Binance, the world's largest cryptocurrency exchange, suffered a record cyberattack on October 29, 2026, with hackers stealing approximately $6.3 billion in digital assets. Blockchain security researchers have linked the attack to North Korean hackers, while the exchange has suspended withdrawals and promised to cover customer losses.
The theft is believed to be the largest cryptocurrency hack ever recorded. Investigators estimate that most of the stolen assets were transferred from Binance-controlled wallets in approximately 20 minutes, demonstrating how quickly attackers can move digital funds once they gain access to critical systems.
Binance said its initial investigation identified a compromised laptop belonging to a DevOps engineer. The attacker apparently used that access to reach an internal service and submit unauthorized withdrawal transactions.
The exchange reported finding no evidence that the private keys protecting its cryptocurrency wallets had been stolen. However, subsequent investigations identified additional potential points of intrusion, suggesting that the attack may have involved more than one security weakness.
About $3 billion in affected cryptocurrency was frozen through cooperation with other companies in the digital asset industry. Binance is working with law enforcement, blockchain investigators and cryptocurrency issuers to locate and recover additional funds.
How Hackers Stole Billions From Binance
The attack targeted Binance's internal wallet infrastructure, which manages cryptocurrency deposits, withdrawals and transfers. Cryptocurrency exchanges typically maintain internet-connected wallets to provide customers with immediate access to their digital assets.
These wallets, commonly called hot wallets, allow transactions to be processed quickly. Their internet connectivity also creates potential security risks if attackers compromise the systems authorized to operate them.
According to blockchain intelligence firm TRM Labs, approximately $6.36 billion was transferred from Binance wallets across 10 blockchains. Most of the transfers occurred during a concentrated period of about 20 minutes.
Investigators believe the hackers gained access to internal systems that could authorize withdrawals. This would allow cryptocurrency to be transferred without requiring the attackers to steal the private keys themselves.
The distinction is important because private keys normally provide direct control over digital assets. An attacker who compromises an authorized transaction system may still be able to move funds even when those keys remain protected.
Binance initially identified a compromised engineer's laptop as a possible entry point. Investigators have not publicly established exactly how the device was compromised or whether it alone provided sufficient access to carry out the theft.
The company's investigation is continuing, and the final technical explanation could change as more evidence becomes available.
North Korean Hackers Suspected
Blockchain investigators have attributed the attack to TraderTraitor, a North Korean state-sponsored hacking operation associated with the country's broader cryptocurrency theft campaigns.
TRM Labs said its analysis provided high confidence that TraderTraitor was responsible. Other blockchain investigators also identified similarities between the Binance breach and previous attacks attributed to North Korean hacking groups.
The suspected attackers have a history of targeting cryptocurrency exchanges and other financial organizations. Their operations often involve compromising employees, exploiting internal systems and moving stolen funds through multiple cryptocurrency networks.
The FBI previously identified TraderTraitor as responsible for the February 2025 attack against cryptocurrency exchange Bybit. That operation resulted in the theft of approximately $1.5 billion in digital assets.
The Binance theft is more than four times the size of the Bybit attack, which previously held the record for the largest known cryptocurrency heist.
Although security researchers have linked the latest attack to North Korea, the attribution remains based on investigative findings. Binance has not publicly established the identities of individual attackers.
U.S. authorities have previously warned that North Korean hackers use stolen cryptocurrency to generate revenue for the government. Investigators say these operations frequently involve elaborate methods intended to disguise the origin and movement of stolen funds.
Nearly Half of Stolen Funds Frozen
A major recovery effort began shortly after the theft was detected. Binance coordinated with cryptocurrency issuers and blockchain intelligence companies to identify addresses receiving stolen assets.
Approximately $3 billion was frozen, according to initial reports. Stablecoin issuers Tether and Circle participated by restricting transfers involving digital tokens connected to the attack.
Stablecoins are cryptocurrencies designed to maintain a relatively stable value, commonly by tracking the U.S. dollar. Some issuers have technical controls that allow them to block transfers from designated blockchain addresses.
These controls helped investigators prevent the movement of a substantial portion of the stolen assets.
However, freezing cryptocurrency does not automatically return it to the original owner. Recovery can require additional technical procedures, cooperation among companies and legal authorization.
Other cryptocurrencies, including Bitcoin and Ethereum's native Ether token, generally cannot be frozen by a central issuer. Once transferred to an address controlled by an attacker, these assets can be difficult to recover without access to the relevant keys or intervention at a service handling them.
Investigators reported that the attackers were converting some stolen assets into cryptocurrencies that lack centralized freezing controls. This may complicate attempts to recover the remaining funds.
The public nature of blockchain transactions allows investigators to follow transfers between addresses. However, identifying the people behind those addresses can be considerably more difficult.
Binance Promises to Protect Customers
Binance said it would cover customer losses using company resources and its Secure Asset Fund for Users, commonly known as SAFU.
The fund was established to provide additional financial protection during extraordinary security incidents. Binance has maintained that customer assets remain safe despite the breach.
The exchange temporarily suspended withdrawals while its security teams investigated the attack and reviewed affected systems. Deposits and withdrawals were subject to restrictions as the company worked to prevent additional unauthorized activity.
Binance said it expected to resume withdrawals after completing necessary security checks. It also promised to publish updated proof-of-reserves information once remediation efforts were complete.
Proof-of-reserves disclosures are intended to demonstrate that an exchange holds assets backing customer balances. However, such disclosures do not necessarily provide a complete picture of a company's liabilities or financial condition.
The company's promise to reimburse customers is significant given the extraordinary amount involved. The total cost to Binance will depend partly on how much of the stolen cryptocurrency can ultimately be recovered.
The incident also raises questions about the ability of large exchanges to protect their internal authorization systems. Security measures designed to defend private keys may not prevent losses if attackers can compromise the software or infrastructure responsible for executing transactions.
Cryptocurrency Security Faces Renewed Scrutiny
The Binance breach occurred as cryptocurrency exchanges continued to expand their services and attract customers seeking alternatives to traditional financial platforms.
Unlike banks, which generally operate within established deposit insurance and regulatory frameworks, cryptocurrency platforms rely on different arrangements for protecting customer assets. Those protections vary by company, jurisdiction and the type of cryptocurrency involved.
Many exchanges maintain cybersecurity teams, insurance arrangements or emergency funds. Nevertheless, even sophisticated defenses may be vulnerable to compromised employee devices, malicious software and weaknesses in transaction approval systems.
Some cryptocurrency users choose self-custody, which means storing digital assets in wallets controlled by their own private keys. This reduces dependence on an exchange but transfers responsibility for security and recovery to the individual.
Losing private keys or recovery phrases can permanently prevent access to cryptocurrency holdings. Hardware wallets can reduce exposure to online attacks, but they cannot eliminate every threat.
For Binance, the immediate priority remains tracing stolen assets, restoring normal services and identifying the weaknesses that allowed the attack.
The company has pledged to cooperate with authorities and compensate affected customers. Investigators must still determine how much of the stolen cryptocurrency can be recovered and whether additional security failures contributed to the breach.
As of October 30, approximately half of the estimated $6.3 billion theft had been frozen, leaving billions of dollars still subject to tracing and recovery efforts.