Hackers Drain $6.3 Billion From Binance in Roughly 20 Minutes
Hackers stole an estimated $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in what blockchain analysts have described as the biggest crypto theft on record. The attack began shortly after 2000 GMT on Thursday, 29 October 2026, and most of the funds were drained within roughly 20 minutes.
The speed of the theft is central to its significance. Unlike exchange breaches that unfold over days or weeks as attackers probe defences, this operation appears to have been executed with a single, coordinated push once access was obtained. According to US blockchain-analytics firm TRM Labs, the attackers compromised Binance’s “signing infrastructure”, the systems that authorise transactions, allowing them to issue instructions that emptied the wallets Binance uses to process customer transactions.
The distinction matters. Conventional exchange security focuses heavily on custody: keeping private keys offline, segmenting wallets and requiring multiple approvals for large transfers. But if the machinery that signs and approves transactions is itself compromised, those safeguards can be bypassed entirely. In this case, hackers manipulated transaction approvals so funds could leave an internet-connected wallet without passing through normal controls.
Binance initially suspected a compromised software engineer’s laptop as the entry point. Co-CEO Richard Teng later said investigators had found multiple breach points, calling it a “complex attack” involving malicious software designed to erase evidence. That detail suggests a deliberate effort not merely to steal, but to frustrate the forensic trail that would normally allow investigators to trace and recover funds.
Stolen Assets Spread Across Chains as Issuers Race to Freeze Funds
The stolen assets moved across several blockchains, including Bitcoin, Ethereum, Tron, Ripple and Layer 2 networks. About half of the haul consisted of stablecoins, a detail that proved to be the industry’s main line of defence.
Because major stablecoins are centrally issued, their issuers retain the ability to blacklist addresses and freeze tokens even after they have been stolen. That power was exercised at speed. Tether froze nearly $1.57 billion of the stolen assets, while Circle froze about $800 million. World Liberty Financial, a crypto venture associated with the Trump family, also froze affected holdings.
Binance said roughly $3 billion had been located or frozen in the aftermath. The exchange did not initially account for the remaining $3.3 billion, a gap that will weigh on the industry’s confidence until it is resolved. The roughly half of the haul that was not in stablecoins, spread across Bitcoin, Ethereum, Tron, Ripple and Layer 2 networks, presents a far harder recovery problem. Native assets on those chains cannot be frozen by any issuer, and once funds are bridged, swapped or laundered through mixing services, tracing becomes exponentially more difficult.
The pattern is familiar from previous large-scale thefts, where stablecoin components are quickly immobilised while the remainder scatters across chains. What makes this incident different is sheer scale. At $6.3 billion, the theft exceeds the combined losses of most previous record-breaking exchange hacks by a wide margin, and it struck the platform widely regarded as the industry’s most operationally mature.
For ongoing coverage of exchange security incidents and their market fallout, see our Bitcoin coverage, where we track cross-chain movements of stolen funds and the industry response.
Binance Halts Withdrawals and Pledges Corporate Funds to Cover Losses
Binance halted withdrawals in the immediate aftermath of the attack and said it would use corporate funds to cover customer losses, while insisting that customer funds were safe. The pledge follows a playbook that has become standard among major exchanges: absorb the loss, reassure users and restore operations quickly to prevent a bank-run dynamic.
The response helped limit the damage. A rapid freeze of stolen stablecoins, combined with a public commitment to make customers whole, reduced the immediate contagion risk that has followed smaller exchange collapses. But the episode has nonetheless demonstrated something uncomfortable for the industry: a compromise of transaction-signing systems can bypass conventional safeguards even at the biggest platform in the market.
The reputational arithmetic is harsh. Binance’s scale has long been presented as a security advantage, with resources to invest in defences that smaller venues cannot match. The heist does not invalidate that argument, but it reframes it. Size concentrates risk as well as capability. A single successful intrusion into signing infrastructure at the industry’s largest exchange produced a loss larger than the gross domestic product of several small nations.
The incident also intensified calls for exchanges to share threat intelligence more systematically and to strengthen offline key storage and transaction controls. Industry participants have long discussed formal mechanisms for sharing indicators of compromise, similar to arrangements in traditional banking, but progress has been uneven. A theft of this magnitude, attributed by analysts and blockchain firms to North Korea-linked hackers, possibly the group known as TraderTraitor, is likely to accelerate those efforts, although that attribution has not been presented as a final legal finding.
Attribution Points to North Korea-Linked Hackers
Analysts and blockchain firms attributed the attack to North Korea-linked hackers, possibly the group known as TraderTraitor. The attribution is consistent with a pattern of state-sponsored cryptocurrency theft that has become a significant feature of the digital asset landscape, in which stolen funds are widely assessed by governments and researchers to support sanctioned programmes.
The sophistication described by Teng, including malicious software designed to erase evidence and the manipulation of transaction approval flows, fits the profile of a patient, well-resourced operation rather than an opportunistic exploit. The initial suspicion of a compromised engineer’s laptop, followed by the discovery of multiple breach points, suggests a staged intrusion in which the attackers established several footholds before executing the theft.
If the attribution holds, the implications extend beyond Binance. A group capable of penetrating the signing infrastructure of the world’s largest exchange is capable of penetrating almost any custodial platform. That realisation is already reshaping how exchanges think about their most sensitive systems, particularly the hardware and software layers that turn an approved instruction into a signed transaction.
Analysis: The Custody Question Returns to Centre Stage
The Binance heist matters for three reasons, and none of them is the headline number alone.
First, it exposes the structural risk created by centralised exchanges holding vast customer assets. The industry’s decade-long argument for self-custody has rarely had a cleaner exhibit. When billions sit behind a single signing infrastructure, a single compromise can move all of it. The counter-argument, that exchanges can absorb losses and reimburse customers, was tested here and, on Binance’s own account, held. But reimbursement is a remedy, not a defence, and the $3.3 billion still unaccounted for will test how complete that remedy proves to be.
Second, it demonstrates the difficulty of recovering crypto once it crosses multiple chains. The industry’s freeze response was genuinely rapid, and the stablecoin issuers deserve credit for immobilising more than $2 billion between them within the first hours. Yet nearly half the stolen value remains outside the reach of any issuer. Cross-chain mobility, one of the sector’s most celebrated innovations, is also its most effective laundering vector.
Third, it will shape the regulatory conversation. Policymakers have focused heavily on token classification and disclosure. This incident redirects attention toward operational resilience: how signing keys are stored, how approvals are chained, what offline controls exist between an instruction and a broadcast transaction, and whether exchanges should be required to share threat intelligence with each other and with regulators. The calls for stronger offline key storage and shared threat intelligence that followed the attack are likely to harden into formal expectations.
For Binance, the immediate task is accounting for the missing $3.3 billion and restoring full withdrawals without triggering outflows that test its corporate backstop. For the wider industry, the task is harder: proving that the convenience of centralised custody can coexist with security that survives a determined, state-linked adversary. The biggest heist in crypto history took 20 minutes to execute. Rebuilding the confidence it destroyed will take considerably longer.
For continued reporting on exchange security, stablecoin issuer actions and cross-chain fund tracing, follow our Bitcoin coverage as the recovery effort develops.
