In late October 2026, Binance, the world's largest crypto exchange, was hit by what is being reported as the largest crypto theft on record. Media reports put the loss at about $6.3 billion. The FBI has attributed the attack to North Korea's TraderTraitor group. Withdrawals were paused and then resumed in phases from 1 November.
This story is still developing, and Binance has not published a full post-mortem. We pulled together what mainstream outlets and blockchain-intelligence firms have reported, and we separate confirmed statements from speculation. Figures are preliminary and may change. This is not financial advice.
What Is Publicly Known
| Item | Reported detail |
|---|---|
| Date | Attack reported on 29 October 2026 |
| Amount | About $6.3 billion in digital assets; one outlet says $6.36 billion |
| Attribution | FBI: TraderTraitor, North Korea-linked; the same group it tied to the $1.5 billion Bybit theft in 2025 |
| Binance response | Withdrawals paused, then resumed in phases from 1 November; says it will reimburse users and has replaced most stolen funds from reserves |
| Net outflows | Reported at about $3.6 billion on the first day of resumed withdrawals |
| Market reaction | Bitcoin dipped, then steadied around $78,000 on 2 November |
Sources include PBS NewsHour, CBS News, BleepingComputer and Bloomberg. Outlets differ slightly on timing and on the share of losses already replaced.
How Did It Happen? What Is Reported and What Is Not
Binance has not published a technical post-mortem, so the mechanism is still partly inference. Two pieces of information are on the record:
No private-key leak. Binance said there was no evidence that wallet private keys leaked. That points away from a classic key theft and toward abuse of an approval or authorization.
A single signature. Chainalysis CEO Jonathan Levin said the incident "looks like one signature that gave the attacker a never-expiring, full-access token to a Binance hot wallet" (as quoted by CBS News). This is an expert's reading of the on-chain evidence, not a confirmed finding.
A less authoritative outlet, Zeebiz, described a sequence in which the attacker tested the final code on a different wallet and moved test funds back, then deployed the same code against a Binance hot wallet about four hours later. We could not corroborate that account, so treat it as unverified.
What remains unclear: who approved the signature and how they were deceived or compromised; whether the weakness was in internal tooling, a third-party wallet interface or an employee's device; and how a hot wallet holding this much value was authorized at all. Until Binance or independent investigators publish details, avoid repeating a detailed narrative as fact.
The Bybit Parallel
The FBI's link to the 2025 Bybit theft matters. In February 2025, attackers stole about $1.5 billion in ether from Bybit by compromising the interface its signers used, so the signers approved a transaction that did not do what they saw on screen. The cryptography held; the human-and-tooling layer failed. If the Binance reading above is right, the pattern is similar: attackers go after the approval path, not the blockchain.
Where the Money Goes Next
The FBI said TraderTraitor was converting stolen assets mainly into ether and expected it to use DeFi protocols and instant swap services to move them, and it asked exchanges and analytics firms to block transactions linked to the addresses involved. Reports on 30 October said the hackers had not yet converted the proceeds into fiat. Past North Korean thefts have been laundered through chains of swaps and bridges over weeks and months, so partial freezes and seizures are possible but full recovery is rare.
Lessons for Exchanges, Fintechs and Treasuries
1. Make approvals explicit and bounded. Prefer allowances with strict limits and expiry. Unlimited, non-expiring approvals are a standing invitation.
2. Verify what you sign. Use independent transaction simulation and out-of-band verification, so a compromised interface cannot show signers one thing and execute another.
3. Shrink hot wallets. Keep only operating balances online, with velocity limits and automated pauses on anomalies.
4. Separate duties and devices. No single person, laptop or tool should be able to authorize a transfer of this size.
5. Rehearse incident response. Decide in advance who can pause withdrawals, who talks to regulators and law enforcement, and how you communicate with users. Regulators are watching: see our 2026 regulation map.
What Users Should Do
Do not rush to withdraw or move funds on rumor; follow Binance's official channels only and watch for phishing that exploits the news. Use two-factor authentication that is not SMS, withdrawal allow-lists and anti-phishing codes. Never keep more on any exchange than you are willing to have frozen for a while. Exchange failures remain an operational risk even when the company promises to make users whole.
Building a custody or exchange product and want a security review of your signing flow? Contact us.
Frequently Asked Questions
How much was stolen in the Binance hack?
Mainstream outlets report about $6.3 billion in digital assets, with at least one outlet citing $6.36 billion. Figures are preliminary.
Who is blamed for the Binance hack?
The FBI said the attack was tied to malicious cyber activity by TraderTraitor, a North Korea-linked group the bureau also linked to the $1.5 billion Bybit theft in 2025. Blockchain-intelligence firms had pointed the same way earlier.
Are Binance users going to lose money?
Binance has said it will cover the losses and reported that it had replaced most of the stolen funds from its own reserves. Withdrawals resumed in phases from 1 November. Check Binance's official statements for current status.
Could the same thing happen to other exchanges?
The 2025 Bybit theft and this incident share a pattern: attackers target the signing and approval process rather than breaking the cryptography. Any exchange or treasury that relies on a few operators approving high-value transactions faces similar risk.