What Happened at Binance? The $6.3 Billion Hack Explained

Last updated: October 30, 2026. This story is still developing, and some details below may change as Binance and investigators release more information.

On October 29, 2026, Binance, the world’s largest cryptocurrency exchange, confirmed a security incident that the company estimates had a total impact of around $6.3 billion. It is being described as the largest crypto hack on record. Binance says user funds are safe and that it will cover the losses itself, but the incident has already shaken the market and raised hard questions about how a company of that size could be breached. Here is what is known so far about the Binance hack.

What happened

The first signs came from users, who reported funds leaving the exchange’s wallets. Binance told reporters it was aware of reports of a possible security issue and was investigating, and a spokesperson then confirmed that withdrawals had been paused on multiple networks as a precaution. Later that night Binance published a fuller statement acknowledging the incident.

According to that statement, the early findings point to a compromised laptop belonging to a DevOps engineer. Binance says the attacker used it to reach a service container and then submitted unauthorized withdrawal transactions. The company says it has found no evidence that any wallet private key was leaked, which matters because it suggests the attacker abused access to the withdrawal system instead of cracking the wallets themselves.

The key facts at a glance

Question	What is known
When did it happen?	October 29, 2026, with Binance’s detailed statement coming late that day
How much was affected?	An estimated $6.3 billion in total impact
How much is frozen?	Around $3 billion frozen on-chain so far, with help from blockchain partners and token issuers
How did the attacker get in?	Early findings point to a compromised DevOps engineer’s laptop, then a service container used to submit unauthorized withdrawals
Were private keys leaked?	Binance says it has found no evidence of a private key leak
Who covers the losses?	Binance, through its SAFU fund and company funds, not users
Are withdrawals open?	Suspended while the withdrawal service and its addresses are rebuilt, with a restart expected by Sunday, November 1
Are deposits working?	Binance says deposits and normal platform activity are unaffected

How Binance is responding

Binance has said it reserved more than $6.34 billion in company funds to cover the incident, and its notice to users says about $5 billion of that is held in the exact tokens that were affected. It has also said the losses will be paid from the SAFU fund, the emergency reserve it created in 2018 to protect users after a breach. That fund has historically held around $1 billion, so the larger company reserves are what make the promise credible.

On the technical side, the company revoked authorization on the affected addresses, suspended withdrawals while it rebuilds the withdrawal service, and brought in law enforcement and blockchain intelligence firms to trace the stolen assets. Part of the freezing has depended on token issuers and other platforms cooperating, which is why the frozen total has been rising in stages instead of all at once.

Binance has also promised three things over the next few days: an announcement when withdrawals are safely restored, a full technical post-mortem once the investigation is verified, and a fresh Proof of Reserves after remediation so anyone can check that no user balance was affected.

Who is behind it

Binance has not publicly named an attacker. Several blockchain analytics firms have. TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-backed unit linked to the wider Lazarus Group, and Chainalysis said it also believed the same group was likely responsible. TRM pointed out that several features of the attack match earlier North Korea-linked thefts, including the 2025 Bybit hack, which the FBI also attributed to TraderTraitor. One investigator noted that the attacker’s wallet had been funded through small Tornado Cash withdrawals more than a day before the theft.

It is worth keeping the wording careful here. This is attribution by private analysts, not a confirmed finding from Binance or a government agency, and North Korea has denied similar accusations in the past.

What it did to the market

The reaction was fast. Reports during the day described Bitcoin sliding to around $76,000 and more than $1.5 billion in leveraged crypto positions being liquidated as traders reacted. Those figures come from market coverage that was updating through the day, so treat them as a snapshot and not a final count.

This is not Binance’s first breach. In May 2019, attackers took about 7,000 bitcoin, worth roughly $40 million at the time, from the exchange’s hot wallet by getting hold of user API keys and two-factor codes. Binance paid that back from SAFU, and users were not out of pocket. The scale this time is far larger. The 2025 Bybit hack, previously the record at around $1.5 billion, now looks small next to a $6.3 billion estimate.

If you hold funds on Binance, the company’s position is that nothing you own is at risk, and that its reserves are in place to back that up. Even so, a few sensible steps cost nothing. Read updates only from Binance’s official channels, since incidents like this attract impersonators. Nobody from Binance will ask for your password, one-time codes, or seed phrase, so anyone who does is running a scam.

Make sure two-factor authentication is on, use an authenticator app instead of SMS if you can, and consider turning on a withdrawal address whitelist. Do not panic-click links in emails or direct messages about compensation.

If you only trade occasionally and keep most of your crypto on an exchange, this is also a fair moment to ask whether that is a good idea. Self-custody has its own risks and is not right for everyone, but any exchange is a single point of failure, and the size of the bet is yours to decide.

What developers can learn from this

The most useful detail for anyone who writes or runs software is how the attack reportedly began. One personal laptop, belonging to someone whose job involves production access, appears to have been the way in. From there the attacker reached a service that could submit withdrawal transactions. Wallet cryptography was not the weak point. The systems around it were.

That points to a handful of habits worth taking seriously on your own projects. Treat developer machines as part of your production attack surface, since an engineer’s laptop often holds tokens, SSH keys, and cloud credentials. Give service containers the narrowest permissions possible, and avoid long-lived credentials where short-lived ones will do. For anything that moves money or deletes data, require a second, independent approval that does not live on the same machine or in the same pipeline. Add limits and alerts, such as caps on withdrawal size and speed, so that an abused account cannot empty a wallet in one go. And watch for social engineering aimed at developers. One report says Binance had blocked North Korea-linked attempts that used fake job interviews to trick people into running malicious code just two days before the incident, and that kind of lure can reach any developer who takes interview exercises or code samples from strangers.

Why this matters for developers

You may never build an exchange, but the pattern here shows up everywhere: a trusted person’s device, a service with more access than it needs, and a transaction path with too few independent checks. If you work in web development or run your own sites, the same principles apply at smaller scale, from how you store API keys to who can deploy to production. It is a good prompt to look at your own setup this week, starting with the permissions your deployment tokens have and where your secrets actually live.