Binance $6.3 Billion Hack Explained: What Happened and What Users Should Do

What Happened in the October 2026 Binance Hack?

Attackers drained cryptocurrency from Binance-controlled hot wallets across ten or eleven blockchains, depending on whose count you use, starting at 20:05 UTC on October 29.

The four totals in that table are not a disagreement about what was taken. They are the same assets priced at different moments: TRM Labs values the haul at the prices that held at the moment of theft, Chainalysis and Elliptic ran their own reconstructions, and Binance later restated its own estimate as about $6.34 billion. Any figure in this range is defensible; a figure of $5.9 billion is Chainalysis’ first estimate, which the firm has since revised upward.

It is comfortably the largest cryptocurrency theft on record. The $1.5 billion taken from Bybit in February 2025, the previous record, was about a quarter of it. Binance alone lost close to twice what was stolen from the entire crypto industry during 2025.

The distinction that matters for anyone with an account is that this was an attack on exchange infrastructure, not on individual customers’ wallets.

How Much Was Frozen, and What That Actually Means

About $2.85 billion of the stolen cryptocurrency has been frozen or intercepted. Binance published that figure in its November 3 report, and Elliptic independently arrives at the same number, calling it 44% of the theft. Chainalysis put the total at roughly $2.8 billion as of November 3.

Why the frozen share will probably not grow much

Stablecoins account for 94% of everything frozen, and that is not a coincidence. A stablecoin has an issuer with a blacklist function. Bitcoin, Ether and XRP do not.

Elliptic calculates that the attacker still controls about $3.25 billion across more than 800 addresses, including roughly 584,000 ETH, 18,327 BTC and 233 million XRP. Nothing taken on Bitcoin, the XRP Ledger, Solana or NEAR has been frozen at all, because there is no one with the power to freeze it.

Elliptic co-founder Tom Robinson put it plainly to WIRED: the remaining funds are mostly assets no one can freeze, and he does not expect the frozen share to rise much further.

The laundering is already well advanced and visibly automated. Elliptic counted 1,113 consecutive TRX transfers with a median gap of 90 seconds, running straight through two Pyongyang nights, with amounts randomised to six decimal places. Chainalysis describes thousands of transactions and patterns it says it has not seen before, including hundreds of fresh addresses each first receiving exactly 1 TRX. Elliptic has published a free blocklist of more than 8,000 associated addresses.

How Did the Attackers Get In?

Binance’s first public explanation, on October 30, was that the breach “may involve a compromised DevOps engineer’s laptop.” The exchange has since retracted that framing itself, saying its subsequent investigation “uncovered additional points of breach” and that the attack was not carried out by one person.

Its initial findings report, published November 3, replaces the laptop story with a four-month intrusion. The root mechanism, in Binance’s own words, was “unauthorized access to an internal wallet signing service” used to initiate transactions outside the normal withdrawal process.

The timeline Binance now describes

1. June 2026. A wallet DevOps engineer searched for a popular AI coding tool and installed a tampered version of Homebrew. Binance says it caught the anomaly, replaced the device and rotated credentials — but by then the attacker knew the engineer’s role and his colleagues on wallet infrastructure.
2. September 2026. The attackers posed as recruiters and ran job interviews with a second engineer. The second interview, held on a social chat app, ended with him downloading a take-home “assignment” whose code repository executed malware during setup. Binance describes it as a zero-day its endpoint security did not detect.
3. Escalation. From that machine the attacker used one of Binance’s own internal AI tools to reach two more engineers, and found a container deployment permission token on the first engineer’s computer.
4. October 29, 17:15 to 19:56 UTC. The attacker logged into a third engineer’s computer using credentials stolen from the first, deployed a container and triggered a script. The transfers began nine minutes later.

Co-CEO Richard Teng summarised it in a November 3 interview: the attackers “spent months building their way in.”

Why it took so long to stop

This is the most useful technical disclosure in the report, and it has had little attention.

The compromised hot wallet used multi-party computation, which means there was no single private key anyone could grab to revoke the attacker’s authorizations. Binance had to build a bespoke revocation procedure first. It also states plainly that suspending withdrawals and shutting down hot wallet services did not invalidate authorizations already recorded on-chain. The delegation was finally cleared at 00:10 UTC on October 30, more than four hours after the first transfer.

The same report discloses that Binance detected and prevented 57 suspected North Korea-linked cyber threat cases during 2026. This was the one that worked.

What Role Did EIP-7702 Play?

At 20:20 UTC the attacker submitted a single Ethereum transaction containing 50 authorizations, each one validly signed by Binance’s main hot wallet and each pointing it at an attacker-controlled sweeper contract.

Every authorization covered a different nonce, so whichever way the wallet’s state moved before the transaction landed, one of the fifty would still be valid. TRM Labs reads this as a batch of signatures produced in advance.

Three minutes and twenty-four seconds later the sweeper emptied the wallet: 167,464 ETH and 63 tokens, including about 1.615 billion USDT. Because the delegation persisted, later deposits into the same wallet were swept again without any new signature, and the wallet’s permissions over a second Binance wallet let the attacker pull another 823 million USDC.

EIP-7702 is not the vulnerability

EIP-7702 arrived with Ethereum’s Pectra upgrade in May 2025. It lets an ordinary Ethereum account delegate execution to smart contract code, which is a legitimate and widely used feature. Nothing about it was broken here.

The authorizations were validly signed. The question was never how the signatures were accepted, but how they were obtained.

And the evidence that EIP-7702 is a side detail rather than the story is on the other blockchains. Funds moved off nine or ten other chains by ordinary signed transfers, with no delegation involved, and a second Ethereum hot wallet sent 28,006 ETH with no delegation either. Different chains, different key types, different signing schemes, all producing valid signatures inside about thirty minutes.

From that, TRM Labs inferred that the attacker had gained the ability to make Binance’s signing system sign transactions of its choosing across chains. It wrote that while Binance had published no root cause. Binance’s November 3 description of “unauthorized access to an internal wallet signing service” says the same thing in the exchange’s own words.

There is a general lesson in it for anyone holding crypto anywhere: an attacker does not need to steal a private key. Compromising whatever decides which transactions get signed is enough.

Who Was Behind the Binance Hack?

The FBI attributed the theft to North Korea on October 31, working with the US Secret Service and IRS Criminal Investigation. The language is flat and carries no hedge: the Democratic People’s Republic of Korea “was responsible” for the theft, in activity the Bureau tracks as TraderTraitor. It published the attacker addresses and urged the industry to block them.

Three blockchain intelligence firms had reached the same conclusion first, with varying degrees of caution:

• TRM Labs attributed it to TraderTraitor with stated high confidence, citing matches with the Bybit theft and the April 2026 KelpDAO hack: the same pattern of small Tornado Cash withdrawals funding an operator wallet, staging long in advance, and signatures obtained before being executed in one burst.
• Chainalysis framed its finding as an intelligence assessment. Its strongest evidence was watching the Binance funds commingle in real time with the proceeds of the September 2026 Bitget theft.
• Elliptic was deliberately the most hedged, calling TraderTraitor the likely perpetrator before the FBI statement, on the basis of shared infrastructure with several other exchange thefts.

One distinction is worth preserving: Binance has not attributed the attack itself. Its position is that the FBI’s information indicates the DPRK is responsible. Teng declined to make the attribution personally.

Why exchanges, and not blockchains

Nobody attacked Ethereum. Nobody attacked Bitcoin.

A large exchange concentrates enormous holdings behind systems that have to keep processing transactions continuously, and those systems run on people, credentials, software dependencies and approval processes. Compromising the machinery that authorises transactions reaches far more value than compromising any individual account ever could.

That is why the entry point here was a job interview and a tampered package installer, not a cryptographic break.

Will Binance Cover the Losses? SAFU and the 98%

Binance’s commitment has been consistent since October 30 and is worth quoting rather than paraphrasing: “Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users.”

By its November 3 report the exchange says 98% of the impacted token assets have been replenished, up from 90% on October 31 and about 95% on November 1, and that it has set aside more than the full amount required to cover the loss. It lists BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed. The shortfall is in less liquid tokens outside its top ten, which it says may take longer to source.

What SAFU is, and what it is not

The Secure Asset Fund for Users is an emergency reserve Binance set up in July 2018. It is held and managed by Nest Clearing and Custody Limited, a recognised clearing house regulated by the Abu Dhabi Global Market’s Financial Services Regulatory Authority, and a portion of it serves as ADGM capital reserves.

Binance has funded the replenishment from three places, which it names: a partial deployment of SAFU, a portion of its futures insurance fund, and its own corporate treasury.

So SAFU has been drawn down. Binance now says it is “committing to replenishing the SAFU to return the fund size to approximately US$1 billion” — which makes that familiar $1 billion figure a target after a drawdown, not an untouched reserve sitting behind your balance. Binance publishes no current dollar balance or composition for the fund, only a Bitcoin address.

Had Binance tried to cover a $6.3 billion loss from SAFU alone, it would not have been close. A fund sized at roughly one billion dollars was never an insurance policy against an event of this size, and no exchange reserve of any kind currently is.

Have customers voted with their balances?

Partly. Reuters reported about $4.72 billion in net withdrawals in the days after reopening, roughly 3% of platform assets. Binance characterises that as confidence largely holding, and the comparison is not unreasonable: around $7 billion left Circle’s USDC in the week after Silicon Valley Bank failed, and Binance itself saw about $6 billion leave in 72 hours after the FTX collapse.

Binance also took a fresh Proof of Reserves snapshot on October 31 and made the zero-knowledge proof user-verifiable on November 2.

Were Binance Customers’ Personal Wallets Compromised?

No. The attack was on Binance-controlled infrastructure, and nothing published suggests customer wallets held outside the exchange were touched.

If you hold crypto in a wallet whose private keys were never shared with Binance, a compromise of Binance’s internal systems does not give the attacker anything to work with. Your keys were never in the building. For a refresher on what that actually means in practice, see our explainer on what a crypto wallet is.

If your assets were in Binance custody, you depended on the exchange’s systems and its ability to honour withdrawals, and for roughly 55 hours you could not move them.

What to check on your account

• Log in through Binance’s official site or app — typed, or from your own bookmark. Not from a link in a social media post or a message.
• Check your balance, recent transactions, withdrawal availability for the specific assets you hold, and any security notifications.
• If you see activity you do not recognise, go through the exchange’s own account-security and support channels.

That last point matters more than it sounds. A recovery phrase is not a password you can change afterwards — it is permanent control of the wallet, which is why our guide to keeping a seed phrase safe says never to type one into anything that asks for it.

Should You Move Your Crypto Off Binance?

This is a reason to look at how much you keep on an exchange. It is not a reason to sell, and it is not a reason to move everything tonight.

Binance is covering the loss, has restored backing for 98% of affected assets, and is processing withdrawals again. The case for acting is not that your balance is in danger today; it is that the event has shown you what your exposure actually looks like.

Neither column is safer in the abstract. They fail in different ways, and which failure you are better equipped to survive depends on you.

If you hold funds on Binance right now

Check which assets have had withdrawals restored — the reopening has been phased, and as of November 3 it is still not complete across everything.

If you decide to move some of it, verify the destination address, the blockchain network, the fee and the minimum before you send anything, and send a small test transaction first. A wrong network is the most common way people lose crypto permanently, and it has nothing to do with hackers.

You do not need to sell to get out of exchange custody. The same asset usually transfers directly to a compatible wallet.

If you are thinking about self-custody

Self-custody means you control the keys that authorise transactions. A hardware wallet keeps those keys off your everyday devices, and our guide to the best crypto wallets covers the types and their trade-offs.

What it also means is that the responsibility moves to you, entirely. Lose your recovery information with no valid backup and the funds are gone, with no support line to call. Let someone else see that recovery phrase and they own the wallet. The physical device is usually not the thing that matters — the recovery phrase is, which is the part people underestimate until it is too late.

For someone who has never set up a wallet backup, moving everything into self-custody in a hurry after a news story introduces a more immediate risk than the one they are running from.

If you keep crypto on any centralised exchange

The question is not whether to use one. It is how much needs to be there.

Work out how much you genuinely need available for trading, and treat the rest as a separate decision. Keeping everything on one platform concentrates your exposure to one company’s security and solvency; spreading it reduces that and adds management work in return. Our comparison of the best crypto exchanges sets out how the major platforms differ on custody and security.

What the Binance Hack Means for Crypto Security

The lesson is the oldest one in the industry, and this is the most expensive demonstration of it so far: owning cryptocurrency and controlling its private keys are not the same thing.

An exchange balance is a claim on a company. A self-custody wallet is direct control, and direct responsibility. Both are legitimate, and both have a failure mode.

What this breach does not show is that centralised exchanges are unsafe as a category, or that everyone should be on a hardware wallet by the weekend. Binance has so far done what it said it would do. What it does show is how an exchange actually gets broken into: not through cryptography, but through a recruiter who was not a recruiter and a package installer that had been tampered with four months earlier.

No regulator has taken public action over the breach as of November 3. The response so far has been law enforcement, not regulation — the FBI attribution and address blocklist. Scrutiny of exchange custody is likely to increase, but nothing has been announced.

For most people the practical response is three questions: how much crypto do you need available for trading, how much provider risk are you willing to carry, and could you reliably recover an independent wallet if you had to. Those stay relevant long after this particular story stops being news.