keep most customer assets in offline cold storage and a smaller working balance in internet-connected hot wallets that process withdrawals automatically. Hot wallets must be able to sign transactions quickly, which makes them the most attractive target. ABC News reported that the funds moved from hot wallets. Even a small percentage of a giant exchange’s holdings adds up to billions of dollars.
The entry point: a compromised engineer’s laptop
Binance’s initial investigation says the attack went through an engineer’s laptop, which allowed the attacker to reach a service container and submit unauthorized withdrawal transactions. Elliptic reports that Binance identified the laptop as belonging to a DevOps engineer. Binance has said it found no evidence of a wallet private key leak.
TRM Labs reads the evidence as pointing to a compromise of Binance’s hot wallet signing infrastructure. In simple terms, the attacker appears not to have stolen the keys themselves, but to have gained the ability to get Binance’s own systems to approve withdrawals. In the same time window, wallets on many different networks sent funds to the attacker through ordinary signed transfers.
Not a one-click attack
Co-CEO Richard Teng said the attack was not a one-click action but a complex, multi-step process. TRM’s on-chain evidence supports that: funding through a mixer, test deployments, a dress rehearsal on a spare wallet, and then a coordinated drain across many blockchains in minutes. That pattern points to careful preparation rather than an opportunistic break-in, although the on-chain staging began only about a day before the drain and the attacker may have had access to Binance systems for longer.
An unconfirmed theory: EIP-7702
Some security researchers have speculated that the attacker abused an Ethereum feature called EIP-7702, which lets an ordinary wallet delegate control to a smart contract. A report on Yahoo Finance describes researchers noticing a wallet that appeared to have delegated control to an unverified contract. That same report notes that Binance has not published a technical explanation confirming this mechanism. Until Binance or independent forensic teams confirm it, this should be read as a hypothesis, not a finding.
How Much Was Stolen?
Different sources give different totals. The gaps come from price movements, which chains are included, and whether assets later frozen are counted.
| Source | Estimate |
|---|---|
| Binance | About $6.3 billion total impact |
| TRM Labs | About $6.36 billion across ten blockchains |
| Elliptic | $6.43 billion across eleven blockchains |
| Chainalysis | Revised to roughly $5.9 billion at the time of theft |
Whichever figure you use, it is the largest crypto theft ever. Elliptic notes it is more than four times the $1.46 billion taken from Bybit in 2025. Arkham data cited by CoinDesk showed the attacker’s wallets at one point held over $5.7 billion in various crypto, including nearly $1.5 billion in bitcoin and about $900 million in ether.
Who Is Behind the Hack?
Three separate analytics firms have pointed to North Korea:
- TRM Labs attributes the attack to TraderTraitor, a North Korean state-sponsored group, based on on-chain and off-chain intelligence. TRM says the same group was behind the Bybit theft.
- Chainalysis CEO Jonathan Levin said the firm assessed the attack as likely carried out by TraderTraitor, citing links to earlier incidents.
- Elliptic says the attack is consistent with TraderTraitor’s methods, and reports that some stolen funds reached the same address as proceeds of a suspected North Korean exploit of the Bitget exchange. Investigator ZachXBT has also reported that funds from the Binance incident and a roughly $388 million Bitget hack were routed through THORChain and mixed at one address.
An important caveat: attribution here comes from private blockchain-analysis firms and independent investigators, not from a government announcement. Binance’s own investigation, per CNN, has not attributed responsibility to any individual or found evidence of a private key leak. Expect more detail as law enforcement and forensic teams report.
North Korea’s cyber units have stolen billions of dollars in crypto over the years, widely understood to help fund the country’s weapons programs. That is why these thefts are treated as a national security issue and not only as a financial crime.
Where Did the Stolen Money Go?
Frozen funds
One notable difference from earlier mega-hacks is how quickly parts of the loot were locked. Binance says about $3 billion of assets that passed through attacker-linked wallets has been identified and frozen, including about $2.3 billion in USDT and USDC stablecoins. Tether CEO Paolo Ardoino said his company froze more than $1.56 billion related to the incident. Stablecoin issuers can freeze tokens at the contract level, which is why stablecoins are the easiest part to recover.
TRM’s own snapshot put frozen funds at about $2.7 billion, with the attacker still holding roughly $2.4 billion. Elliptic’s tracking is also ongoing. These numbers will move.
Laundering attempts
Reports describe the attacker moving assets through decentralized platforms. On-chain data cited by CoinDesk shows funds moving through Uniswap, and the exploiter borrowing at least 20,000 wrapped ether (about $44 million) on Aave using stolen USDT as collateral. CoinDesk also reported that the hacker dumped a little-known 2017 token, which then crashed about 90%.
An analyst from Singapore’s Pangolin Intelligence told CNN the cat-and-mouse game had barely begun, and that North Korea was likely to use networks of money-laundering organizations to cash out. In previous cases, much of the stolen value was converted to bitcoin, bridged across chains, and moved through over-the-counter brokers over days and weeks.
Binance’s Response
- Withdrawals paused: Binance temporarily suspended all deposits and withdrawals to complete security checks. Yi He said withdrawals were expected to resume by Sunday.
- Loss coverage: The exchange says it will cover all losses using company funds and its Secure Asset Fund for Users (SAFU), and says it has already reserved over $6.34 billion of company funds.
- Proof of reserves: Binance says it will publish an updated proof of reserves once remediation is complete.
- Law enforcement and tracing: It is working with law enforcement, stablecoin issuers and blockchain intelligence firms to trace, freeze and recover more funds.
NBC News points out that, unlike bank deposits, funds on a crypto exchange are not automatically insured, so any refund depends on the exchange’s decision. Binance’s pledge is a commitment from the company, not a government guarantee.
Market Impact
Crypto prices dropped as word spread. CoinDesk reported Bitcoin falling back to around $77,000, and major tokens traded lower across the board. The same day, prediction market Polymarket disclosed a breach at one of its third-party providers, with losses under $3 million, a much smaller but related reminder of the sector’s weak spots.
On solvency, Sean Farrell of Fundstrat Global Advisors said the most important market takeaway is that the hack does not currently appear to create meaningful solvency risk for Binance. That view depends on the company honoring its pledge and on the frozen funds and reserves holding up, so watch the promised proof-of-reserves update.
Why would an event of this size not cause a bigger crash? Part of the explanation is likely that a large portion of the stolen value was quickly frozen or tracked, and that Binance moved fast to say it would absorb the loss. But confidence shocks can linger, especially if withdrawals stay paused longer than expected.
Binance’s Earlier Security Incidents
This is not the first time Binance has been hit, though earlier incidents were far smaller.
- March 2018: Suspected API-key attacks caused strange trades on the platform.
- May 2019: Hackers took about 7,000 BTC, then worth roughly $40 million, from a hot wallet holding about 2% of Binance’s bitcoin. Binance covered the loss from SAFU and paused withdrawals for about a week while it reviewed its security.
- October 2022: An exploit of the BNB Chain bridge (BSC Token Hub) minted around 2 million BNB, but validators halted the chain and most of the funds were trapped.
- August 2026: A data leak at SafePal, a wallet maker backed by Binance Labs, exposed personal details of about 40,000 buyers (this was not a hack of Binance itself).
The 2019 incident and this one share a pattern: the attacker went after the hot-wallet layer, and Binance responded by pausing withdrawals and using its own funds to make users whole. The difference is the scale, which is roughly 150 times larger.
Lessons for Traders and Investors
1. Exchanges are counterparties, not vaults
When you keep money on any exchange or broker, you hold a claim on that company, not the assets themselves. If the company is hacked, fails, or freezes withdrawals, your access depends on its ability and willingness to pay. This applies equally to forex brokers. Our guides on how to start forex trading in Nepal and forex leverage and margin explain why you should always check how a broker holds client money before depositing.
2. Don’t keep more than you need on a platform
Only keep the funds you actively need for trading on any platform. Withdraw profits regularly. This is basic risk management and works against any kind of platform failure.
3. The weakest link is often a person
According to Binance, the entry point here was an engineer’s laptop, not a flaw in blockchain code. Large thefts increasingly begin with social engineering, malware or compromised developer machines. For individuals, the same lesson applies: your phone, email and browser are part of your security.
4. Transparency matters
Look for platforms that publish proof of reserves, explain how they separate client assets, and communicate clearly during incidents. Binance’s coming proof-of-reserves update will be a test of that.
5. Don’t panic-trade headlines
Hack news can produce sharp, short-lived price moves. Decisions made on rumor, particularly with leverage, are a common way traders lose money. Wait for confirmed information from official channels.
What This Means for Readers in Nepal
Many people in Nepal follow global crypto news, so it is worth being clear about the legal position. Nepal Rastra Bank (NRB) has repeatedly stated that virtual currency and Bitcoin business is illegal and that virtual currency is not legally recognized in Nepal. The ban has been based on provisions of the Foreign Exchange (Regulation) Act. Legal commentary also notes that authorities have investigated and prosecuted people for crypto-related transactions in past years.
At the same time, the government is exploring a state-issued digital currency. A proposed amendment to the NRB Act would give legal status to a Central Bank Digital Currency (CBDC) issued and backed by NRB, which is a different thing from privately issued cryptocurrencies like Bitcoin.
Hamro Forex does not encourage anyone to break local law. This article is for general information and news awareness only. If you have questions about what is allowed for you, speak to a qualified Nepali lawyer or check NRB’s latest notices directly, because rules can change.
Whatever your own exposure, the Binance incident is a useful case study in counterparty and platform risk. If you trade or hold money on any overseas platform, ask who regulates it, where client money is held, and what happens if it is hacked or becomes insolvent.
How to Protect Yourself Right Now
Big hacks are followed by waves of scams. Criminals know people are anxious and looking for updates.
- Use official channels only. Get updates from the exchange’s verified website and verified social accounts. Ignore links sent by direct message, email or text.
- Beware of fake recovery services. Anyone offering to recover your funds for a fee, or asking for your seed phrase, password or 2FA code, is a scammer. No genuine support team will ask for these.
- Watch for fake compensation and airdrop pages. Phishing sites often imitate refund or compensation forms.
- Strengthen your accounts. Turn on two-factor authentication using an authenticator app or hardware key rather than SMS, use a unique password, and enable withdrawal address allow-lists if your platform offers them.
- Keep your devices clean. Update your operating system, avoid pirated software, and be careful with email attachments and browser extensions.
- Don’t rush. Withdrawals are paused, not lost. Panic decisions lead to mistakes.
What Happens Next
- Withdrawal restart: Watch whether Binance resumes withdrawals by the Sunday target, and on which networks first.
- Post-mortem: A full technical account from Binance would clarify the entry point and whether theories such as EIP-7702 hold up.
- Proof of reserves: The promised update will show whether the exchange is fully backed after the loss.
- Further freezes and seizures: More recoveries are possible if stablecoin issuers, exchanges and investigators keep tracking the funds. Historically, however, the unfrozen portion of North Korean thefts is rarely recovered.
- Regulatory response: Expect pressure on exchanges worldwide over key management, endpoint security and disclosure standards.
- Official attribution: A government statement on North Korea’s role could follow.
Frequently Asked Questions
Was Binance really hacked?
Yes. Binance confirmed a security incident with an estimated total impact of about $6.3 billion, and its leadership has described it as an exploit.
How much money was stolen from Binance?
Binance estimates around $6.3 billion. Independent analytics firms put the figure between roughly $5.9 billion and $6.43 billion, depending on timing and method.
When did the Binance hack happen?
The main drain began around 20:05 UTC on 29 October 2026, which was 01:50 on 30 October in Nepal. A second wave followed later that night.
How did hackers get into Binance?
Binance says the breach started with a compromised engineer’s laptop, which gave access to a service container used to submit unauthorized withdrawals. It reports no evidence of a private key leak. A full technical report has not been released.
Who hacked Binance?
TRM Labs, Chainalysis and Elliptic say it was likely TraderTraitor, a North Korean state-linked group. This attribution comes from analytics firms and has not been formally confirmed by a government.
Are Binance users’ funds safe?
Binance says user funds are safe and that it will cover all losses from company funds and its SAFU fund. Exchange balances are not government-insured, so the pledge depends on the company. Withdrawals are temporarily paused.
When will Binance withdrawals resume?
Co-founder Yi He said withdrawals were expected to resume by Sunday. Check Binance’s official channels for the latest status, since timing can change.
Is this the biggest crypto hack ever?
Yes. It is about four times larger than the 2025 Bybit hack of roughly $1.5 billion, which was previously the record.
Can the stolen crypto be recovered?
Part of it already has been locked. About $3 billion has been reported frozen, with stablecoins making up the bulk. The remainder is being traced across blockchains, and recovery of non-frozen assets is historically difficult.
Is cryptocurrency legal in Nepal?
Nepal Rastra Bank has repeatedly said that virtual currency and Bitcoin business is illegal and not legally recognized. Check the latest NRB notices or consult a lawyer for advice on your situation.
Conclusion
The Binance hack of October 2026 is a landmark event for the industry: the largest theft ever, carried out in minutes after careful preparation, and traced to a state-linked actor. Binance’s quick freeze of billions in assets and its pledge to cover losses have so far limited the damage to users and markets, but the key questions remain open. How exactly did the attacker get in, how much will be recovered, and will the promised proof of reserves show a fully backed exchange?
For traders, the practical message is simple: understand who holds your money, keep exposure to any single platform limited, secure your own devices and accounts, and rely on verified information. Hamro Forex will update this article as official details emerge.
Disclaimer: This article is for information only and is not financial, investment or legal advice. Figures are taken from the sources below as of 30 October 2026 and may change. Trading and holding digital assets carries significant risk.
Sources
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
- Elliptic: The largest theft in history: North Korea likely behind the $6.4 billion Binance hack
- CoinDesk: Binance loses over $6 billion in the largest crypto hack to date
- CNBC: Binance’s $6.3 billion hack: What we know and what comes next
- CNN: Binance, North Korea suspected in record $6 billion theft
- Bloomberg: Binance Estimates $6.3 Billion Hacked in Crypto’s Biggest Heist
- NBC News: Binance targeted in $6.3 billion crypto heist, the largest ever
- Al Jazeera: Binance says $6.3bn stolen in biggest crypto heist in history
- Forbes: Binance Says $6.3 Billion Impacted In Record Crypto Hack
- crypto.news: Binance hack: What happened and where the $6.3 billion went
- The Crypto Times: Binance Hack Explained
- Yahoo Finance: Is Binance Being Hacked?
- The Hacker News: Binance cryptocurrency hacked (2019 incident)
- Business 360: Cryptocurrency, networking businesses illegal: NRB
- ShareSansar: Central Bank Digital Currency set to become legal money in Nepal
Learn more: who we are · the risk disclaimer · contact us.
Educational content, not financial advice. Leveraged trading can lose more than your deposit.
