The theft · Binance · 29 October
$6.3 billion left in twenty minutes.
The largest crypto exchange said a security breach moved about $6.3 billion on Thursday night. About half of that has been frozen. The company says it will cover the loss.
On 29 October 2026, near 20:05 UTC, an attacker began moving funds out of Binance wallets on ten blockchains. TRM Labs said most of an estimated $6.36 billion left in about twenty minutes. Binance put the impact at about $6.3 billion. Elliptic counted $6.43 billion and called it the largest theft of any kind on record, more than four times the $1.5 billion taken from Bybit in February 2025.
“Your money is safe, and we’re covering every loss.”
That line is from co-CEO Richard Teng. He said the first look pointed at a compromised DevOps engineer’s laptop, which let an attacker into a service container and from there into unauthorized withdrawals. He also said this was not one engineer’s password and not a single click. A later note from Binance said the follow-up work had found more points of breach, and that the attack was complex. The company said it had found no evidence that a wallet private key leaked, and that its investigation had not blamed any individual.
Binance said it will cover the losses from the SAFU user-protection fund and from company money. Withdrawals were stopped. Outflows stopped when that pause went on. A Friday update said deposits were still running, about $3 billion had been frozen on-chain with partners, and withdrawals were still on a clock of about 45 hours. Co-founder Yi He had already said the exchange would cover “all hacking losses.”
Tether and Circle froze stablecoins tied to the flows. Circle’s chief executive, Jeremy Allaire, said his firm had frozen more than $800 million. Earlier on Thursday night Binance had counted $2.54 billion frozen and warned the number would rise. Elliptic later said it had verified about $2.84 billion frozen, almost all of it USDT and USDC, and that the attacker was swapping the rest into ether and other assets an issuer cannot freeze.
The bitcoin is the piece nobody can freeze by calling an issuer. CoinDesk followed 18,270 BTC, about $1.4 billion at early Friday prices, out of a Binance hot wallet in block 973,732, around 20:20 UTC. Within minutes the coins sat in 19 wallets: 17 holding 1,000 BTC each, one holding 832.5, one holding 437.7. As of 04:23 UTC Friday, none of the 19 had sent a coin on.
TRM Labs and Chainalysis attributed the attack, with high confidence, to TraderTraitor, a North Korean unit tied to the Lazarus Group. Elliptic said some of the stolen funds reached an address that also held proceeds of a suspected North Korean exploit of Bitget, and called the method consistent with TraderTraitor. Nobody has claimed the theft. Binance told the BBC it was working with law enforcement to identify the criminals. It did not itself name North Korea.
Markets flinched. Bitcoin fell to a six-week low near $76,368. Ether fell to about $2,178. Binance.US said it is a separate company and that its customers were unaffected.
