Binance, the world's largest cryptocurrency exchange, is investigating a cyberattack after billions of dollars in cryptocurrency were transferred from its wallets on Thursday, 29 October 2026.
Initial reports estimated that $5.5 billion had been moved, while stablecoin issuers froze around $1.8 billion. Blockchain investigators have since raised the estimated theft to $6.36 billion, potentially making it the largest cryptocurrency heist in history.
According to TRM Labs, approximately $6.36 billion left Binance wallets across ten blockchain networks. The blockchain intelligence firm estimated that around $2.7 billion in affected assets had subsequently been frozen.
Binance acknowledged the security incident and temporarily halted trading, deposits and withdrawals. Co-founder Yi He assured customers that their funds were safe and pledged to cover hacking losses, according to Axios.
How Did Attackers Move More Than $6 Billion From Binance?
The attack targeted Binance's hot wallets, which are internet-connected cryptocurrency wallets used to process transactions and customer withdrawals.
TRM Labs reported that most suspicious transfers occurred within approximately 20 minutes, beginning at 20:05 UTC on 29 October. The activity affected ten blockchain networks, including Ethereum, Bitcoin and Tron.
On Ethereum, investigators identified the use of EIP-7702, a feature that allows wallets to delegate transaction execution to smart-contract code.
TRM found that the attacker had prepared 50 signed authorisations. One valid authorisation allowed an attacker-controlled smart contract to execute transactions from a Binance hot wallet.
TRM suspects Binance's wallet-signing infrastructure was compromised because suspicious transfers occurred across networks using different signing systems. Separately, Axios reported that Binance's preliminary investigation linked the intrusion to a compromised engineer's laptop.
The full sequence of events and the precise extent of the compromise remain under investigation.
Billions Frozen as Tether and Circle Race to Stop Transfers
The first warnings emerged on Thursday when blockchain observers identified unusually large transfers from Binance-linked wallets.
According to Decrypt, early estimates placed suspicious transfers at approximately $5.57 billion across Ethereum, Bitcoin and Tron. Tether initially froze around $975 million in USDT, while Circle blocked approximately $823 million in USDC.
Those restrictions totalled roughly $1.8 billion. Further freezes followed as investigators traced assets across additional networks.
TRM subsequently reported that Tether, Circle, Ripple and World Liberty Financial had frozen approximately $2.67 billion in stablecoins.
Arbitrum's Security Council also restricted assets worth around $30 million, bringing the total to approximately $2.7 billion as of 00:30 UTC on 30 October. Later reports indicated that roughly $3 billion had been frozen.
However, frozen cryptocurrency is not necessarily recovered cryptocurrency. Restrictions can prevent affected tokens from moving, but returning those assets remains a separate process. TRM estimated that the attacker still controlled more than 420,000 Ether (ETH) and 18,270 Bitcoin (BTC), worth approximately $2.4 billion at the time of its assessment.
North Korean Hackers Suspected as Investigators Trace the Money
TRM Labs has attributed the attack to TraderTraitor, a North Korea-linked hacking operation previously associated with major cryptocurrency thefts.
The firm's high-confidence assessment draws on blockchain transactions and other intelligence. Investigators identified signs of advance preparation, suspicious wallet activity and transaction patterns resembling earlier attacks.
However, responsibility for this incident has not been independently established through a publicly disclosed law enforcement finding. North Korean representatives have previously denied allegations involving cryptocurrency exchange hacks.
The estimated theft would substantially exceed the approximately $1.5 billion stolen from cryptocurrency exchange Bybit in February 2025. If TRM's figures are confirmed, the Binance attack would be more than four times larger than that previous record.
Are Binance Customers' Funds Safe?
For Binance customers, the immediate concerns are whether their holdings remain protected and when normal services will resume.
Binance initially said it had not confirmed any impact on customer funds. The exchange subsequently acknowledged approximately $6.3 billion in affected assets, according to Axios.
Co-founder Yi He assured users that their funds were safe and promised Binance would cover hacking losses. However, that assurance does not independently establish the status of every customer asset or confirm when compensation might be available.
The incident coincided with declines across cryptocurrency markets. Bitcoin fell below $79,000 as reports emerged, while Binance's BNB token also dropped. Broader market conditions make it difficult to determine how much of either decline resulted directly from the attack.
Customers should monitor Binance's official security updates and avoid suspicious links or unverified recovery offers.
Investigators must now establish how the attackers gained access, how much cryptocurrency can ultimately be recovered and whether Binance can demonstrate that its remaining assets are secure.
