Binance, the world’s largest cryptocurrency exchange, confirmed a major security breach late on October 29, 2026, with an estimated impact of approximately $6.3 billion. The incident is widely described as the largest crypto theft on record, roughly four times the size of the February 2025 Bybit heist of about $1.5 billion.

The bulk of the funds left Binance hot wallets across roughly nine to ten blockchains in a compressed window, with most of the outflows occurring in about 20 minutes beginning around 20:05 UTC. Analytics firms including Arkham, Elliptic, TRM Labs, and Chainalysis have tracked the flows. Binance’s own estimate places the total impact near $6.3 billion; independent tallies have ranged from roughly $5.9 billion to $6.4 billion at the time of the theft.

How the Breach Occurred

Preliminary findings point to a compromised DevOps engineer’s laptop. According to Binance, the device allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Co-CEO Richard Teng emphasized that the attack was not a single “one-click” action but a more complex process. The exchange has stated it found no evidence of any wallet private-key leak. Affected address authorizations have been revoked, and Binance is working with law enforcement and blockchain intelligence partners.

Blockchain analytics firms TRM Labs and Chainalysis have attributed the attack with high confidence to North Korea’s TraderTraitor unit (linked to the broader Lazarus Group). The assessment rests on on- and off-chain patterns, infrastructure overlap with prior incidents (including a Bitget exploit), and operational similarities to the 2025 Bybit hack. Binance has not publicly named a perpetrator and says it is cooperating with authorities. No government confirmation has been issued as of early October 30.

Frozen Assets and Recovery Efforts

Roughly $3 billion of the affected assets has been frozen on-chain so far, primarily through rapid action by stablecoin issuers. Tether froze approximately $1.57 billion in USDT, while Circle froze more than $800 million in USDC. Additional freezes involved Ripple, World Liberty Financial, Arbitrum’s Security Council, and others, bringing the verified frozen total into the $2.7–3 billion range according to multiple reports. The remaining funds—largely Bitcoin (including roughly 18,270 BTC split across multiple wallets) and Ethereum—cannot be frozen by issuers and remain under attacker control for now. Attackers have also moved portions through decentralized platforms and bridges.

Binance suspended deposits and withdrawals as a precaution while security checks continue. The exchange has said it expects withdrawal services to resume within roughly 45–48 hours once remediation is complete. Binance.US was unaffected.

User Funds and Coverage

Binance co-CEO Yi He and founder Changpeng Zhao (CZ) have stated that user funds are safe and that the exchange will cover all losses from its Secure Asset Fund for Users (SAFU) and corporate reserves. SAFU, Binance’s longstanding emergency reserve (currently holding roughly 15,000 BTC valued near $1.1–1.2 billion), was established precisely for security incidents. Company funds will cover any remaining shortfall after frozen assets and SAFU are applied. The exchange has also said it will publish an updated proof of reserves once the situation is fully resolved.

Market and Industry Impact

Cryptocurrency prices fell immediately after the news, with Bitcoin dropping to multi-week lows near $77,000 in some sessions amid broader liquidations. The incident has intensified scrutiny of exchange hot-wallet practices, signing infrastructure, employee-device security, and the practical limits of proof-of-reserves transparency. While Binance’s pledge to make users whole has provided some reassurance, the scale of the theft—executed in minutes through compromised internal access—highlights ongoing operational risks even at the largest platforms.

The situation remains fluid. Figures may shift as additional freezes are confirmed and the investigation progresses. Binance has committed to a detailed technical post-mortem once facts are fully verified.