2026 Binance hack
 Logo of Binance | |
| Date | 29 October 2026 |
|---|---|
| Type | Cryptocurrency exchange heist |
| Outcome | ~US$6.3 billion[a] in assets stolen with $2.7–$3 billion frozen[b] |
| Accused | TraderTraitor (North Korea) |
On 29 October 2026, US$6.3 billion worth of digital currency was stolen from Binance, a cryptocurrency exchange, allegedly by the North Korea–linked hacking group TraderTraitor. The exchange hack is the largest-ever cryptocurrency heist, surpassing the $1.5 billion Bybit hack in 2025,[2] with the most affected blockchains being Ethereum and Bitcoin. Approximately $3 billion of the stolen stablecoins have been frozen. North Korea has since denied being behind the theft.[3]
Binance, having initially halted all trades, has stated it will cover all losses.[4] The exchange began allowing withdrawal services for customers on 1 November, processing $4.65 billion worth of asset withdrawals on that day.[5] Binance have also said that they will show proof of reserves on 2 November. The United States Secret Service has said that they are working to recover the stolen assets.[6]
Hack
[edit]| Blockchain | Value in US$ billions |
|---|---|
| Ethereum | |
| Bitcoin | |
| Tron | |
| XRP | |
| Solana | |
| Arbitrum, Optimism, Base | |
| Avalanche | |
| Polygon |
According to the blockchain intelligence company TRM Labs, the hack was linked to North Korean hackers.[6][7][8] Specifically, it has been attributed to TraderTraitor, who appear to be part of Lazarus Group.[9] The hack is the largest-ever cryptocurrency heist,[10][11] surpassing the $1.5 billion Bybit hack in 2025. According to the chief scientist of Elliptic, a blockchain analytics firm, the hack "is almost certainly the single largest-known theft of any kind".[2]
The hack began on 29 October 2026 between 8:05 p.m. UTC, on the XRP Ledger, and 8:20 p.m. UTC, on the Ethereum and Bitcoin blockchains.[c][11] It took approximately 20 minutes, during which assets worth $6.36 billion were taken out of ten blockchains.[7][1] The main Ethereum transaction was processed at 8:24 p.m. UTC with a combined 64 transfers.[6] Further attacks occurred at 11:05 p.m. UTC on Avalanche and Polygon, followed by a final Ethereum transaction at 11:56 p.m UTC. The hackers then moved 17,260 Ether to a new wallet address at 5:15 a.m. UTC the following day.[11]
Of the $6.3 billion stolen, the most affected blockchain was Ethereum, with $3.8 billion stolen, followed by 18,270 Bitcoin, valued at $1.5 billion. Other blockchains affected included TRON, XRP, and Solana; with $628 million, $296 million, and $96 million in assets stolen, respectively.[1] One transaction was for more than $2.5 billion.[2] According to Binance's CEO Richard Teng, the hackers used a multi-signature protocol called EIP-7702 to execute the attack on Binance's hot wallet.[6]
Binance initially said that it believed the attack was carried out via a software engineer's compromised laptop, through which the hackers made unauthorized withdrawals.[7][10] Other issues were later found,[12] and the hackers likely prepared the attack at least 36 hours in advance.[10] While the exploit featured unique money laundering patterns,[8] as of 30 October 2026, the hackers had yet to convert the stolen crypto into fiat currency.[2] This process can take weeks to years and may require paying middlemen.[2]
Aftermath
[edit]| Category | Value in US$ billions |
|---|---|
| Stablecoins | |
| Bitcoin | |
| Other assets |
Following the cyberattack, Binance halted all trades and suspended withdrawals.[11][12] The exchange coordinated half of the hacked assets to be frozen by blockchain partners,[2][9][12] with cryptocurrency companies, including Tether and Circle, freezing approximately $3 billion of the stolen stablecoins.[9][1]
Tether initially froze cryptocurrency wallets at 9:01 p.m. UTC with Circle following suit three minutes later. At 10:06 p.m. UTC, Tether blocked Binance's hot wallet, with Circle doing the same at 11:53 p.m. UTC.[11] Binance subsequently removed the hackers' permissions from its hot wallet at 12:10 a.m. UTC.[1]
The day after the hack, the company announced that they would cover all losses resulting from the hack, saying that all user funds were "completely safe". Binance also announced that they were cooperating closely with law enforcement to determine the origin of the hackers.[7][10] In response to the hack, Bitcoin fell by 5% to less than $80,000.[10][12] A number of related businesses, including Robinhood and Coinbase also saw significant decreases in their stock value.[12]
Withdrawals
[edit]Binance announced that they intend to show proof of reserves on 2 November, and Teng planned to resume services on Binance within 40 hours. The exchange stated that they have set aside $6 billion to cover all losses,[6] announcing they would "absorb the financial impact of [the] stolen funds" rather than their users.[13] On 31 October, Binance announced that they had replenished 90% of the losses, with remaining 10% representing tokens that were less liquid,[13] with the intention to resume withdraw services for customers on 1 November.[14] The exchange began to allow customers to withdraw funds as planned, starting with Ethereum, USDT, and USDC, as well as some tokens on its own blockchain,[4] followed by Dogecoin and Solana.[5] Binance said that it used funds from its Secure Asset Fund, Futures Insurance Fund, Bitcoin reserve, and corporate treasury, in order to purchase tokens to cover the losses from the hack.[4]
Within nine hours of withdrawals resuming at 6 a.m. UTC across all 15 blockchains, users withdrew $4.65 billion in assets and deposited $1.01 billion, resulting in a net total of $3.6 billion withdrawn from the exchange.[15] According to the data platform DefiLlama, by the morning of 2 November, users had withdrawn a net total of $4.9 billion, equating to 3% of total assets. The exchange also reopened withdrawals for US dollars and dirhams that same morning. Binance stated that they had a remaining 5% of tokens to purchase in order to reimburse customers,[5] and that withdrawals had begun to subside after the initial high volume.[15]
Investigation
[edit]The United States Secret Service said that it was working to track, freeze, and recover the stolen funds from Binance.[6] The FBI released Ethereum, Bitcoin, and Solana wallet addresses linked to the hack, and asked the public for any information.[16]
A United Kingdom Financial Conduct Authority spokesperson confirmed that while Binance is not registered to offer crypto services in the UK, the Authority is aware of a recent incident and is currently investigating to understand its potential impact.[8]
On 3 November, Kim Yo Jong, Department Director of the Central Committee of the WPK, and sister of North Korean Leader Kim Jong Un, issued a press statement through the Korean Central News Agency, denying that the hack had been carried out by North Korea. In the statement, Kim Yo Jong accused the United States of using the hack to attack the reputation of North Korea, and also denied North Korean involvement in the Bybit hack.[17][3]
See also
[edit]Notes
[edit]References
[edit]- 1 2 3 4 5 6 7 8 9 Lee, Jenny (30 October 2026). "Binance's $6.3 billion hack: What we know and what comes next". CNBC. Archived from the original on 30 October 2026. Retrieved 31 October 2026.
- 1 2 3 4 5 6 Milmo, Dan and Makortoff, Kalyeena (30 October 2026). "How big a deal is the $6.3bn Binance crypto heist, who did it, and are investments safe?". The Guardian. Retrieved 31 October 2026.
- 1 2 Kim, Hyung-Jin; Kim, Tong-Hyung (3 November 2026). "North Korea denies being behind $6.3bn Binance crypto hack". BBC News. Retrieved 3 November 2026.
- 1 2 3 "Binance resumes customer withdrawals after record $6.3bn hack". The Guardian. 1 November 2026. ISSN 0261-3077. Retrieved 1 November 2026.
- 1 2 3 Asgari, Nikou (2 November 2026). "Binance users pull $5bn as crypto exchange restarts services after heist". Financial Times. Retrieved 2 November 2026.
- 1 2 3 4 5 6 Hadfield, Charlotte; Hoyle, Craig; Tidy, Joe; McMahon, Liv (30 October 2026). "Binance hack updates: North Korea could be behind $6.3bn hack of crypto exchange". BBC News. Archived from the original on 30 October 2026. Retrieved 30 October 2026.
- 1 2 3 4 Berry, Alex; Connor, Richard (30 October 2026). "Cryptocurrency exchange Binance suspends trading after suspected hack linked to North Korea". Deutsche Welle. Agence France-Presse, Associated Press, Reuters. Retrieved 30 October 2026.
- 1 2 3 Milmo, Dan and Makortoff, Kalyeena (30 October 2026). "North Korea is likely culprit behind $6.3bn crypto hack, 'largest heist in history'". The Guardian. ISSN 0261-3077. Retrieved 31 October 2026.
- 1 2 3 Barnes, Angela (30 October 2026). "Binance hit by major hack as billions in crypto funds are frozen". Euronews. Retrieved 31 October 2026.
- 1 2 3 4 5 Sephton, Connor (30 October 2026). "Crypto industry suffers 'largest bank heist in human history' as billions stolen in Binance hack". Sky News. Retrieved 30 October 2026.
- 1 2 3 4 5 Lee, Jenny; Napolitano, Liz; Giangiulio, Davis (29 October 2026). "$6.3 billion Binance hack is largest crypto theft on record". CNBC. Archived from the original on 31 October 2026. Retrieved 31 October 2026.
- 1 2 3 4 5 Yaffe-Bellany, David and Mac, Ryan (30 October 2026). "Binance Suspends Withdrawals After Crypto Hackers Steal $6.3 Billion". The New York Times. Archived from the original on 30 October 2026. Retrieved 31 October 2026.
- 1 2 "Binance says 90% of stolen assets replenished". Reuters. 31 October 2026. Retrieved 31 October 2026.
- ↑ "Crypto firm Binance covers 90% of losses after $6.3bn hack". BBC News. 31 October 2026. Archived from the original on 31 October 2026. Retrieved 31 October 2026.
- 1 2 Lee, Jenny (2 November 2026). "Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack". CNBC. Retrieved 2 November 2026.
- ↑ "North Korea Responsible for $6 Billion+ Binance Attack". FBI Cyber. 31 October 2026. Archived from the original on 1 November 2026.
- ↑ Kim, Yo Jong (3 November 2026). "Press Statement of Kim Yo Jong, Department Director of C.C., WPK" (Press release). Korean Central News Agency. Retrieved 3 November 2026.
