Inside Binance’s $6.3 Billion Crypto Hack: How a 20-Minute Blitz Sparked a Global Scramble

20 minutes and $6.3 billion: the largest crypto heist on record

In roughly 20 minutes on Thursday, October 29, hackers drained more than $6.3 billion in digital assets from hot wallets belonging to Binance, the world’s largest cryptocurrency exchange. Spanning at least 10 blockchains simultaneously, the blitz is the largest cryptocurrency theft—and potentially the largest single financial heist of any kind—in history, according to The New York Times and blockchain intelligence firms tracking the stolen funds.

Major blockchain analytics organizations—including TRM Labs, Elliptic and Chainalysis—attributed the operation with high confidence to TraderTraitor, an elite North Korean state-sponsored hacking unit associated with the Lazarus Group. The scale of the breach more than quadrupled the previous record, a $1.5 billion exploit against the Bybit exchange in February 2025 that federal investigators also linked to North Korea.

Total loss estimates vary slightly by methodology and token-price snapshots at the moment of the drain: Binance estimated the impact at roughly $6.3 billion, TRM Labs calculated $6.36 billion across 10 blockchains, and Elliptic valued the outflows at $6.43 billion across 11 networks. In the hours that followed, an emergency coalition of stablecoin issuers and blockchain security councils froze roughly $2.85 billion to $3 billion of the stolen assets before they could be laundered, while Binance halted withdrawals and pledged to cover all customer balances from its own reserves.

Updated October 31, 2026, 1:45 p.m. Central. Forensic investigations by law enforcement and blockchain security teams remain active; figures reflect on-chain valuations at the time of the October 29 outflows.

How the breach happened—and what was not compromised

Binance said its initial investigation found no evidence that wallet private keys were leaked. Instead, preliminary findings pointed to a compromised DevOps engineer’s laptop that allowed attackers to access an internal service container and push unauthorized withdrawal batches through legitimate signing infrastructure, according to PBS NewsHour and CNN.

Binance co-CEO Richard Teng later emphasized that the intrusion went beyond a single device, describing a sophisticated, multi-point operation that used a “self-destruct mechanism that destroyed tooling and traces as they went,” The Washington Post reported. That distinction matters: rather than cracking cryptographic keys offline, the attackers hijacked the operational systems that instruct hot wallets—online wallets used to process routine customer withdrawals—to sign and broadcast transactions.

On Ethereum, where roughly $3.8 billion was drained, TRM Labs reported that the attacker used pre-signed EIP-7702 delegation authorizations to manipulate transaction nonces and convert Binance hot wallets into automated “sweeper” contracts under the attacker’s control. Those findings reflect preliminary company and third-party blockchain forensics rather than a completed independent audit or law-enforcement indictment.

“This is almost certainly the largest theft of any kind in history.”

Tom Robinson, chief scientist at Elliptic, as reported by The Guardian

Inside the war rooms: freezing $3 billion in real time

As abnormal outflows lit up blockchain monitors on Thursday afternoon Eastern time, executives at Binance, stablecoin issuers and decentralized finance protocols scrambled into emergency conference calls and Slack “war rooms,” David Yaffe-Bellany and Dustin Volz reported in The New York Times. What followed was a high-speed race between automated laundering scripts and manual asset freezes.

Because major dollar-pegged stablecoins are governed by smart contracts with built-in compliance controls, their issuers can blacklist specific wallet addresses and immobilize stolen tokens on-chain. Tether froze approximately $1.56 billion in USDT, Circle locked roughly $800 million to $823 million in USDC, and Ripple halted about $200 million in related assets, while Arbitrum’s Security Council and DeFi lending protocol Aave enacted emergency restrictions. Altogether, roughly $2.85 billion to $3 billion—nearly half of the gross haul—was frozen within hours.

Native cryptocurrencies such as Bitcoin and Ether, however, have no central issuer or freeze switch. Knowing that stablecoins would quickly be blacklisted, the attackers used automated programs to split funds across thousands of intermediate addresses and swap stablecoins into unfreezable ETH and BTC before issuers could act. Chainalysis noted “laundering patterns we have not seen before,” including an automated sequence on the Tron network in which intermediary wallets received exactly 1 TRX immediately before accepting and forwarding larger tranches of stolen funds.

Where the funds moved across blockchains

The chart below summarizes on-chain outflow estimates across affected networks and the split between frozen assets and unfrozen native tokens, based on forensic analyses from TRM Labs, Elliptic and Chainalysis. Dollar amounts are approximate valuations at the time of the October 29 transactions.

Why investigators point to North Korea’s TraderTraitor

Within 24 hours of the heist, TRM Labs, Chainalysis and Elliptic independently linked the attack with high confidence to North Korea’s TraderTraitor unit. Investigators cited three main lines of technical evidence: pre-attack funding through Tornado Cash that matched prior state-sponsored operations, automated multi-chain laundering scripts, and on-chain commingling of stolen funds with wallet clusters tied to earlier North Korea-attributed exploits, including the 2025 Bybit and Bitget breaches, according to CBS News and The Guardian.

United Nations monitors and U.S. officials have previously reported that Pyongyang relies on large-scale cryptocurrency thefts to evade international sanctions and help finance its weapons programs. Even after accounting for the roughly $3 billion frozen on-chain, the remaining ~$3.3 billion to $3.5 billion in unfreezable assets—including more than 420,000 ETH and 18,270 BTC—would represent the largest single windfall ever captured by North Korean cyber operatives.

At the same time, “high confidence” attribution from private blockchain intelligence firms is not a formal judicial finding. While the FBI, the U.S. Secret Service and international law-enforcement agencies have opened investigations, federal authorities had not issued a formal public indictment or declassified government attribution in the reporting reviewed through October 31.

Timeline of the heist and response

Times are listed in Coordinated Universal Time (UTC) and U.S. Eastern Daylight Time (ET).

1. Wednesday, October 28 · ~36 hours before the drainAn operator wallet used in the attack receives three small withdrawals from the Tornado Cash privacy mixer to fund contract deployment, according to TRM Labs.
2. Thursday, October 29 · 20:05 UTC (4:05 p.m. ET)Unauthorized outflows begin across Binance hot wallets on 10+ blockchains. Roughly $6.36 billion is siphoned within a 20-minute window, led by Ethereum (~$3.8B) and Bitcoin (~$1.5B). Source: TRM Labs
3. Thursday, October 29 · ~21:00–23:05 UTC (5:00–7:05 p.m. ET)Emergency war rooms activate across the crypto industry. Tether, Circle, Ripple and protocol security councils freeze nearly $3 billion in stolen stablecoins and tokens; a smaller second wave of outflows hits Avalanche (~$28M) and Polygon (~$10M). Binance suspends withdrawals. Source: Elliptic
4. Friday, October 30TRM Labs, Elliptic and Chainalysis attribute the attack with high confidence to North Korea’s TraderTraitor unit. Binance co-CEO Richard Teng says user balances will be fully covered by company reserves and the Secure Asset Fund for Users (SAFU). Source: The Guardian
5. Saturday, October 31Binance announces in Recovery Update #3 that it has replenished 90% of stolen assets using treasury and SAFU reserves ahead of phased withdrawal resumptions. The New York Times details the behind-the-scenes crisis response and warns of an escalating era of AI- and automation-driven cyber threats. Source: The New York Times

What it means for Binance users and the crypto market

For individual account holders, Binance executives Richard Teng and co-founder Yi He stated that no customer balances would be reduced and that the company would absorb the entire unrecovered loss through its corporate treasury, Futures Insurance Fund and Secure Asset Fund for Users (SAFU). On Saturday, October 31, Binance reported that it had already replenished 90% of the stolen assets—including 100% of affected Bitcoin, Ether, USDT, USDC, BNB, Solana, XRP and Zcash—and published an updated Proof of Reserves snapshot while preparing to restore full withdrawal services over the November 1–2 weekend.

Company reserve snapshots and executive pledges provide on-chain visibility into designated wallet holdings, though security and accounting analysts note that a Proof of Reserves snapshot is not the same as a comprehensive independent audit of all corporate liabilities. Meanwhile, Elliptic released a public blocklist of attacker addresses to help exchanges and compliance teams screen out tainted funds.

As The New York Times reported, cybersecurity researchers view the October 29 heist as a watershed warning: as state-sponsored groups combine social engineering and endpoint compromise with artificial intelligence and high-speed cross-chain automation, a single breach inside signing infrastructure can move billions of dollars before human defenders can react.

Sources and visual credits

The New York Times: “Binance’s $6.3 Billion Hack Is Just the Start of a Risky New Era” (David Yaffe-Bellany and Dustin Volz) · TRM Labs: on-chain forensic breakdown and attribution · Elliptic: $6.43B valuation, freeze estimates and blocklist · Chainalysis: automated laundering analysis · PBS NewsHour: incident overview · The Guardian: attribution and industry reaction · The Washington Post: attack mechanics and self-destruct tooling · CNN · CBS News · Wikipedia: 2026 Binance hack.

Hero and thumbnail: Newstro generated conceptual editorial illustration; not a photograph of an actual facility or device. Blockchain outflow chart: Newstro SVG graphic compiled from TRM Labs, Elliptic and Chainalysis forensic estimates.