Key Highlights

  • About USD 6.3 billion left Binance wallets across ten blockchains, mostly in about 20 minutes, with TRM Labs estimating USD 6.36 billion, making it the largest crypto theft on record.
  • The FBI attributed the attack to North Korea's TraderTraitor group on October 31, 2026, saying the hackers were converting stolen Assets mainly into Ethereum (ETH).
  • Binance said it would cover all losses, froze roughly USD 3 billion of affected assets with partners, and customers withdrew a net USD 4.72 billion after withdrawals reopened on November 1.
  • Bitcoin (BTC) dipped to about USD 76,300 on November 3, 2026, while spot Bitcoin funds lost USD 399 million on November 2, their second straight day of outflows.

What Is Known About the Breach

Binance reported the incident on Thursday, October 29, 2026. Its early investigation pointed to a compromised laptop of an engineer, and a later update referred to points of breach. TRM Labs said the attacker moved funds out of Binance wallets across ten blockchains, most within about 20 minutes. Binance said it found no evidence of a wallet private key leak, and a security firm executive suggested, without confirmation, that a never-expiring access token to a hot wallet may have been involved. Deposits were unaffected and withdrawals were suspended, then reopened on Sunday, November 1. Binance is a private company and has no ticker. Published coverage separately reported a smaller hot wallet attack at another exchange, with an estimated loss of USD 40 million.

Attribution and the Money Trail

TRM Labs attributed the attack with high confidence to TraderTraitor, the North Korean group linked to the 2025 Bybit theft, and Chainalysis said it was likely the same actor. The FBI issued a cyber alert on October 31, working with the Secret Service and IRS Criminal Investigation, and urged exchanges to block wallet addresses used for laundering. Elliptic said about USD 3.24 billion remains in linked addresses and may be laundered through decentralized finance and swap services. Because stolen assets are being converted into Ethereum (ETH), tracing and freezing depends on how quickly other platforms act. Figures vary slightly by source, from about USD 6.3 billion to USD 6.36 billion.

Market Impact and Risks

Binance pledged to cover all losses from its emergency protection fund and company money, and it plans an updated accounting of assets backing customer balances. Still, customers withdrew a net USD 4.72 billion after reopening, up from USD 3.64 billion on the first day. Bitcoin (BTC) traded near USD 76,900 on November 3, and a sentiment index stood at 34 out of 100, in fear. The risks are further customer withdrawals, regulatory scrutiny, more attacks on other platforms and funds that cannot be recovered. A theft of this scale tests the claim that exchanges can keep customer assets safe, but only the final investigation will show the exact cause. Binance temporarily halted deposits and withdrawals while it ran security checks.

Where Things Stand

Hackers drained about USD 6.3 billion from Binance by moving funds from wallets on ten blockchains in about 20 minutes, apparently after compromising an engineer's laptop and an internal service, and the FBI attributes the attack to North Korea. Binance says users will be covered, but withdrawals of USD 4.72 billion show confidence has taken a hit. Watch Binance's updated accounting, the investigation's final findings and whether any of the roughly USD 3 billion frozen is recovered.