TL;DR
- On the evening of 29 October 2026, an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes. TRM Labs calls it the largest crypto theft on record 1. Binance estimates about $6.3 billion 2.
- TRM Labs and Chainalysis attribute it to TraderTraitor, a North Korean state hacking unit. Elliptic urges caution, and Binance has not named anyone 125.
- About $3 billion has been frozen, Binance says. The rest is beyond the reach of any issuer, including more than 420,000 ETH and 18,270 BTC 12.
- Binance says user funds are safe, that it will cover all losses, and that about $6.34 billion is ready to do it 35.
- The root cause is unpublished. Binance first pointed to one engineer's compromised laptop, then found "additional points of breach" 27.
Twenty minutes
Binance is the largest crypto exchange in the world 8. At 20:05 UTC on a Thursday in October, money began leaving it.
It left from the XRP Ledger first. Then from Solana and Optimism. At 20:20 UTC the Bitcoin hot wallet sent 18,270 BTC, and a single transaction landed on Ethereum carrying 50 authorizations, each signed by the Binance hot wallet. Three minutes and 24 seconds later, that wallet's entire balance was gone 12.
Most of about $6.36 billion was out in about 20 minutes 3. Within hours, the previous record, North Korea's $1.5 billion theft from Bybit in February 2025, was no longer close: TRM puts this one at about four times its size 111.
This is a developing story. Figures here reflect reporting through 30 October 2026 and are likely to change.
Minute by minute
Times are UTC, from TRM Labs' reconstruction unless cited otherwise.
Three small withdrawals from Tornado Cash reach an operator wallet. Preparation was under way at least 36 hours before the theft. 12
The first attack code is deployed and tested on two wallets. 1
The final version is rehearsed on a third wallet. About four hours later, the same code is installed on a Binance hot wallet. 1
The first money moves. Five XRP Ledger wallets send 233.46M XRP. 1
The Bitcoin hot wallet sends 18,270 BTC. On Ethereum, one transaction arrives carrying 50 pre-signed authorizations. Within about two minutes, 612.7M USDT leaves on Tron. 1
Three minutes and 24 seconds after that transaction, the Ethereum hot wallet empties: 167,464 ETH and 63 tokens, including 1.615B USDT. 12
The counterattack. Tether freezes 971.1M USDT in the main receiving wallet. 1
Circle freezes 823M USDC. 1
Ripple freezes 40.5M RLUSD, as about 48M RLUSD is being sold on decentralized exchanges. 1
A second wave reaches Avalanche and Polygon. 1
Arbitrum's Security Council forces out 8,426 ETH and 74.6M ARB. 1
Binance reports about $3 billion frozen, says its investigation "has uncovered additional points of breach", and says about $6.34 billion is ready to cover losses. 57
The haul
TRM values each asset at its price when taken. Ethereum and its tokens made up more than half, and the stablecoins in that pile turned out to be the attacker's weakness 1.
Source: TRM Labs 1. Parts sum to about $6.36B.
Nobody agrees on the exact total yet. The estimates differ by more than half a billion dollars, largely because the firms value and scope the theft differently 12.
Sources: Elliptic and Chainalysis via The Hacker News 2; TRM Labs 1; Binance 2.
Accounting for the losses
Where is the money now? No two sources balance the books the same way, and none of them fully balances. I've left the gaps visible instead of hiding them.
Sources: TRM Labs 1; Elliptic and Binance via The Hacker News 2. Grey segments are my subtraction, not a reported figure (Elliptic's is $0.26B). Snapshots were taken at different times.
Frozen is not the same as recovered: frozen tokens are locked where they sit, and getting them back is a separate process. Bitcoin and ether have no issuer who can freeze them, and TRM's tally of what the attacker still holds is made up of those two assets 12.
Who pays
Binance says it will cover all losses from its Secure Asset Fund for Users (SAFU) and its own funds 2. SAFU alone can't do it: it holds about 15,000 BTC, worth around $1.18 billion on the morning of 30 October 14. Later that day, Binance said about $6.34 billion was ready: roughly $5 billion held in the same assets that were stolen, and about $1.3 billion being bought on the market and over the counter 5.
Sources disagree on one detail: CoinDesk reports the $6.34 billion includes the frozen assets 6, while The Block reports they are separate 5. Binance's promised updated proof of reserves will matter here 14. These are Binance's own statements, not audited figures. Withdrawals stayed suspended on 30 October while Binance rebuilt its withdrawal security, with service expected back within about 48 hours 27.
The race to freeze
Forty-one minutes after the Bitcoin wallet emptied, Tether froze 971.1 million USDT sitting in the attacker's main receiving wallet. Three minutes later, Circle froze 823 million USDC. The attacker had taken stablecoins that carry an off switch, and the issuers used it 1.
Source: TRM Labs, as of 00:30 UTC on 30 Oct 1. Total about $2.7B. Binance's later figure is about $3B 2.
The attacker was moving just as fast. TRM reports that from 20:20 UTC the Bitcoin was split into round pieces of 1,000 and 100 BTC. About 325 million USDT was sold to market makers for about 122,300 ETH, at a discount of more than 10%, a steep price for getting out of assets that can be frozen. Another wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH before Aave froze the affected markets 1. TRM expects cross-chain bridges, swap services and OTC brokers next 1.
Who did it
TRM Labs attributes the theft to TraderTraitor, North Korea's elite hacking unit: "We make this judgment with high confidence." It says features of the attack match the Bybit and KelpDAO hacks 1. The FBI named the same group for Bybit 11. Chainalysis also links it to North Korea with high confidence, citing funds from an earlier theft mixing with the Binance funds 2.
Not everyone is ready to say so. Elliptic urged caution, pointing to differences from known North Korean laundering in speed and method, and to the missing root cause 2, though CoinDesk has since listed Elliptic among the firms linking the attack to North Korean hackers 4. Binance has not named a culprit 5. North Korea has denied hacking allegations in the past, and the reports I reviewed contain no FBI or government attribution for this attack yet 38.
The money matters beyond crypto. Current and former US and South Korean officials say North Korea's hacking teams are a key source of revenue for the sanctioned, nuclear-armed regime 8.
North Korea's ledger
By Chainalysis' lower-bound count, North Korean hackers had stolen $6.75 billion in all the years through 2025 9. If the attribution holds, this one evening, at Chainalysis' own $5.91 billion, comes to 88% of that all-time figure 29.
Sources: Chainalysis 92; TRM Labs 10. Binance is shown as attributed by TRM Labs and Chainalysis, not officially confirmed.
Source: TRM Labs, April 2026 10. Under 10% in 2020 and 2021.
How they got in
Binance hasn't published a root cause. Here is what's on the record, and how far each claim goes:
- Binance's first account: the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container" and submit unauthorized withdrawals 2.
- Binance's later account: co-CEO Richard Teng says the attacker "did not simply use one engineer's permissions", and the investigation "has uncovered additional points of breach" 27.
- Private keys: Binance says it has found "no evidence of a wallet private key leak" 2.
- TRM's and Elliptic's assessment: the attacker most likely gained the ability to make Binance's own signing systems sign transactions of its choosing. This is their reading of the blockchain, not a confirmed finding 12.
The theory is chilling because it explains the speed. Nothing had to be cracked if the vault itself could be persuaded to sign. Binance has promised technical details when its investigation ends 3.
The aftershock
Markets moved overnight. Bitcoin hit its lowest price since 18 September. BNB, Binance's own token, fell furthest among the major coins, and its trading volume more than tripled 4. Listed crypto companies followed on Friday: Coinbase fell about 12% and Circle about 9.5% in early trading 7.
The hack wasn't the only force at work. CoinDesk also points to a technology selloff: Nasdaq-100 futures fell 2.3%, and Intel slid about 25% on weak guidance 4. How much of the decline belongs to Binance can't be separated out.
The largest ever
Hack sizes are hard to compare across years, because each is valued at the prices of its day. Even so, the gap isn't close.
Sources: TRM Labs 1; NBC News 1113; Euronews 12. Selected major incidents, not an exhaustive ranking.
"The largest hack in history" is TRM's headline 1; its report text says the largest crypto theft on record. I found no independent tally across all financial crime, so read "in history" as that framing.
What we still don't know
- How they got in. No root cause has been published 12.
- Who did it, officially. The attribution comes from private firms, and Elliptic is more cautious than its peers 2.
- The final bill. Binance says the affected and frozen totals could still change 15.
- Where the money ends up. TRM expects laundering through bridges, swap services and OTC brokers, but that is a forecast 1. The attacker still holds billions that nobody can freeze 12.
- Whether customers are made whole. Binance has pledged it, and customers won't be able to test it until withdrawals return 25.
Sources
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (data to 00:30 UTC, 30 Oct)
- The Hacker News: Binance Suffers Security Breach Affecting $6.3 Billion in Assets (quotes Binance, Chainalysis and Elliptic)
- CBS News / AP: $6.3 billion Binance hack was likely work of North Korea, blockchain intel firms say
- CoinDesk: BTC falls to $76,400 as Binance hack triggers $1.57 billion in liquidations
- The Block: Binance says it has $6.34 billion ready to cover hack losses
- CoinDesk: Binance arranges $6.34 billion to cover losses from record crypto hack
- CoinDesk live: Binance finds more breaches in $6.3 billion hack
- CNN (via ABC17): World's largest crypto exchange hit by world's largest heist
- Chainalysis: 2025 crypto theft reaches $3.4 billion
- TRM Labs: North Korea stole 76% of all crypto hack value in 2026 with just two attacks (April 2026)
- NBC News: FBI says North Korea was responsible for $1.5 billion Bybit hack
- Euronews: From Ronin to Mt. Gox, crypto's biggest hacks and heists
- NBC News: Crypto exchange Binance suffers $570 million hack (2022)
- CCN: Binance's $1B SAFU fund faces a $6.3B hack
- Cointelegraph live: Binance losses estimated at $6.3B amid major crypto hack