Attackers stole roughly $6.4 billion from Binance in the largest cryptocurrency theft ever recorded, forcing the exchange to pause withdrawals, mobilize billions of dollars in reserves and work with law-enforcement agencies across several countries. According to Decrypt, the incident involved Binance’s own wallet and signing infrastructure rather than a direct failure of the underlying blockchains.
How the breach unfolded
The attack began at about 4:05 p.m. Eastern Time on Thursday, after U.S. markets had closed. Funds were moved from Binance hot wallets across roughly 10 blockchains, with most of the transfers completed within around 20 minutes.
Blockchain analytics firms Chainalysis and TRM Labs estimated the stolen assets at approximately $6.4 billion. That is more than four times the previous record, the $1.5 billion Bybit theft in February 2025.
Binance initially said the breach may have started with a compromised laptop used by a DevOps engineer. The attacker may have used access to reach a service container and submit unauthorized withdrawals. The exchange later said its investigation had identified additional breach points, indicating a more complicated process than the compromise of one employee’s permissions.
Binance said there was no evidence that wallet private keys had been exposed. It also said the attacker used a self-destruct mechanism to remove tools and traces during the operation.
On Ethereum, the attacker used EIP-7702, a feature introduced in 2025 that allows ordinary wallets to temporarily execute smart-contract code. TRM Labs said 50 pre-signed authorizations were used to turn a Binance hot wallet into a “sweeper” contract, which then drained its assets.
The episode did not represent a flaw in Ethereum itself. Rather, TRM Labs said it indicated a compromise of Binance’s signing infrastructure. Binance Chief Executive Richard Teng said the delegation process bypassed the exchange’s normal approval controls.
Losses, reserves and frozen tokens
Binance said it would cover all losses with company funds and its Secure Asset Fund for Users, an emergency reserve. Teng stressed that customer assets were not affected by the theft.
The exchange has set aside more than $6.34 billion. About $5 billion of that amount was already held in the same tokens stolen during the attack, including Bitcoin, Ethereum, BNB, USDC and USDT. Binance said it is acquiring the remaining assets through open-market and over-the-counter purchases.
Withdrawals were paused while Binance rebuilt and retested its systems. The exchange said deposits continued to operate normally, and that it aimed to restore withdrawals by Sunday and publish a complete proof of reserves by Monday. A proof of reserves is a report intended to show the assets held by an exchange against its customer obligations.
Stablecoin issuers also acted quickly. Stablecoins are privately issued digital tokens designed to track the value of assets such as the U.S. dollar. Unlike decentralized cryptocurrencies, the companies behind these tokens can blacklist addresses and freeze associated funds.
Tether froze more than $1.5 billion in USDT connected to the attack, while Circle froze around $823 million in USDC. Together with other efforts, roughly $3 billion had been frozen or located.
A substantial amount remained under the attacker’s control, however. More than 420,000 ETH and 18,270 BTC, along with other tokens, were still beyond the reach of issuers because they could not be frozen. Elliptic estimated that the hacker continued to control about $3.3 billion and was moving funds through Tron and other networks.
Investigation and market response
TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean state-linked group also blamed for the Bybit theft. Following that earlier incident, the group converted about 84% of the stolen Ethereum into Bitcoin through the cross-chain network Thorchain. The attribution would push North Korea’s crypto haul in 2026 well above $1 billion, with the Binance theft alone accounting for the largest portion.
Binance is cooperating with law-enforcement agencies worldwide, including the FBI and the U.S. Secret Service. The FBI confirmed that it was aware of the incident and was coordinating with partners. The Secret Service, which investigates financial and digital-currency crimes, declined to comment.
Despite the scale of the theft, the wider crypto market remained relatively stable compared with earlier exchange failures. Bitcoin fell to about $76,400 on Friday, a decline of roughly 4%, while more than $1.3 billion in leveraged positions were liquidated. The event also renewed debate over oversight of offshore exchanges. CFTC Chairman Michael Selig said the breach supported the case for the crypto-market regulations proposed by his agency earlier in the month.
Moneyiar market picture
Moneyiar market data recorded at 12:43 p.m. on November 1, 2026, showed BNB at $711.5134921781, up 0.88% over 24 hours but down 3.73% over seven days.
Other assets in the supplied Moneyiar data were mixed:
- Nexus (NEX): $0.0000006834, down 3.87% in 24 hours and up 13.56% over seven days.
- Rain (RAIN): $0.0058159954, down 5.25% in 24 hours and 27.44% over seven days.
- Billions Network (BILL): $0.0139971939, down 0.59% in 24 hours and up 10.04% over seven days, based on data recorded at 1:39 a.m. on September 21, 2026.
The Binance incident leaves the exchange facing the immediate task of restoring withdrawals and demonstrating that its security controls have been rebuilt, while investigators and blockchain analysts continue tracking the funds.
