Binance has committed more than $6.34 billion of its own resources to cover losses from a massive cryptocurrency hack on Thursday, October 29, 2026. The attack drained approximately $6.3 billion in digital assets from the exchange, making it potentially the largest cryptocurrency theft ever recorded.
The company said industry partners had frozen approximately $3 billion in assets connected to the theft by Friday. However, those funds had not necessarily been returned to Binance, and investigators continued tracking cryptocurrency that remained under the attackers' control.
Binance temporarily suspended withdrawals while investigating the breach but said customers would not be required to absorb the financial losses. The exchange also began rebuilding its reserves using corporate funds and existing digital assets.
Blockchain intelligence companies TRM Labs and Chainalysis attributed the attack with high confidence to a hacking operation associated with North Korea. Binance has not publicly confirmed who carried out the theft.
Hackers Steal Billions in Minutes
The attack began Thursday evening when large amounts of cryptocurrency started leaving Binance-controlled wallets across several blockchain networks.
TRM Labs estimated that approximately $6.36 billion was transferred from Binance wallets across 10 blockchains. Most of the stolen assets moved during a period of about 20 minutes, beginning around 20:05 UTC.
The affected networks included Bitcoin, Ethereum, Tron, Solana, XRP Ledger, Avalanche, Polygon and several Ethereum-connected networks.
Investigators identified the activity by monitoring blockchain transactions, which provide publicly accessible records of cryptocurrency transfers. The unusually large withdrawals and their concentration in a short period raised immediate concerns about unauthorized access.
The theft involved internet-connected cryptocurrency wallets, commonly called hot wallets. Exchanges use these wallets to process withdrawals and maintain funds available for everyday transactions.
Hot wallets are convenient for customers but can expose assets to additional cybersecurity risks because they interact with online systems.
The attack moved through multiple networks in a coordinated sequence. According to TRM Labs, the attackers had prepared portions of their operation before the theft began.
The blockchain intelligence firm identified activity suggesting that preparations started at least 36 hours before the main withdrawals.
Investigators also detected advance testing and other technical steps that indicated the operation had been carefully planned.
Compromised Employee Laptop Investigated
Binance co-chief executive Richard Teng said the company's initial investigation pointed to a compromised laptop belonging to a development operations engineer.
The suspected compromise may have allowed attackers to access an internal service used to submit unauthorized withdrawal transactions.
Teng said the incident involved more than the misuse of a single employee's permissions. Investigators were examining additional possible weaknesses within the exchange's systems.
Binance reported that it had found no evidence that private keys protecting its cryptocurrency wallets had been stolen.
That distinction matters because private keys are the credentials used to authorize blockchain transactions. An attacker who obtains them may be able to transfer digital assets without further access to a company's internal systems.
A compromise involving transaction-processing software presents a different security challenge. Attackers may exploit trusted processes to issue transactions even without directly stealing the underlying wallet keys.
TRM Labs separately identified evidence suggesting that the attackers had compromised part of Binance's transaction-signing infrastructure.
The company's findings and the blockchain investigators' assessments are not necessarily contradictory. Both point to possible weaknesses in the systems responsible for authorizing cryptocurrency transfers.
However, the full technical explanation has not been established publicly, and investigators are continuing to examine how the attack occurred.
Approximately $3 Billion in Assets Frozen
The response involved several companies that issue or manage cryptocurrency tokens.
Tether, Circle, Ripple and other industry participants moved to freeze assets associated with addresses connected to the attack.
Tether reportedly froze more than $1.57 billion in USDT, while Circle blocked more than $800 million in USDC.
Ripple also froze approximately $200 million in associated assets. Additional restrictions affected other tokens and blockchain networks.
The combined frozen amount was reported at approximately $3 billion by Binance and several industry publications. Independent blockchain assessments published earlier in the response identified somewhat smaller totals.
The differences reflect the rapidly changing investigation and the timing of individual asset freezes.
Freezing cryptocurrency does not automatically return it to the original owner. Instead, the process prevents certain tokens from being transferred or redeemed while companies and authorities determine the appropriate next steps.
Some stablecoin issuers can block transactions involving specific addresses because their tokens include administrative controls. Other cryptocurrencies, including Bitcoin, generally cannot be frozen through the same mechanism.
As a result, significant amounts of stolen cryptocurrency remained beyond the direct control of issuers and exchanges.
Investigators warned that the attackers were moving assets through numerous wallets and cryptocurrency services in attempts to make the funds harder to trace.
Binance Commits Corporate Funds to Cover Losses
Binance said it had reserved more than $6.34 billion in company resources to restore customer balances and cover the effects of the breach.
According to CoinDesk, approximately $5 billion of that amount was already held in the same cryptocurrencies affected by the theft.
The company was acquiring the remaining assets through cryptocurrency markets and private transactions to match the balances that had been lost.
The reserve allocation is separate from the approximately $3 billion frozen by industry partners.
This distinction means Binance is not claiming that it has already recovered all the stolen cryptocurrency. Instead, it is using its own resources to cover customer losses while pursuing the stolen funds.
The exchange also has an emergency protection reserve known as the Secure Asset Fund for Users, or SAFU.
Established to provide protection during extraordinary security incidents, the fund has generally maintained assets worth approximately $1 billion.
Binance indicated that its own reserves and emergency protection arrangements were available to support its response. However, the precise amount ultimately drawn from SAFU had not been independently established in the initial reports.
The company maintained that customer accounts would be restored without requiring customers to contribute toward the losses.
That commitment is intended to preserve trust, but its successful implementation depends on completing the necessary asset purchases, accounting adjustments and security reviews.
Investigators Suspect North Korean Hackers
TRM Labs attributed the theft to TraderTraitor, a hacking operation associated with North Korea.
The company cited technical evidence, transaction patterns and similarities to previous cryptocurrency attacks. Chainalysis also linked the incident to the same operation with high confidence.
The assessment remains an attribution by cybersecurity investigators rather than a publicly confirmed determination by Binance or law enforcement authorities.
North Korean hackers have been connected to major cryptocurrency thefts in previous years.
In February 2025, attackers stole approximately $1.5 billion from cryptocurrency exchange Bybit. The FBI subsequently attributed that theft to North Korea's TraderTraitor operation.
The FBI said the stolen assets were transferred through numerous cryptocurrency addresses as attackers attempted to convert and conceal them.
The Binance incident appears substantially larger than the Bybit theft, based on the estimated value of the stolen assets.
Cybersecurity investigators have also reported that North Korean operations frequently target digital asset companies because cryptocurrency can be transferred quickly across international borders.
Once stolen assets move through multiple blockchains and services, recovering them becomes increasingly difficult.
However, transaction tracking can still help investigators identify suspicious wallets, alert other exchanges and prevent certain funds from reaching accounts where they can be converted into conventional currencies.
Withdrawals Suspended During Security Review
Binance suspended withdrawals after discovering the breach, while deposits remained available.
The company said it was conducting additional security checks before allowing normal withdrawal activity to resume.
Reports published Friday indicated that Binance expected to begin restoring withdrawals in stages, although the timing depended on completing its investigation and verifying the safety of affected systems.
As of the latest verified reports, a full restoration of withdrawals had not been independently confirmed.
The temporary suspension affected customers who wanted to move cryptocurrency away from the exchange. Such restrictions can cause concern because users depend on the ability to access and transfer their digital assets.
Binance sought to reassure customers by stating that it had enough resources to cover confirmed losses.
The incident also prompted discussions about additional security measures, including stricter transaction approval requirements and delays on unusually large withdrawals.
Some industry executives suggested that exchanges should coordinate more closely when suspicious transfers are detected.
Stronger monitoring could help identify attacks earlier, although safeguards must also account for legitimate customers who need timely access to their funds.
Record Theft Raises Questions About Crypto Security
The Binance breach demonstrates how a single security failure can affect assets spread across numerous blockchain networks.
While blockchains maintain public transaction records, the exchanges and applications that manage cryptocurrency remain vulnerable to attacks targeting employees, software and operational systems.
The theft also shows both the potential and the limitations of industry cooperation. Token issuers and other partners moved quickly to block billions of dollars, but large amounts of cryptocurrency remained outside their control.
Binance has committed substantial corporate resources to protecting customer balances, yet the broader recovery effort remains unfinished.
The exchange must complete its security review, restore withdrawal services and continue working with investigators to identify the attackers.
The final amount recovered will depend on whether additional stolen assets can be traced, frozen and eventually returned. Until those steps are completed, the approximately $3 billion frozen during the initial response should not be treated as money already recovered by Binance.