Hack

Binance Loses $6.3 Billion in the Biggest Crypto Hack in History

co-produced by AI30. October 2026, 07:20

A person uses the Binance trading interface on a laptop and a smartphone, with coins in the background — Binance lost around $6.3 billion in the largest crypto hack on record. © Kanchanara on Unsplash

One laptop, $6.3 billion gone. Attackers drained cryptocurrencies worth about $6.3 billion (about €5.7 billion) from Binance, the world’s largest crypto exchange, on Thursday evening. It is the largest crypto theft ever recorded, more than four times the size of the previous record hack at the exchange Bybit in February 2025. Binance has halted withdrawals and promised to cover the entire loss.

What Was Stolen

The attackers emptied Binance’s so-called hot wallets on ten blockchains at the same time. These are the wallets that are connected to the internet and that an exchange uses to process deposits and withdrawals around the clock. According to an analysis by TRM Labs, the stolen funds included:

Ethereum: about $3.8 billion, including more than 200,000 ether and stablecoins such as USDT and USDC
Bitcoin: 18,270 BTC worth about $1.5 billion
Tron: about $630 million, mostly in USDT
XRP Ledger: about $300 million in XRP
Solana and other blockchains: more than $170 million combined

The attack was first spotted on the blockchain. As The Block reported, the analyst Spreek flagged transfers of about $3.55 billion to a previously unknown wallet, which quickly sent nearly $900 million onward. Conor Grogan, a product director at the rival exchange Coinbase, soon put the outflows at up to $5.8 billion, while the security firm Blockaid initially investigated about $3.3 billion in suspicious outflows from hot wallets on Ethereum, Arbitrum and Avalanche.

Estimates vary slightly. Binance itself puts the damage at about $6.3 billion, while the blockchain analytics firm Chainalysis estimates about $5.9 billion at the time of the theft. According to Arkham Intelligence, the attackers’ wallets at one point held more than $5.7 billion, including nearly $1.5 billion in bitcoin, $900 million in ether, about $1.5 billion in USDT and more than $800 million in USDC.

The first and last outflows were just under four hours apart. According to TRM, the attack was prepared the day before and funded with small amounts from the crypto mixer Tornado Cash.

Where the Breach May Have Occurred

Binance has not yet published a full analysis, but the initial findings point to a human weak spot. In a statement cited by CoinDesk, Binance said: “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak.” DevOps teams manage the systems used to build software and roll it out into live operations, which is why they often have far-reaching access rights.

TRM Labs reached a similar conclusion: The infrastructure Binance uses to sign transactions from its hot wallets was compromised. That is the only way to explain how the attackers could get transactions of their choosing approved on ten blockchains at once. On Ethereum, they used a new feature called EIP-7702 and had obtained 50 signatures in advance to ensure that one of them would be valid.

The pattern is familiar. In the Bybit hack of 2025, a developer’s computer was also the entry point. TRM attributes the attack with “high confidence” to TraderTraitor, a North Korean hacking group linked to the notorious Lazarus Group, which according to the F.B.I. was also behind the Bybit theft. The prominent blockchain investigator ZachXBT also named Lazarus as the “likely attacker.” Ido Ben-Natan, a co-founder and the chief executive of the crypto security firm Blockaid, said the tactics and level of sophistication were consistent with North Korean operations. “This is the biggest crypto hack in history,” he told CoinDesk.

About $3 Billion Frozen

Part of the loot has already been blocked. Because many of the stolen coins were stablecoins, their issuers were able to step in. Tether’s chief executive, Paolo Ardoino, initially reported freezing more than 1.57 billion USDT. “Protecting the industry and our partners is our main priority,” he said. Circle’s chief executive, Jeremy Allaire, reported freezing more than 800 million USDC. Even Binance’s founder, Changpeng Zhao, praised the two stablecoin companies for acting quickly. According to TRM, the amount frozen by Tether rose to about 1.8 billion USDT overnight. Smaller amounts were frozen by Ripple, World Liberty Financial and the security council of the Arbitrum blockchain. Binance itself says about $3 billion has been frozen, including $2.3 billion in the stablecoins USDT and USDC. The issuers block the affected addresses so that the coins can neither be moved nor cashed out.

According to TRM, however, about $2.4 billion (about €2.2 billion) remains beyond the issuers’ reach, mainly in ether and bitcoin. The attackers have already begun swapping some of it on decentralized exchanges such as Uniswap, sometimes at a discount of more than 10 percent, and borrowing more ether through lending protocols. On Aave, they posted stolen USDT as collateral and borrowed at least 20,000 wrapped ether worth about $44 million. According to blockchain data, Aave then froze its lending markets to prevent further borrowing. The goal of such maneuvers is to swap freezable stablecoins as quickly as possible into cryptocurrencies that have no central issuer. The bitcoin was split across numerous wallets.

Binance Vows to Cover the Losses

Binance was slow to confirm the attack. In her first response on X, Yi He said the company was aware of reports of a potential security issue, was actively investigating and would provide updates only through official channels. She also warned users to watch out for scams, unofficial links and requests for account information, which often accompany such incidents.

Binance now insists that customer funds are safe. The exchange plans to cover the losses from its emergency fund, the Secure Asset Fund for Users (SAFU), and from company funds. Yi He, Binance’s co-chief executive, wrote on X that the platform would cover “all hacking losses.” Mr. Zhao also weighed in. “It does look like a hack on Binance,” he wrote. “I don’t manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered.”

The SAFU fund alone is nowhere near enough. Set up in 2018 to protect customers in the event of hacks and other emergencies, the fund holds about $1 billion in bitcoin, according to CoinDesk, or about one-sixth of the damage. Binance will have to cover the rest from its own assets, although the actual loss could shrink considerably thanks to the frozen stablecoins. For context, Binance held about $144 billion in assets before the hack, according to DefiLlama, so the theft amounts to about 4 percent of that. Binance plans to publish a new proof of reserves once the security gap has been closed. According to Yi He, withdrawals are expected to resume within 48 hours.

Binance is not the first exchange to suffer a major hack this year. In September, the exchange Bitget lost more than $350 million, and its chief executive, Gracy Chen, also promised full compensation to all customers. According to DefiLlama, other major attacks this year hit Liquid Network (about $320 million), Drift ($295 million) and Kelp ($293 million). On the same day as the Binance hack, the prediction market Polymarket also disclosed that one of its third-party providers had been breached, though losses there were under $3 million.

What the Hack Means for Centralized Exchanges

The attack rattled markets. Bitcoin fell 4.8 percent and briefly dropped below $77,000, while ether lost 5.7 percent. BNB, the token linked to Binance, was hit even harder at minus 8 percent, and the token of the lending protocol Aave fell 11 percent. In the derivatives market, about $1.5 billion in positions were forcibly liquidated, according to CoinDesk. Geoffrey Kendrick, global head of digital assets research at Standard Chartered, expects further losses. “Only after assets are unfrozen and more detail of the hack emerges will we find a new base,” he wrote.

Sean Foley, a crypto markets expert at Macquarie University in Sydney, took a broader view. He said the attack highlighted the risks of centralized exchanges, where users hand over control of their coins, and could push traders toward decentralized alternatives. Mr. Kendrick agrees and recommends taking a fresh look at Uniswap over the medium term. At the same time, this case also shows the flip side: It was the centrally issued stablecoins from Tether and Circle that made it possible to freeze nearly half of the loot.