On October 29, 2026, cryptocurrency exchange Binance was struck by a massive security breach, resulting in the theft of an estimated $6.3 billion to $6.4 billion in digital assets. The incident is now recognized as the largest single crypto heist in history, far surpassing the previous record of $1.5 billion stolen from the Bybit platform in February 2025. The attackers moved the funds out of Binance’s hot wallets across approximately 10 different blockchains, with the majority of the theft occurring in a span of just 20 minutes.
Anatomy of a Complex Attack
Initial statements from Binance suggested that the attackers might have gained access through a compromised DevOps engineer’s laptop, which allegedly allowed them to infiltrate a service container and initiate unauthorized withdrawals. However, Binance CEO Richard Teng later clarified that the breach was a highly complex attack process and “not a single ‘one-click’ action”. Teng emphasized that the attacker did not simply exploit one engineer’s permissions, nor has the exchange found any evidence of a wallet private key leak.
According to blockchain intelligence firm TRM Labs, the most likely explanation is that the hackers gained the ability to make Binance’s hot wallet signing system authorize transactions of their choosing across multiple blockchains. The analysis revealed that the attackers spent at least a day and a half preparing, funding the operation with small Tornado Cash withdrawals and testing malicious code on other wallets before launching the full-scale attack.
The North Korean Connection
Multiple prominent blockchain intelligence firms, including TRM Labs, Chainalysis, and Elliptic, have attributed the historic hack to “TraderTraitor,” an elite cybercrime unit affiliated with North Korea’s state-sponsored Lazarus Group.
These firms based their assessments on robust on-chain and off-chain intelligence, identifying several features of the attack that match earlier North Korea-linked heists. Furthermore, Elliptic and Chainalysis confirmed that funds stolen from Binance have already been commingled on-chain with the proceeds from the Bitget exchange exploit that occurred last month, which was also attributed to North Korea. Private intelligence firm Pangolin Intelligence reached a similar conclusion after correlating the on-chain activity with previous known incidents involving North Korean hackers.
Billions Frozen, But Billions Still Unreachable
In the immediate aftermath of the breach, Binance and its industry partners raced to contain the fallout. Working alongside law enforcement, stablecoin issuers, and blockchain analysts, approximately $2.8 billion to $3 billion in stolen assets have been successfully frozen. According to Elliptic, these frozen funds make up roughly 44% of the theft and consist almost entirely of USDT and USDC stablecoins.
Despite these rapid interventions, the attackers managed to secure a massive unfreezable fortune. TRM Labs reported that the hackers currently retain control of over 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion, which no centralized issuer has the power to freeze. The perpetrators are actively swapping the remaining unfrozen stablecoins into Ethereum and other decentralized assets, and have begun moving funds across different blockchains to obscure their tracks.
Binance’s Response and Assurances
Following the discovery of the breach, Binance temporarily suspended all deposits and withdrawals to conduct comprehensive security checks and immediately revoked authorization for the affected addresses. The exchange has formally engaged law enforcement and blockchain intelligence partners to trace the missing funds and identify the culprits.
Binance’s co-founder and former CEO, Changpeng Zhao, who remains the company’s largest shareholder, reassured the public on social media, stating he expects user funds to be fully covered by the exchange. The company has warned that the estimated $6.3 billion to $6.4 billion figure may continue to increase as their teams work closely with industry partners to trace additional assets.