Hackers drained about $6.3 billion from Binance on October 29. Withdrawals are paused, $3 billion is frozen, and Binance says it will cover every loss.
Binance, the world’s largest cryptocurrency exchange, has been hit by what is now the biggest crypto theft on record. Hackers drained about $6.3 billion (roughly ₹60,000 crore) from the exchange’s wallets on October 29, 2026, with most of the funds moved out in around 20 minutes.
The exchange has paused withdrawals, says user balances are safe, and has promised to cover every loss from its own funds.
What happened?
According to blockchain intelligence firm TRM Labs, the outflows began at about 20:05 UTC on October 29 and spread across ten blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. TRM estimates the total at $6.36 billion. Chainalysis puts it at $5.9 billion, while Binance’s own estimate is about $6.3 billion.
The stolen assets included large amounts of Ether, the stablecoins USDT and USDC, and 18,270 bitcoin, worth about $1.4 billion on its own.
For comparison, the previous record was the $1.5 billion hack of the Bybit exchange in February 2025. The Binance theft is roughly four times larger.
How the attackers got in?
In a post on X, Binance CEO Richard Teng said the company’s initial investigation suggests the attack “may have started with a compromised DevOps engineer’s laptop.” That gave the attacker access to a service container, from which unauthorised withdrawal transactions were submitted.
Teng stressed that this was not a simple breach. “The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process,” he wrote, adding that the investigation “has not attributed responsibility to any individual.”
Binance has since said it found “additional points of breach.” So far, it says, there is no evidence that any wallet private keys were leaked. The company has promised a detailed technical post-mortem once the investigation is complete.
Who is behind it?
Both TRM Labs and Chainalysis have linked the attack to TraderTraitor, a North Korean hacking unit tied to the Lazarus Group. TRM said it made the assessment “with high confidence.” The same group was linked by the FBI to the Bybit hack.
Ari Redbord, TRM’s global head of policy, called the attack a “watershed” and said theft at this scale by North Korea is “a global security issue, not just a crypto theft.”
Is user money safe?
Binance says yes. In his post, Teng told users: “Bottom line – your money is safe, and we’re covering every loss.” The exchange says losses will be covered by its SAFU (Secure Asset Fund for Users) emergency fund and company funds.
Binance has set aside more than $6.34 billion to cover the shortfall. About $5 billion of that is already held in the same tokens that were stolen, and the company is buying the rest on the open market and through over-the-counter deals. It has warned that some affected tokens have low liquidity, so this could take time.
Binance has also said it will publish an updated Proof of Reserves once the fix is complete, so users can verify their funds are fully backed.
Can users withdraw?
Not yet. Withdrawals have been suspended while Binance completes what Teng called “a security revamp of the withdrawal service and its related addresses.” Co-founder Yi He said the exchange expects to start restoring withdrawals within 48 hours of the October 30 update, though this is a target, not a confirmed date.
Deposits are working normally, according to Teng.
How much has been recovered
About $3 billion of the stolen funds has been frozen on-chain so far, mostly by stablecoin issuers. Tether froze its USDT and Circle froze its USDC held in the attacker’s wallets. Ripple and World Liberty Financial froze smaller amounts.
That still leaves an estimated $2.4 billion to $2.9 billion in assets the hackers control and can move, including the 18,270 bitcoin. TRM Labs says the attacker has already started laundering funds, including selling USDT to market makers and borrowing against it on lending platforms.
Binance founder Changpeng Zhao, who no longer runs the exchange, thanked the stablecoin issuers for their “quick freeze” and said that, as a shareholder, he expects all user funds to be fully covered.
Market impact
The news hit crypto prices. Bitcoin fell about 5% and dropped below $77,000. BNB, Binance’s own token, fell around 6%.
What users should do?
There is no official action users need to take right now. Experts generally advise against panic-selling during the uncertainty. Users should make sure two-factor authentication is switched on, and should be careful with any message, email or DM promising a “refund” or “compensation” for the hack. Scammers often use moments like this to target worried customers.
Teng’s closing message to users was simple: “Our team hasn’t stopped… I’ll share what I can, as soon as I can.”
Also Read: Binance Reserves $6.34 Billion to Cover User Losses
