On October 29, 2026, attackers drained $6.34 billion from Binance's hot wallets in about four hours. Measured in dollars at the time of the theft, it's the largest heist in crypto history. The previous record was set by the 2025 Bybit hack, which cost that exchange about $1.5 billion, roughly a quarter of this one.
Binance is covering the loss from its own funds. Withdrawals are reopening gradually, network by network.
What Happened on October 29
The unauthorized transfers ran from about 20:05 to 23:56 UTC. The attacker hit the exchange's hot wallets across ten blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. According to analysts at Hacken, most of the money was gone in the first 20 minutes or so. Bitcoin fell more than 4% that evening and dipped below $78,000.
Some of the money was stopped almost immediately. Tether froze more than 1.5 billion USDT, Circle blocked about 823 million USDC, and Ripple and World Liberty Financial did the same with their stablecoins, RLUSD and USD1 respectively. In total, Binance estimates that around $2.85 billion was frozen or intercepted. Frozen isn't the same as returned, though. Getting the money back usually takes a law enforcement request or a court order, after which the issuer burns the blocked tokens and mints new ones. Bitcoin and ether can't even be frozen, because no issuer stands behind them.
The Attack Started in June
According to Binance's preliminary report, the breach began months before October 29, and the first targets were the exchange's own employees.
In June, an engineer looking for an AI coding tool installed a tampered copy of Homebrew, the popular macOS package manager. Binance spotted suspicious activity, gave the engineer a new laptop, and rotated credentials. By then, though, the attacker had learned what the engineer did and who they worked with.
The next move looked like a job offer. In September, a Binance developer received a take-home coding test from a company that didn't exist. When the developer set up the project, malicious code replaced a component of pyenv, a tool for managing Python versions, and the machine's security software didn't flag it. In October, the attacker used that machine and an internal Binance AI tool to get into the accounts of two more engineers who worked on the wallets.
On October 29, the attacker used the stolen credentials to spin up a container, then ran a script and reached the internal service that signs transactions. From then on, the system approved the attacker's transfers as if they were routine. Binance says it found no sign that private keys had leaked.
The Ethereum part of the attack relied on EIP-7702, a standard that lets an ordinary wallet hand off execution to smart contract code. A Binance hot wallet granted some of its permissions to the attacker's contract, and the balance was drained through it within minutes. Revoking that delegation took more than a single command. The wallet uses multi-party computation (MPC), in which the key is split among several parties, so undoing the delegation required a separate procedure.
Binance Hack Timeline 2026: From an Infected Laptop to Reopened Withdrawals
On October 31, the FBI named the culprit: TraderTraitor, a North Korean group the bureau also blamed for the 2025 Bybit hack. North Korea denies involvement. Fake job offers are a familiar tactic: North Korea-linked hackers have used them against crypto industry staff for years. We covered how other major attacks worked, from Mt. Gox to Bybit, in our piece on the biggest crypto hacks in history.
Who Pays for the Stolen Funds and When You Can Withdraw
Binance suspended withdrawals right away and announced it would cover the loss itself. It set aside more than the full amount needed, drawing on four sources: SAFU (its Secure Asset Fund for Users), the futures insurance fund, a bitcoin reserve, and its corporate treasury. With that money, the exchange is buying coins on the market to replace the stolen ones. By October 30, it had replenished about 80% of the stolen assets, and by November 4, about 98%. What's left is mostly illiquid tokens, which take the longest to buy.
"Replenished" here means Binance paid out of its own pocket. The stolen coins haven't come back. According to the FBI, they're being converted mainly into ether ahead of further laundering through DeFi and instant swap services.
Withdrawals for BTC, ETH, USDT, USDC, BNB, and XRP reopened first, on November 1, and other networks followed as they cleared security checks. Net outflows on the first day came to $3.64 billion, about 2% of the exchange's assets, and by November 3 more money was coming in than going out. As of November 5, the rollout isn't finished, so before withdrawing, check that your network is open on Binance's status page in the app or on the website.
Who Else Was Hacked This Fall
On September 24, Bitget lost about $388 million from its hot and warm wallets. The attackers exploited a flaw in a third-party security product and sent fake withdrawal commands. Bitget is covering the loss from its user protection fund. On November 2, Brazil's Mercado Bitcoin reported a breach of its hot wallets. The damage was first put at about $40 million, and on-chain analysts at Bitquery later counted $48.5 million. Mercado Bitcoin has also promised to compensate customers. Our article on the risks of storing large amounts of crypto on an exchange explains why a big balance isn't safe even on the largest platform.
If You Keep Crypto on an Exchange
For several days, Binance customers couldn't withdraw their money. A pause like this usually follows a major hack. If a property or car payment falls due during a freeze, compensation that arrives later won't save the deal. If you'll need the money on a fixed date, move it off the exchange in advance.
Leave on an exchange only what you actively trade, and keep the rest in your own wallet. Binance itself expanded its Proof of Reserves after the hack, from 10 to 44 tokens. That doesn't remove the risk of keeping funds on a centralized platform, and no exchange is free of it.
Scammers also get busier after big hacks, posing as exchange "support." Binance has warned customers not to follow unofficial links or share their account details with anyone.
If you need to turn crypto into cash, you don't have to send it to a trading platform first. Our guide to withdrawing crypto legally in Georgia covers the options and the rules. With GeCrypto, which is licensed by the National Bank of Georgia, you send coins straight from your own wallet and receive cash at our office in Tbilisi or a transfer to your bank account.