On Thursday 29 October 2026, the world's largest cryptocurrency exchange suffered the largest cryptocurrency theft ever recorded. Binance said attackers drained an estimated $6.3 billion from its hot wallets - the internet-connected wallets used for day-to-day withdrawals. The previous record was the $1.5 billion taken from Bybit in February 2025, so this attack was roughly four times larger, with most of it happening in a burst lasting only about 20 minutes, according to CoinDesk.
For ordinary users, the first question is simple: is my money safe? Binance, through co-founder Yi He and founder Changpeng Zhao, has said user funds are safe and it will cover all losses. How completely and how quickly that promise is kept is what the next few days will answer.
What happened on Thursday
The first public signs came on Thursday afternoon in the United States, when blockchain watchers noticed large amounts of cryptocurrency leaving Binance wallets. Zhao, who no longer runs the company but remains its largest shareholder, wrote on X that the incident looked like a hack. Binance then confirmed a security incident, and a spokesperson later told TechCrunch withdrawals had been temporarily suspended on multiple networks as a precaution.
Within hours, stablecoin issuers were freezing funds: Tether froze more than $1.567 billion in USDT, Circle more than $800 million in USDC, and Ripple around $200 million, according to Reuters and CoinDesk. By Friday morning, Binance put the total frozen at about $3 billion - still less than half of the estimated total stolen.
How the attack worked, in plain terms
Binance's initial investigation pointed to a compromised laptop belonging to a DevOps engineer. Such engineers work on the systems that keep software running, so a laptop with internal-tool access can be a powerful entry point even without holding customer money directly. According to Binance, the attacker used that access to reach a service container - a small, self-contained part of the exchange's internal software - and from there submitted withdrawal transactions that should never have been approved.
Binance said it had found no evidence that any wallet private keys - the secret codes proving wallet ownership - were leaked. In other words, the attacker did not steal the master keys, but found a way to make the system authorise withdrawals anyway. Binance later said it had found additional points of breach, without giving details, and described the attack as complex.
Blockchain analysts added another layer. CoinDesk reported that the attacker used an Ethereum feature called EIP-7702, which allows a normal wallet to hand control to a piece of software. After getting a key wallet, labelled Binance 14, to sign that permission, the attacker turned it into a sweeper that forwarded incoming funds to their own address. Etherscan records cited by CoinDesk show 167,464 ETH moving from Binance 14, followed by 28,005.6 ETH from another wallet, Binance 16.
TRM Labs and Chainalysis linked the attack, with high confidence, to the North Korean-linked group TraderTraitor. That is the analysts' assessment, not an identification by Binance, which said it was working with law enforcement to confirm who was responsible.
What Binance says about customer funds
On 30 October, Binance put a number on its commitment. It told CoinDesk it had set aside more than $6.34 billion in company resources to restore customer balances. Of that amount, $5 billion was already held in the exact token assets that were affected, and Binance said it was buying the remainder through public markets and over-the-counter trades so the replacement matched what users had lost, token for token. The company said those figures did not include the frozen assets, which are being pursued separately with partners and law enforcement. It also pointed to its Secure Asset Fund for Users, known as SAFU, an emergency reserve that has typically held around $1 billion in bitcoin.
That is the practical meaning of "user funds are safe" here: Binance promises to honour balances from its own resources while recovery continues, not that the crypto was never taken. One check on that promise comes from Binance's own reserve data. Its 1 October report included Binance 14, then holding 1.26 billion USDT and 89,475 ETH, among 37 assets. CoinDesk found the stolen crypto was part of the assets backing customer balances. On 1 October, Binance held exactly enough ETH to cover customers; the roughly 204,500 ETH taken is about 5.6 percent of its ETH reserves, leaving ETH backing near 94 percent until assets are replaced. The next snapshot, due on 1 November, will show whether that replacement has happened.
What happens next
Freezing stolen crypto is a race, and not all coins can be frozen equally. Stablecoins such as USDT and USDC can be frozen by their issuers, which can block specific addresses; bitcoin and ether cannot be frozen the same way. For the rest, recovery relies on tracing, blocking transfers at other exchanges, and law enforcement - slower work, especially as Chainalysis reported thousands of automated transactions apparently designed to scramble the trail.
As of the latest updates used for this article, deposits remained open and withdrawals remained paused while Binance finished security checks. Binance had previously said withdrawals could resume in roughly 45 to 48 hours, and other reporting put that expectation at around Sunday morning. That is an expected timetable, not a confirmed reopening, and users should treat it as such until Binance confirms withdrawals are live again. Binance also temporarily suspended Binance Alpha trading as a precaution, according to Reuters; Binance.US said it was not affected.
Binance's early advice remains the safest general guidance: follow updates only through official channels, and beware of scams and unofficial links or requests for account information. The investigation is still open, the full post-mortem is not yet published, and the final recovered amount is unknown. What is clear is the scale: $6.3 billion stolen, $3 billion frozen, a $6.34 billion replacement commitment, and a reserve question to be settled by the 1 November snapshot and by whether withdrawals reopen smoothly.
