Binance's $6.3 Billion Heist Forces a Reckoning on Hot Wallets

Binance's $6.3 Billion Heist Forces a Reckoning on Hot Wallets

The largest crypto theft on record

On October 29, 2026, attackers drained about $6.3 billion from Binance, the world's largest cryptocurrency exchange, in roughly 20 minutes starting at 20:05 UTC. TRM Labs put the total at approximately $6.36 billion moved out of Binance wallets across ten blockchains. That is about four times the $1.5 billion Bybit hack of February 2025, making it the biggest cryptocurrency theft on record. Chainalysis separately estimated about $5.91 billion stolen at the time of the suspected breach.

What Binance says happened

Binance said its initial investigation traced the intrusion to a compromised DevOps engineer's laptop, which let an attacker reach an internal service container and submit unauthorized withdrawal transactions. The exchange later added that investigators had found additional points of breach, calling it a complex attack rather than a single one-click operation. Binance said it had found no evidence of a wallet private key leak. Co-CEO Richard Teng stressed that the attacker did not simply use one engineer's permissions.

How one transaction moved a fortune

On Ethereum, the attacker used a feature called EIP-7702 to hand control of a Binance hot wallet to its own code, TRM said. A single transaction then moved 167,464 ETH plus 63 other tokens, including 1.615 billion USDT. Kok Tin Gan, cofounder and CEO of cybersecurity firm NyxLab, said it looked like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet, raising questions about why stronger approval controls were not in place.

About $3 billion frozen, billions still missing

Binance said around $3 billion of the stolen assets had been frozen onchain, mostly stablecoins. Former CEO Changpeng Zhao thanked Tether for freezing roughly $971 million and Circle for freezing roughly $823 million. Elliptic estimated that $2.84 billion had been frozen by 7:00 am UTC on Friday, while the attackers still controlled about $3.33 billion in assets that issuers could not immobilize. TRM's Ari Redbord said roughly $2.4 billion in USDT and USDC had been frozen, with an estimated $2.4 billion in bitcoin and ether beyond issuers' direct reach.

All losses covered, exchange says

Binance suspended all deposits and withdrawals after the attack and pledged to cover all losses through its Secure Asset Fund for Users (SAFU) and company reserves. "User funds are safe," the company said. Co-founder and co-CEO Yi He said customer withdrawals should resume by Sunday, and Binance later said it remained on track to resume withdrawals within 45 hours while coordinating with law enforcement.

North Korea blamed with high confidence

TRM Labs attributed the attack to TraderTraitor, a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38, saying it made the judgment with high confidence based on on- and off-chain intelligence. Chainalysis and Elliptic also linked the theft to North Korean actors. The same network has been blamed for the Bybit heist. Zhao wrote on social media that the theft does look like a hack on Binance.

Why this shakes confidence in exchange wallets

A hot wallet is a wallet an exchange keeps connected to the internet to pay out customer withdrawals. Compromise its signing infrastructure and legitimate-looking transactions can drain billions before anyone reacts. "I think it's extremely dangerous," Tyler Moore, a cybersecurity professor at the University of Tulsa, said. "I think you should be very wary of leaving any significant amount of funds in an exchange." Analysts advise keeping no more on an exchange than needed for trading, with long-term holdings in a wallet where the user controls the private keys. Even users whose accounts were untouched lost access when withdrawals were suspended.

What comes next

Three things matter now: how much of the remaining $3 billion-plus can be traced or recovered, when SAFU payouts reach users, and whether withdrawals resume on schedule. With roughly half the loot frozen through issuer cooperation and half converted into assets that cannot be frozen, the case is also a stress test of the industry's freeze-and-trace playbook against an adversary that reporters link to a state-backed operation.