In one of the biggest cryptocurrency thefts ever recorded, hackers drained roughly $6.3–$6.4 billion from Binance in a rapid attack that unfolded mostly within about 20–30 minutes. The FBI has attributed the breach to North Korean operatives, specifically a group known as TraderTraitor (also linked to the Lazarus Group), which has a long history of crypto-related attacks used to generate funds under international sanctions.
What Happened
The attack targeted Binance’s hot wallets — the internet-connected wallets the exchange uses to process customer withdrawals. Attackers drained funds across roughly 10 different blockchains in a short window on October 29, 2026. Binance paused withdrawals while it investigated and began rebuilding systems.
The exchange has said it will cover all customer losses using company funds and its emergency reserves. It has already set aside more than $6.34 billion and reports that it has replenished about 90% of the stolen assets. Withdrawals are expected to resume soon, and Binance plans to publish updated proof-of-reserves data.
What Was Stolen
Blockchain analysis firms (including TRM Labs and Elliptic) have broken down the major assets taken. The largest portions were:
- Ethereum network: About $3.8 billion. This included roughly 200,000 ETH plus large amounts of stablecoins — approximately 1.9 billion USDT and 823 million USDC, along with many other tokens.
- Bitcoin: 18,270 BTC, worth around $1.47 billion at the time.
- Tron: Roughly $628 million, mostly USDT along with some TRX.
- XRP Ledger: About 233.46 million XRP, valued near $296 million.
- Solana: Around 970,500 SOL, worth approximately $96 million.
- Smaller amounts were taken from other networks including Arbitrum, Optimism, Base, Avalanche, and Polygon.
Stablecoins (especially USDT and USDC) made up a significant share of the total. Because these tokens are issued by centralized companies, Tether, Circle, and others were able to freeze roughly $2.7–$3 billion of the stolen funds relatively quickly. The remaining value — largely in Bitcoin and Ethereum that cannot be frozen by an issuer — is still under the attackers’ control and has been moved across multiple chains.
Who Is Behind It
U.S. authorities and major blockchain analytics firms have linked the attack to North Korean state-sponsored hackers. The group has previously carried out high-value crypto thefts, including the $1.5 billion Bybit hack in 2025. Stolen funds are typically laundered and used to support the regime’s sanctioned activities.
Why This Matters
A theft of this size, even from the world’s largest crypto exchange, highlights ongoing risks in how platforms manage hot wallets and withdrawal systems. Binance’s decision to fully cover user losses is a significant step that should limit immediate damage to customer trust. At the same time, the fact that attackers could move this much value so quickly shows that major security gaps still exist.
The incident is likely to increase pressure on exchanges to improve real-time monitoring, tighten access controls, and strengthen cooperation with stablecoin issuers and law enforcement. It also underscores the difference between assets that can be frozen (like major stablecoins) and those that cannot (Bitcoin and Ether).
Looking Ahead
Crypto has seen large hacks before, but few have approached this scale. Binance’s ability to replace most of the funds quickly will help contain the short-term fallout. The longer-term test will be whether the exchange — and the wider industry — can close the vulnerabilities that allowed an attack of this size to succeed in the first place.