Binance hack causes an estimated $6.3 billion loss. Explore the attack, frozen funds, North Korea links and implications for crypto holders.
Author: Kritika Gupta
30th October 2026– Binance has reported a security hack with an estimated impact of $6.3 billion. Blockchain investigators describe the incident as the largest crypto theft on record, surpassing the February 2025 Bybit hack. Binance says it will cover customer losses through its SAFU reserve and company funds. Meanwhile, the exchange has suspended deposits and withdrawals as security teams check its infrastructure.
Early breakdowns circulating online placed losses above $5.6 billion. However, subsequent investigations identified additional outflows and distinguished assets stolen directly from assets the attacker acquired through swaps.
High Signal Summary For A Quick Glance
High attention and emotional sentiment detected.
The attacker moved most of the funds within approximately 20 minutes, starting around 20:05 UTC on October 29. TRM tracked transfers across ten blockchains.
On Ethereum, the attacker used an EIP-7702 authorization to make a Binance wallet execute malicious sweeping code. Other affected wallets signed conventional transfers across multiple networks.
Consequently, TRM’s assessment points to compromised signing infrastructure rather than an Ethereum-only exploit. TRM also attributes the attack to North Korea’s TraderTraitor group with high confidence. That remains the firm’s attribution while investigators continue their work.
Separately, Binance says its initial investigation points to a compromised DevOps engineer’s laptop. According to the exchange, that access allowed the attacker to reach a service container and submit unauthorized withdrawals.
Binance says investigators have found no evidence of a wallet private key leak. Nevertheless, the incident highlights how attackers can abuse transaction authorization systems without extracting private keys.
Binance has revoked the affected address authorization and engaged law enforcement and blockchain intelligence partners. It also plans to publish a technical post-mortem and updated proof of reserves after remediation.
The exchange estimates that partners have frozen approximately $3 billion on-chain. However, freezing funds prevents further movement; it does not automatically return those assets to Binance. Recovery still requires additional coordination.
Tether, Circle and other issuers have blocked substantial stablecoin balances. Meanwhile, the attacker swapped portions of the stolen stablecoins into ETH and other assets before some freezes took effect.
For crypto holders, this exposes a practical distinction: centralized stablecoins give issuers a mechanism to block funds, while native assets such as BTC offer no equivalent issuer-controlled freeze function.
Key milestones related to this development
Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop.
The attacker drains wallets across multiple blockchains, moving most funds within approximately 20 minutes.
Binance reports an estimated $6.3 billion impact and suspends deposits and withdrawals during security checks.
Binance reports approximately $3 billion frozen and commits to covering losses through SAFU reserves and company funds.
Binance plans to publish investigation findings and updated proof of reserves after remediation.
Markets fell as traders assessed the breach. Reuters reported that Bitcoin dropped more than 3% to approximately $76,368, while ETH fell more than 3% to around $2,178. BNB declined approximately 5% over 24 hours to $709.70.
These prices reflect the reporting window and may change as the situation develops.
For Binance customers, the immediate issue extends beyond reimbursement. Withdrawal restrictions also limit access to funds while the exchange completes security checks.
Meanwhile, the attacker’s remaining holdings create potential selling pressure. However, those balances alone cannot establish when, where or whether the attacker will sell.
The next disclosures will help readers assess three issues: how Binance restores secure withdrawals, how much frozen value it recovers, and how its updated reserves support its commitment to cover losses.
Ultimately, the breach puts exchange access controls and signing permissions under scrutiny. Strong key protection must work alongside controls that prevent compromised internal systems from authorizing withdrawals.
Our Crypto Talk is committed to unbiased, transparent, and true reporting to the best of our knowledge. This news article aims to provide accurate information in a timely manner. However, we advise the readers to verify facts independently and consult a professional before making any decisions based on the content since our sources could be wrong too. Check our Terms and conditions for more info.
