Binance Hit by Record-Breaking Security Incident. $6.3 Billion Drained from the Exchange. Is This the Largest Hack in Crypto History?
On October 29, 2026, one of the most serious security incidents in the history of the cryptocurrency market took place. Assets worth an estimated $6.3 billion were transferred out of 17 Binance hot wallets. The operation affected multiple blockchains and lasted just under four hours. Binance officially confirmed the incident, pledged to cover all losses using its SAFU fund and its own funds, and began working with analytics firms and stablecoin issuers to recover the assets.
The scale of the incident is unprecedented. For comparison, the previous record-breaking attack on Bybit in February 2025 resulted in losses estimated at approximately $1.5 billion. In Binance's case, the reported impact is more than four times greater. However, this does not mean that the entire $6.3 billion has been permanently lost. Approximately $3 billion has been frozen, while some of the remaining assets are still under the attacker's control.
What is most concerning, however, is how the operation was carried out. According to Binance's preliminary findings, the attacker may have gained access to the exchange's internal infrastructure through a compromised laptop belonging to a DevOps engineer. There is currently no evidence that the wallets' private keys were leaked. The problem therefore appears to have involved the system used to authorize withdrawals, rather than a breach of the underlying blockchain security.
Binance: What Exactly Happened on October 29?
The first outflows from Binance wallets were recorded at approximately 20:04 UTC. Over the following minutes, assets began moving to addresses controlled by the attacker. According to Bitquery's reconstruction, the operation involved 17 Binance hot wallets and nine blockchain networks. TRM Labs reports flows across ten blockchains.
The networks affected included Bitcoin, Ethereum, Tron, Solana, XRP Ledger, Arbitrum, Avalanche, Optimism, Base and Polygon. The total value of assets transferred out of the exchange's wallets was estimated at approximately $6.3-$6.36 billion.
Two events that occurred almost simultaneously are particularly important, but they should not be confused. At 20:20:06 UTC, approximately 18,270 BTC was transferred to an address controlled by the attacker. At 20:20:59 UTC, 50 EIP-7702 authorizations associated with Binance 14 were recorded. These were two separate events, occurring less than a minute apart.
The main series of ETH and ERC-20 token transfers began at approximately 20:24 UTC. Further transfers from Binance wallets continued until 23:56 UTC. This means the outflows analyzed by Bitquery covered a period of almost four hours.
Key moments in the incident:
20:04 UTC - The first recorded outflows from Binance wallets.
20:20:06 UTC - Approximately 18,270 BTC transferred to an attacker-controlled address.
20:20:59 UTC - 50 EIP-7702 authorizations associated with Binance 14 recorded.
20:24 UTC - The main series of ETH and ERC-20 token transfers begins.
20:26 UTC - Further ETH transfers from Binance wallets.
20:40-20:41 UTC - Additional transfers of ETH and USDC.
23:56 UTC - End of the outflow window analyzed by Bitquery.
02:23 UTC, October 30 - Binance publishes its official incident statement, estimating the impact at $6.3 billion.
Sources: Bitquery's on-chain reconstruction and Binance's official statement.
Which Cryptocurrencies Were Stolen from Binance?
The incident was not limited to a single asset or blockchain network. The attacker transferred enormous amounts of stablecoins, ETH, BTC and numerous popular tokens. Detailed records of transfers on Ethereum illustrate the scale of the operation.
Some of the most significant assets included:
USDT: 1,615,409,499 tokens worth approximately $1.615 billion.
USDC: 780,177,060 tokens worth approximately $780 million.
ETH: Approximately 195,470 ETH worth around $442 million.
wBETH: 29,934 tokens worth approximately $74.6 million.
RLUSD: 62,597,240 tokens worth approximately $62.6 million.
XAUt: 11,372 tokens worth approximately $45.6 million.
UNI: 6,189,796 tokens worth approximately $41.2 million.
ENA: 198,369,717 tokens worth approximately $37 million.
PEPE: Approximately 7.18 trillion tokens worth around $35.3 million.
USD1: 27,760,802 tokens worth approximately $27.7 million.
LINK: 2,263,172 tokens worth approximately $25 million.
AAVE: 127,853 tokens worth approximately $16.2 million.
This breakdown comes from an earlier analysis of transfers on Ethereum. It does not represent the complete balance of all assets transferred during the multi-chain incident. These amounts should also not be added to the later $6.3 billion estimate as a separate loss.
18,270 BTC Worth Approximately $1.4 Billion. The Attacker Split the Bitcoin Across 19 Wallets
One of the most interesting aspects of the incident is how the stolen Bitcoin was distributed. Approximately 18,270.2 BTC, valued at around $1.4 billion at the time of reporting, was sent to the attacker's address in 11 transactions. The funds were then divided among 19 wallets.
The distribution was as follows:
17 wallets received exactly 1,000 BTC each.
One wallet received approximately 832.5 BTC.
The final wallet received approximately 437.7 BTC.
According to CoinDesk, as of 04:23 UTC on October 30, none of these 19 wallets had forwarded the Bitcoin they received.
This is particularly important because of the difference between Bitcoin and stablecoins. Issuers of USDT and USDC can freeze funds at the token contract level. Bitcoin has no central issuer capable of freezing specific coins. In practice, recovering control over BTC requires cooperation from exchanges, OTC brokers or other intermediaries that can refuse to process funds linked to the attack.
The Attacker Converted Some Stablecoins into ETH and TRX. What Was Recovered?
Freezing stablecoins does not mean the attacker was unable to convert some of the stolen funds into other assets beforehand. According to Bitquery's reconstruction, approximately $729 million in stolen stablecoins was exchanged for ETH and TRX before some of the addresses were frozen.
As a result, the attacker accumulated approximately 490,361 ETH. This is around 2.4 times the initial 200,630 ETH obtained in the analyzed outflows. The remaining ETH was accumulated by converting other stolen assets into Ether.
According to Bitquery's measurement at 03:54 UTC on October 30, approximately $3.1 billion was still held in wallets controlled by the attacker. At that point, Bitquery had not recorded transfers of these funds to exchanges or mixers.
TRM Labs presents a somewhat different picture, based on an earlier measurement and its own methodology. According to its analysis, the attacker still controlled more than 420,000 ETH and 18,270 BTC, with a combined value of approximately $2.4 billion. Differences between these estimates reflect factors such as the time of measurement, the scope of tracked assets and changes in on-chain flows.
How Did the Attacker Gain Control of Binance Wallets?
Binance's preliminary findings suggest that the initial point of entry may have been a compromised laptop belonging to a DevOps engineer. The attacker allegedly used it to gain access to a service container within the exchange's internal infrastructure, which was then used to send unauthorized withdrawal transactions.
Binance stated that it had found no evidence of private key leakage from its wallets. This is a very important distinction. The transactions were signed by Binance's system, but that does not mean anyone broke the cryptography securing Bitcoin or Ethereum. The problem appears to have involved access to the infrastructure responsible for authorizing withdrawals.
The mechanism used on Ethereum, involving EIP-7702, is particularly interesting. This functionality allows a regular wallet to delegate the execution of operations to smart contract code while retaining its own address and balance.
According to the on-chain analysis, the attacker used 50 authorizations signed by Binance 14. They were prepared for successive nonce values. This allowed one of the authorizations to be accepted at the appropriate moment, after which the wallet began executing code controlled by the attacker. As a result, assets could be automatically transferred to an external address.
This does not mean that EIP-7702 is inherently a security vulnerability. It is a feature of the Ethereum protocol that, in this case, was allegedly exploited as part of a compromise involving the infrastructure used to authorize transactions.
Binance has announced that it will publish a detailed technical report once the investigation is complete. At this stage, the explanation of the attack should therefore be treated as preliminary findings rather than a final forensic report.
Who Is Behind the Binance Attack? Evidence Points to North Korea
TRM Labs attributed the incident to the North Korean-linked TraderTraitor group with a high degree of confidence. Chainalysis has also pointed to links with North Korea. Analysts have identified similarities to the February 2025 attack on Bybit, which was attributed to a group linked to the North Korean state apparatus.
TraderTraitor is the name used to describe a cybercriminal group associated with North Korea. Its activities include attacks on cryptocurrency companies and attempts to obtain funds used to finance the state's activities.
However, it is important to be cautious when drawing definitive conclusions. Attribution by blockchain analytics firms is not equivalent to official confirmation of the attackers' identities by law enforcement agencies. Binance has stated that it is cooperating with relevant authorities and industry partners to identify those responsible for the incident.
How Much Was Frozen? Binance Reports Approximately $3 Billion in Frozen Assets
One of the most important elements of the response to the attack was cooperation with stablecoin issuers and blockchain infrastructure operators. Tether, Circle, Ripple, World Liberty Financial and other partners took action to block assets linked to the attack. In addition, the Arbitrum Security Council froze funds held on the Arbitrum network.
Binance's latest statement on October 30 indicates that approximately $3 billion was frozen. An independent Bitquery analysis identified approximately $2.7 billion, while TRM Labs estimated the value of frozen stablecoins and assets across networks at around $2.7 billion.
The differences between these estimates reflect the timing of the measurements, the scope of the networks analyzed and the methodologies used by individual firms. They should not be treated as a single, definitive balance. Furthermore, freezing assets does not necessarily mean they are immediately returned to Binance.
How Did Binance Respond? SAFU, Loss Coverage and Suspended Withdrawals
Binance officially confirmed the incident on October 30 at 02:23 UTC. The exchange stated that its preliminary investigation pointed to a possible compromise of a DevOps engineer's laptop, which may have enabled the attacker to access a service container and send unauthorized transactions.
The most important announcement, however, concerned financial responsibility. Binance pledged to cover all losses using its SAFU fund and its own funds. The exchange assured users that their assets were safe.
SAFU, or Secure Asset Fund for Users, is Binance's emergency fund designed to protect users in exceptional security-related situations. Binance announced that it would use both the fund's resources and the company's own funds.
As part of its security response, the exchange:
Temporarily suspended deposits and withdrawals while security checks were carried out.
Revoked authorization for addresses affected by the incident.
Began cooperating with law enforcement agencies and blockchain analytics firms.
Pledged to cover all losses using SAFU and its own funds.
Announced that it would publish an updated Proof of Reserves after completing its remediation work.
In a subsequent statement, Binance clarified that deposits remained available, while withdrawals were still suspended as the exchange rebuilt and reviewed its withdrawal systems. The exchange expected withdrawals to resume within approximately 48 hours.
Binance Proof of Reserves Under Scrutiny. Do Reserves Still Cover 100% of Customer Balances?
One of the most important issues to emerge after the incident is Proof of Reserves, a statement of an exchange's reserves and its liabilities to customers.
CoinDesk pointed out that the wallets from which the assets were transferred appeared in Binance's October reserve snapshot. This means that some of the assets affected by the incident had been listed as reserves backing customer balances.
According to CoinDesk's analysis, Binance reported 100% coverage of its ETH liabilities before the incident. The transfer of approximately 204,500 ETH could have reduced this ratio to around 94%, assuming the missing assets had not yet been replenished. Similar shortfalls may have affected USDC and some altcoins.
This is important information, but it is not proof that Binance is insolvent. The exchange has pledged to cover all losses, meaning its liabilities to customers are supposed to remain fully backed. The key question is whether Binance will actually replenish the missing assets and demonstrate this in its next reserve report.
The updated Proof of Reserves announced by Binance will therefore be particularly important. It should make it possible to verify whether the exchange has restored the level of coverage for liabilities in individual cryptocurrencies.
How Did the Crypto Market React? Bitcoin Fell Below $77,000
News of the Binance incident triggered a strong market reaction. Bitcoin fell to approximately $76,400-$76,500, reaching its lowest level in six weeks. Ethereum briefly declined to around $2,170-$2,200, while BNB lost more than 8% over a 24-hour period.
According to market data cited by CoinDesk, total liquidations in the futures market rose to approximately $1.57 billion. Traders holding long positions were hit particularly hard. BTC liquidations accounted for around $522 million, while ETH liquidations reached approximately $361 million.
The entire decline cannot be attributed solely to the Binance incident. Other factors also affected the market, including weakness in US technology stocks. Nevertheless, there is little doubt that news of $6.3 billion in assets being transferred out of the exchange significantly worsened sentiment and increased selling pressure.
BNB is also worth watching. Binance's ecosystem token recorded one of the sharpest declines among the largest cryptocurrencies. The market was pricing in not only the risks associated with the incident itself, but also its potential consequences for confidence in the world's largest cryptocurrency exchange.
The Largest Hack in Crypto History? Binance Surpasses Bybit and Ronin
With an estimated impact of $6.3 billion, the Binance incident dramatically changes the historical ranking of the largest cryptocurrency thefts.
One of the largest cases previously known was the LuBian incident. Approximately 127,426 BTC were allegedly transferred out of the Chinese Bitcoin mining pool in December 2020. The case was only revealed by Arkham in August 2025, with the stolen funds valued at approximately $3.5 billion at the time of the transfers. However, this was not a conventional, clearly explained exchange hack, and LuBian itself has not publicly confirmed the incident.
Another major case was the 2025 attack on Bybit, with losses estimated at approximately $1.5 billion. Earlier incidents among the largest cryptocurrency thefts included Ronin Network in 2022, Poly Network in 2021, Binance Bridge in 2022, Coincheck in 2018 and Mt. Gox in 2014.
Historical figures are not fully comparable because some incidents were valued at the time of the theft, while others were valued only after they were discovered. Nevertheless, Binance is now the record holder based on the reported financial impact. This does not mean that the entire $6.3 billion has been permanently lost.
Are MiCA-Licensed European Exchanges a Safer Choice?
The Binance incident is a reminder that even the largest cryptocurrency platforms are not immune to operational risks and cyberattacks. A company's scale, brand recognition or the size of its reserves cannot guarantee that customer assets are completely safe.
This is also an opportunity to consider the European regulatory framework. Exchanges operating under a MiCA authorization are subject to specific organizational, supervisory and customer protection requirements. These regulations do not eliminate the risk of a cyberattack, but they impose additional obligations on crypto-asset service providers.
Choosing a platform that holds the required authorization and operates within the European regulatory framework may therefore provide an additional layer of formal protection and greater transparency regarding the service provider's responsibilities. However, a MiCA license should not be treated as a guarantee of security or as equivalent to bank deposit protection.
What Does the Binance Incident Mean for Security Across the Crypto Market?
The most important lesson from this event concerns the difference between blockchain security and the security of the infrastructure built around it.
Networks such as Bitcoin and Ethereum can operate exactly as intended, yet users' assets can still be transferred out of an exchange if an attacker gains control of the systems that authorize transactions. In this case, there was no need to break cryptography or take control of an entire blockchain. Gaining access to the infrastructure responsible for processing withdrawals was enough.
The incident also highlights the limitations of Proof of Reserves. Publishing a snapshot of wallets and balances does not eliminate operational risk. Reserves may appear sufficient on a particular date, but their security also depends on access controls, authorization procedures and the resilience of an exchange's internal systems.
Finally, the event illustrates two different sides of the cryptocurrency market. On the one hand, stablecoin issuers can freeze funds, helping to limit the consequences of attacks. On the other hand, Bitcoin remains an asset that cannot be blocked by a central issuer. Recovering BTC in practice requires cooperation with entities capable of controlling the further movement of those funds.
Binance is at the center of the largest known incident of this kind, but the final assessment of its scale will depend on how many assets can be recovered, whether the exchange replenishes its reserves and what conclusions emerge from the full technical report.
If you are looking for a cryptocurrency exchange operating within the European regulatory framework, check out the ranking of MiCA-licensed platforms on micaintelligence.com. It features exchanges with the required authorizations and operational trading platforms available to users across Europe.