Binance Loses $6.3 Billion in Hot-Wallet Breach Blamed on North Korean Hackers

By Coinvote

Published October 31, 2026 - 15:22 UTC | 6 mins read

Attackers emptied Binance hot wallets across multiple blockchains on October 29, and investigators link the theft to North Korea's TraderTraitor group. Stablecoin issuers froze about $3 billion, but roughly $3.3 billion remains with the attacker, and Binance says it will cover every loss.

A 20-minute sweep across about 10 blockchains

Binance, the world's largest crypto exchange, lost about $6.3 billion in assets on Thursday, according to the exchange itself. Decrypt reported that the outflows began around 4:05 p.m. Eastern, after U.S. markets closed. Hot wallets on roughly 10 blockchains were emptied, and most of the funds moved in a window of about 20 minutes.

According to Decrypt, the analytics firms Chainalysis and TRM Labs estimated a slightly higher total of around $6.4 billion. Bitcoin Magazine said Chainalysis dates the first outflows to about 4:20 p.m. Eastern on October 29, and that freezes began by 5:14 p.m. The two outlets therefore differ by a few minutes on the start time, and neither explains why.

The theft is the largest crypto hack on record. Decrypt notes it is more than four times the $1.5 billion taken from Bybit in February 2025. That earlier heist was also attributed to North Korean hackers.

How the attackers reached the wallets

Binance's early investigation traced the breach to the hijacked laptop of an engineer working in DevOps. According to Bitcoin Magazine and Decrypt, that foothold may have given the attacker entry to a service container, from which unapproved withdrawals could be sent. The exchange says it has found no evidence that wallet private keys leaked.

Binance has since widened its account. Decrypt reported that the investigation found additional points of breach, and that CEO Richard Teng now calls the operation more complex than the use of a single engineer's permissions. Binance also said the attacker ran a built-in self-deletion routine that erased its tools and leftover evidence.

On Ethereum, the attacker used EIP-7702, a feature added in 2025 that allows regular wallets to execute smart-contract code for a limited time. According to Decrypt, TRM Labs said the attacker used 50 pre-signed authorizations to make a Binance hot wallet run code that swept its assets. Bitcoin Magazine reported that, according to Chainalysis, an operational wallet funded through Tornado Cash submitted the signed authorizations.

TRM Labs said the episode points to a compromise of Binance's signing infrastructure rather than a flaw in Ethereum itself. The Block headlined a similar conclusion, saying hot-wallet signing infrastructure was compromised. That outlet's detailed reporting was not available, so its account is limited to that framing.

The numbers that define the loss

The figures below come from the outlets named, and they differ in places because each relies on a different statement or firm.

Total stolen: about $6.3 billion per Binance, and around $6.4 billion per Chainalysis and TRM Labs.
Frozen: Binance puts the total of assets frozen on-chain at about $3 billion.
Tether: more than $1.567 billion in USDT, according to CEO Paolo Ardoino, as reported by Bitcoin Magazine. Decrypt put the figure at more than $1.5 billion.
Circle: more than $800 million in USDC, according to CEO Jeremy Allaire. Decrypt cited around $823 million.
Still controlled by the attacker: more than 420,000 ETH and 18,270 BTC, worth over $3 billion, per Decrypt. Elliptic estimates about $3.3 billion.
Binance reserve: more than $6.34 billion set aside, with about $5 billion already held in the stolen token types.

A race between swaps and freezes

Stablecoins can be frozen by their issuers, and the attacker appears to have known it. As reported by Bitcoin Magazine, Chainalysis said the attacker converted $325 million of stablecoins into $285 million of ETH in a span of about 20 minutes. A further $175 million went to stopover wallets.

Tether and Circle both used their ability to blacklist addresses. Decrypt said issuers moved faster than in earlier incidents. First Digital CEO Vincent Chok said stolen FDUSD has also been frozen, per Bitcoin Magazine.

The assets that cannot be frozen are the problem. Decrypt reported that the attacker has kept moving funds through Tron and other networks. After the Bybit theft, the same group converted roughly 84% of stolen Ethereum into Bitcoin through the cross-chain network Thorchain. Whether it repeats that route is an open question.

Binance's promise and the open verification step

Teng said Binance will make up all losses using its own money and the Secure Asset Fund for Users, which serves as an emergency reserve. He also stressed that customer assets were never touched, according to Decrypt. Binance has paused withdrawals while it rebuilds and retests its systems. It aims to restore them by Sunday and to publish a full proof of reserves by Monday. Deposits are operating normally.

Bitcoin Magazine noted that the exchange still has to verify the assets it describes as frozen and protected. Its video program also raised solvency questions about whether Binance can cover the losses. Binance's $6.34 billion reserve is the exchange's answer to that question. The upcoming proof of reserves will show how much outside observers can confirm.

Where the outlets agree and differ

All four pieces agree on the broad outline: a record theft, a hot-wallet compromise, a North Korean attribution and a large stablecoin freeze. They differ on size, since the headline figures run from $6B to $6.4 billion. They also differ on who gets credit for the attribution detail. Decrypt names both Chainalysis and TRM Labs for TraderTraitor, while Bitcoin Magazine describes the group as a unit associated with North Korea.

Bitcoin Magazine also hedged that the theft would be the largest on record only if confirmed at this scale. Decrypt, by contrast, states flatly that no earlier theft comes close. The market impact points the same way in both accounts but differs in size. Decrypt cited more than $1.3 billion in leveraged liquidations, while Bitcoin Magazine put total market liquidations at $1.5 billion. Bitcoin Magazine split that into $468 million for bitcoin and $358 million for ether, with longs bearing most of the losses.

Market reaction and regulatory fallout

Bitcoin fell to about $76,400 on Friday, down roughly 4%, according to Decrypt. It now trades near $77,364, with a 7-day decline of 3.9%. Decrypt credited the calm to a larger market and to spot Bitcoin ETFs holding roughly 1.3 million BTC. Decrypt reported that Cantor Fitzgerald, TD Cowen and Compass Point encouraged clients to purchase shares of crypto-related companies during the dip, treating the hack as a problem specific to Binance's security.

Standard Chartered's Geoffrey Kendrick told CoinDesk that prices may have further to fall, as relayed by Bitcoin Magazine. He said a new base will form once assets are unfrozen and more details emerge. He also argued that the incident might speed up a move of trading toward decentralized exchanges.

CFTC Chairman Michael Selig said on CNBC that the breach proves the point behind the rules the agency proposed earlier this month. The FBI said it is aware of the incident. Reuters, as cited by Bitcoin Magazine, reported that Binance is cooperating with both the FBI and the U.S. Secret Service.

What to watch next

Binance's Sunday withdrawal target and Monday proof of reserves are the nearest checkpoints. Readers can compare the reserve figures against the $6.34 billion the exchange has stated. Users should also heed Chainalysis's warning that scammers are impersonating the firm with fund-recovery and recruiting offers.

Several questions remain open. Investigators have not said whether the unfrozen ETH and BTC will be laundered or recovered. Binance has not detailed the additional breach points it found. A separate Polymarket incident, in which hackers drained more than $2.6 million according to Bitcoin Magazine, coincided with the sell-off, but the outlets do not link the two events.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$77,364	-0.5%	-3.9%	$1.56 trillion
Ethereum (ETH)	$2,247	-0.4%	-5.1%	$274.50 billion
BNB (BNB)	$707	+0.3%	-3.2%	$92.94 billion
TRON (TRX)	$0.314809	-6.1%	-4.3%	$29.91 billion

CoinGecko data as of 2026-10-31 (UTC).

FAQ

How much was stolen in the Binance hack?

Binance says about $6.3 billion in assets was affected. Chainalysis and TRM Labs put the total at around $6.4 billion, according to Decrypt. Roughly $3 billion has been frozen, and about $3.3 billion remains unrecovered.

Who is blamed for the Binance hack?

Chainalysis and TRM Labs attribute the attack to TraderTraitor, a group linked to North Korea. The same group was blamed for the $1.5 billion Bybit theft in 2025. Bitcoin Magazine notes that the scale of the theft is still subject to confirmation.

Are Binance users losing money?

Binance says customer assets were never touched. CEO Richard Teng said the exchange will cover all losses with company funds and its Secure Asset Fund for Users. Withdrawals are paused, and Binance aims to restore them by Sunday.