The Binance Hack: What Happened, What Was Lost, and What It Means for You

Developing story. This was written on 1 November 2026 with the information available that day. Several figures are still preliminary and will change as analysts finish tracing the money. Binance has promised a detailed technical report, and this article is best read alongside it once it is published.

On the evening of Thursday 29 October 2026, UTC, money started leaving Binance's wallets faster than anyone could react. Within hours the world's largest crypto exchange had paused withdrawals, its founder was telling people on X that the company had probably been hacked, and analysts were counting a loss that Binance itself put at about $6.3 billion. If that figure holds, it is the biggest theft in the history of cryptocurrency. Elliptic, a blockchain analysis firm, calls it "almost certainly the largest single theft of any kind in history."

Two days on, the picture is clearer but far from complete. The FBI has named the group it believes is responsible. Binance says it has already replaced most of what was taken. Roughly half of the stolen value has been frozen. The question engineers care about most, how a company with that much security spending lost control of its wallets, has only a partial answer. This article keeps three layers apart: what Binance has confirmed, what outside analysts and officials have reported, and what nobody knows yet.

The short version

Binance estimates about $6.3 billion in assets was affected. Independent estimates range from about $5.9 billion to $6.43 billion.
Around $3 billion has been frozen, mostly stablecoins. Elliptic independently verified about $2.85 billion.
Binance's first explanation was a compromised laptop belonging to a DevOps engineer. It later said there were additional points of breach and has not described them.
On 31 October the FBI said North Korea's TraderTraitor group was responsible.
Binance says it will absorb the loss, reports replacing about 90 percent of the stolen amount, and planned to reopen withdrawals in stages on 1 November.
No reporting so far says customer personal data was taken.

What happened, and when

Times are UTC. Most of the on-chain detail comes from Elliptic's reconstruction. The statements come from Binance and from news coverage. Binance has not yet published its own timeline.

When	What happened
28 to 29 Oct	An attacker-controlled wallet receives three small withdrawals (0.1 ETH each) from Tornado Cash, a mixing service. The attacker's sweeper contract is rehearsed on another wallet about four hours before the attack.
Thu 29 Oct, about 20:05	Five Binance wallets on the XRP Ledger send 233 million XRP to one attacker address. Hot wallets on the other chains follow over roughly the next half hour.
29 Oct, 20:20 to 20:24	On Ethereum, one transaction carries 50 authorizations tied to a Binance hot wallet that Elliptic calls "Binance 14". Minutes later the attacker's contract empties it of 167,464 ETH and 63 tokens, including about 1.6 billion USDT.
29 Oct, about 21:00	Tether freezes the attacker's main Ethereum wallet, locking about $1.18 billion in USDT. Circle freezes about $823 million in USDC.
29 Oct	Binance tells reporters it is investigating a potential security issue and suspends withdrawals on multiple networks. Founder Changpeng Zhao posts that the company likely was hacked.
30 Oct	Binance publishes a preliminary finding: a compromised DevOps engineer's laptop, no evidence of a leaked wallet key, about $6.3 billion affected and about $3 billion frozen. TRM Labs and Chainalysis point to North Korea. The attacker sells stolen AVAX and bridges the proceeds to Ethereum.
30 Oct, later	Co-CEO Richard Teng calls it a "complex attack" and says the attackers used malicious software built to delete evidence.
Sat 31 Oct	The FBI, with the Secret Service and IRS Criminal Investigation, names TraderTraitor and asks crypto businesses to block addresses the group uses. Binance says it has replaced 90 percent of the stolen amount and publishes a new proof of reserves snapshot.
Sun 1 Nov	Binance plans a staged reopening of withdrawals from 06:00 to 09:00 UTC across 15 networks, starting with Bitcoin, Ethereum, BNB Chain and Solana, according to reports. At the time of writing, we could not confirm it had happened.

Speed is the first thing that stands out. Elliptic counts movements across 11 blockchains in about three hours, and the largest single sweep, the Ethereum hot wallet, took roughly three and a half minutes once the attacker's contract was in place. Tether's freeze landed about 40 minutes after that. By then most of the damage was done.

How the attack appears to have worked

What Binance has said

Binance's own first explanation, posted on X, is that the incident may involve a compromised DevOps engineer's laptop, which let an attacker reach a service container and submit unauthorized withdrawal transactions. It added that it had found no evidence of a leaked wallet private key.

A DevOps engineer builds and runs the systems that other software runs on, so their laptop tends to hold credentials for servers and deployment tools. A service container is a packaged program running on one of those servers. The withdrawal service is the part of an exchange that takes a customer's request, builds the blockchain transaction and gets it signed from a hot wallet. A hot wallet is one connected to the internet so payouts can happen in seconds.

If an attacker can reach a service that already has the authority to sign, they do not need to steal the keys. They ask the machine to sign for them. One reading that fits Binance's statement is exactly that. Elliptic's analysis points the same way: it describes abuse of Binance's own signing systems and sees a resemblance to the Bybit theft of February 2025.

What the blockchain shows

Elliptic's reading of the Ethereum data adds a detail. A feature called EIP-7702 lets an ordinary wallet hand control to a smart contract. The attacker used it: a single transaction carried 50 authorizations linked to a Binance hot wallet, after which a sweeper contract the attacker had written could drain the wallet in minutes. Elliptic quotes Teng saying the use of that feature "did not pass through our normal approval controls."

The same report says a second Binance wallet, "Binance 16", sent about $174 million directly to the attacker, and that the attacker used a wallet's owner rights to pull 823 million USDC out of another one.

What is still unknown

The laptop was probably not the whole story. Binance has since said there were additional points of breach, and Teng said the attack "was not carried out by one person," according to Elliptic. Nobody outside Binance knows how the approval controls were bypassed, how long the attacker had access, or what the other points of breach were. The promised post-mortem is the document to wait for.

How much was taken, and how much was frozen

The amounts

Elliptic's breakdown of what left Binance, at prices when it was taken:

Network	Taken
Ethereum and Ethereum-based tokens	about $3.80 billion across 186 tokens, including about 1.9 billion USDT and 823 million USDC
Bitcoin	18,270 BTC, about $1.48 billion
Tron	612.7 million USDT
XRP Ledger	233 million XRP
Total	about $6.43 billion

You will see several totals in the news, and they are not contradictions so much as different ways of counting:

Binance: about $6.3 billion, its own estimate.
Elliptic: $6.43 billion. It counts transfers from Binance to the attacker at the time of theft, and leaves out $169 million that left Binance after withdrawals were paused, which went to long-established addresses and looks like Binance moving its own funds.
Chainalysis: roughly $5.9 billion at the time of the theft, as reported by CoinDesk.
Early reports: "at least $2 billion" and then $5.7 to $5.8 billion. BleepingComputer's figure of up to $5.8 billion was a total of wallet holdings, not a confirmed loss.

Dollar values also drift because the stolen assets are priced in a market that fell on the news. Treat every number here as preliminary.

The frozen part

Binance says about $3 billion has been frozen, including $2.3 billion in the stablecoins USDT and USDC. Elliptic verified $2.85 billion frozen or seized on-chain, 44 percent of the theft, and 94 percent of that was stablecoins on Ethereum and Tron. Tether's chief executive said it froze more than $1.57 billion, and Circle's said it froze more than $800 million. Optimism and Arbitrum secured all of the stolen funds on their networks through governance, and Aave froze the affected markets, according to Elliptic.

Stablecoins freeze easily because a company stands behind each one. The issuer's contract can blacklist an address so that its tokens cannot move. Bitcoin and ether have no issuer. They can only be stopped if an exchange, bridge or other service in the path agrees to refuse the funds. That is why the unfrozen remainder, which Elliptic puts at about $3.21 billion and which includes 18,270 BTC and more than 519,000 ETH, is the part to worry about.

Where the rest is going

Elliptic's tracing shows an attacker in a hurry. About $786 million of stablecoins was swapped into ETH and TRX before freezes landed. One batch of 434 million USDT was converted to ETH at an implied loss of 12 to 26 percent, a haircut the attacker evidently accepted for speed. The bitcoin was split through a peel chain, a series of transfers that each peel a chunk off a large balance, into 19 addresses, mostly 1,000 BTC each. None had reached an exchange or other service at the time of Elliptic's report.

The pace looks automated. The main Tron laundering wallet made 546 transfers from 30 October, with a median gap of 96 seconds. Chainalysis chief executive Jonathan Levin said the attackers had already used thousands of addresses and that the count could reach tens of thousands in the coming weeks as the money moves through bridges, instant exchanges and swappers. The FBI said the actors were mainly converting the haul into ether and expects them to keep laundering it in stages.

Who is blamed, and how sure anyone is

The attribution has two layers. The first is analyst judgment. TRM Labs assessed with high confidence that TraderTraitor, a North Korean state hacking unit linked to the Lazarus Group, was behind it, and Chainalysis and Elliptic reached the same view. Elliptic listed its evidence: the stolen funds are being laundered alongside proceeds of a September 2026 exploit of the exchange Bitget that it assessed as likely North Korean, the same services appear in three earlier TraderTraitor thefts, the preparation was long and appeared to target staff, and the abuse of signing systems resembles Bybit. It also argued that very few groups could coordinate across 11 chains in about three hours.

The second layer is official. On 31 October the FBI said North Korea's TraderTraitor was responsible, the same group it blamed for the $1.5 billion Bybit theft. It urged crypto businesses to block transactions tied to the laundering and shared more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one Solana address.

What is still open: the FBI has not published the evidence behind its conclusion, and Binance has not described the attackers itself. The attribution is strong. The details of the intrusion are not yet public.

What it means if you have money on Binance

What Binance says

Binance says customer funds are safe and that it will cover the loss. Its words: "Binance will absorb the financial impact of these stolen funds, not our users." It reports funding the replacement from its Secure Asset Fund for Users, known as SAFU, which holds about $1 billion in bitcoin, part of a futures insurance fund, and corporate money. SAFU alone could not cover $6.3 billion, so company money is doing most of the work.

By Saturday Binance said it had replaced 90 percent of the stolen amount by buying new tokens, with the remainder mostly in less liquid assets it was still buying. Crypto Briefing reported that its ten most-held assets, including BTC, ETH, USDT, BNB and SOL, were fully covered. Later reports put overall replacement at about 95 percent, a figure that so far appears only in secondary coverage.

What you can check

Binance published a new proof of reserves snapshot at 00:00 UTC on 31 October, and outlets report a more detailed verification expected on 2 or 3 November. A proof of reserves compares the wallets an exchange controls against what it owes customers, and lets you confirm your own balance is counted. It is a useful signal, but it is not an audit and it says little about other debts. Treat it as one input.

The market

Bitcoin fell about 5 percent to below $77,000, ether about 5.7 percent, BNB about 8 percent and Aave about 11 percent, according to CoinDesk. DefiLlama put Binance's assets at roughly $144 billion before the theft, so the stolen amount is around 4 percent of that. Macquarie University's Sean Foley, quoted by Al Jazeera, said that "Any assets held at a centralised exchange are only as safe as the exchange itself."

This article does not tell you whether to withdraw, hold or buy. It can tell you what is known, and a lot of it is still Binance's word.

What about personal data?

Nothing in the coverage so far says customer personal data, such as ID documents used for verification or email addresses, was accessed. Binance's statements are about wallets and funds. Read that as not reported, not as ruled out. If customer data was involved, the post-mortem is where it should show up. Binance has denied claims of leaked customer data in the past, including an alleged breach it said did not come from its systems, and those older claims are unrelated to this incident.

The more immediate data risk is scams. Binance warned users to distrust unofficial links and messages asking for account details. News like this reliably triggers phishing: texts and emails claiming your withdrawal was cancelled, your account is locked, or you are owed compensation. In 2022 CoinDesk reported Binance's then chief executive warning about a text-message campaign built around a link to cancel a withdrawal, which led to a page that harvested logins.

How it compares with earlier hacks

Incident	Amount	Notes
Binance (2026)	about $6.3 billion (Binance), $6.43 billion (Elliptic)	FBI blames TraderTraitor
Bybit (2025)	about $1.4 to $1.5 billion	FBI and analysts blame TraderTraitor; a planned transfer was manipulated
Ronin Network (2022)	roughly $550 to $620 million, depending on prices	Validator keys; US Treasury tied it to Lazarus
BNB Chain bridge (2022)	$570 million minted, about $100 million actually taken	Chain was paused
Poly Network (2021)	about $611 million	Nearly all returned within two weeks
Coincheck (2018)	about $530 million in NEM	More than 260,000 users; about $400 million refunded
Binance (2019)	about 7,000 BTC, over $40 million	One hot wallet; covered from SAFU

Elliptic says the Binance theft is more than four times the size of Bybit and more than six times the roughly $1 billion taken from the Central Bank of Iraq in 2003. It also says the haul almost doubles what North Korea is believed to have stolen over the years, which it puts at more than $6.5 billion before this incident. TRM's 2026 report counted $2.87 billion stolen in nearly 150 hacks during all of 2025.

Binance's own 2019 theft is a useful contrast. Then, hackers used phishing, viruses and stolen API keys and two-factor codes against a hot wallet holding about 2 percent of its funds, and SAFU covered the loss. This time the same fund is a fraction of what was needed.

One laptop, six billion dollars

Exchanges spend heavily on cold storage, approval workflows and hardware security. The reported way in was still a single employee's computer. That is the pattern in many large breaches: the strongest lock does not matter if someone can be handed the key, or a machine that already holds it can be made to act. Bybit's 2025 loss came from a manipulated transfer rather than a cracked wallet, and Ronin's from compromised validator keys.

Your own setup is smaller, but the principle scales down. Your laptop or phone holds your email, your password manager, your exchange login and an open browser session. Malware that can read a page can use a logged-in account without ever learning the password, and two-factor codes do not help once a session has been hijacked. The device is the weak point more often than the algorithm.

Protecting your own accounts

None of this requires special skill. These are the habits that would have helped in the incidents above.

Expect scams this week. Do not click links in texts or emails about the hack. Open the exchange's app or type the address yourself. Set an anti-phishing code in your account if the exchange offers one, so genuine emails carry it.
Use passkeys or a hardware security key instead of SMS codes. SIM swapping and text interception are old and still effective.
Turn on a withdrawal address whitelist and, where offered, a delay. An attacker who gets into your account then cannot send funds to a new address immediately.
Revoke API keys you do not use and log out other sessions. Stolen API keys and two-factor codes were part of Binance's 2019 theft.
Do not leave everything on an exchange. A balance there is a promise from a company. Holding your own keys has risks of its own, because losing a recovery phrase loses the funds, so decide with your eyes open. If you buy a hardware wallet, buy it from the maker.
Never type a recovery phrase into a website or app, and ignore anyone who asks for it, including "support".
Keep finance in its own browser profile with no extensions you do not need, a bookmarked exchange address, and an operating system and browser that are up to date. A separate profile keeps your shopping and social logins away from it. The reasons are covered in the profiles guide.
Check the address bar every time. Look-alike domains and sponsored search ads are how many people reach fake exchange sites.
Read proof of reserves reports with their limits in mind. They show one moment in time, and they are not a statement of everything an exchange owes.

Frequently asked questions

How much was stolen from Binance?

Binance estimates about $6.3 billion in assets was affected. Elliptic puts the figure at about $6.43 billion and Chainalysis at roughly $5.9 billion at the time of the theft. The totals are preliminary and move with crypto prices. About $3 billion has been frozen.

Is my money on Binance safe?

Binance says user funds are safe and that it will absorb the loss. It reports replacing about 90 percent of the stolen assets and has published a new proof of reserves snapshot. Those are Binance's own statements, and a fuller independent check is still pending. This article is not financial advice.

Who hacked Binance?

The FBI said on 31 October 2026 that North Korea's TraderTraitor group, which is part of the wider Lazarus Group, was responsible. Private analysts at TRM Labs, Chainalysis and Elliptic had reached the same assessment earlier. Binance has not described the attackers itself.

Was my personal data leaked?

No reporting so far says customer personal data, such as ID documents or email addresses, was accessed in this incident. That means not reported, which is different from proven absent. Binance's technical post-mortem is where it should be settled.

When can I withdraw again?

Binance planned to reopen withdrawals in stages on 1 November 2026, starting with networks including Bitcoin, Ethereum, BNB Chain and Solana, and said exact timing could shift after security checks. Check Binance's official channels for the current status.

Can the stolen money be recovered?

Part of it has been frozen already, about $3 billion by Binance's count and $2.85 billion by Elliptic's verification, mostly stablecoins. The rest includes bitcoin and ether, which no company can freeze, and it is being moved through swaps and bridges. In the 2022 Ronin theft, which the US Treasury tied to Lazarus, only about $30 million was recovered, according to Decrypt.

A note on Rapid+

Rapid+ Browser lets you keep a profile just for banking and crypto, with its own cookies and logins, on Android and Windows. It will not protect you from malware on your device, which is the lesson of this story: a browser is one layer, not the whole defense. Details are on the multiple profiles page.

Sources

Written by the Rapid+ Team. We build Rapid+ Browser for Android and Windows. Spotted a mistake or have a question? Email us at admin@rapidplusbrowser.online.