Binance $6.3 Billion Hack: Largest Crypto Heist in History

CRYPTO · SECURITY INCIDENT

Binance $6.3 Billion Hack

Largest crypto heist in history as hackers drain hot wallets

Hackers drained an estimated $6.3 billion from Binance hot wallets in minutes, surpassing the 2025 Bybit hack to become the largest cryptocurrency theft on record.

The world's largest crypto exchange suspended withdrawals as stablecoin issuers froze billions in assets while investigations point to a compromised engineer's laptop as the initial entry point.

TL;DR

Scale: An estimated $6.3 billion stolen from Binance hot wallets - potentially the largest crypto hack ever recorded.
Trigger: Binance suspended deposits and withdrawals on multiple networks as a precautionary measure.
Initial access: Preliminary investigation suggests a compromised DevOps engineer’s laptop allowed attackers to gain access to a service container and submit unauthorized withdrawal transactions.
Attribution: Security researchers and US analysts have attributed the attack to North Korean hacking groups, mirroring tactics used in the 2025 Bybit heist.
Response: Tether froze over $1.56 billion in USDT and Circle froze over $800 million in USDC. Binance says user funds will be fully covered by its SAFU fund and company reserves.
Ongoing: Investigation continues with no confirmed final tally or full attack path details released.

What Happened

On October 29, 2026, Binance detected a large-scale security incident as billions of dollars in cryptocurrency began moving out of its hot wallets. On-chain analysis revealed rapid transfers from multiple Binance wallets to newly created addresses in what appeared to be a coordinated draining operation.

Key developments:

October 29, 2026 - Reports emerge of massive outflows from Binance hot wallets. Binance acknowledges “reports of a potential security issue” and begins investigating.
Withdrawals suspended - Binance pauses withdrawals on multiple networks as a precautionary measure.
Stablecoin freezes - Tether CEO Paolo Ardoino confirms freezing over $1.567 billion in USDT, while Circle CEO Jeremy Allaire confirms freezing over $800 million in USDC linked to the incident.
CZ weighs in - Binance founder Changpeng Zhao (who no longer runs the exchange) says it appears to be a hack and expects user funds to be fully covered, though he’s not directly managing the response.
Attribution emerges - Blockchain analysis firm TRM Labs attributes the attack to North Korean hackers, noting similar patterns to the 2025 Bybit heist.
October 30, 2026 - Binance provides updated estimates, putting the impact at approximately $6.3 billion, with around $3 billion frozen so far.

Attack Vector

According to Binance’s preliminary investigation:

Initial compromise - A DevOps engineer’s laptop was compromised, providing the attacker with a foothold.
Lateral movement - The attacker gained access to a service container within Binance’s infrastructure.
Unauthorized transactions - From there, they were able to submit unauthorized withdrawal transactions from hot wallets.
Coordinated drain - Billions were moved across 60+ different tokens to attacker-controlled wallets in a short time window.

Binance has stated there is no evidence of any wallet private key leak. The attack appears to have exploited access to operational systems rather than directly compromising cold storage or seed phrases.

Scale of the Theft

On-chain tracking reveals the massive scope:

Source	Estimated Amount	Notes
Multiple hot wallet drains	~$2.5B - $5.7B	Varies by on-chain analysis
Binance’s estimate	$6.3 billion	Company’s preliminary assessment
Assets frozen by Tether/Circle	~$2.3 billion	USDT and USDC linked to the incident
Tracked by Arkham Intelligence	~$5.78 billion	Across 55 addresses labeled “binance-hacker-1029”

The stolen assets include BTC, ETH, USDT, USDC, and dozens of other tokens spread across multiple addresses to obfuscate movement.

Response & Mitigation

Funds protection - Binance has committed to covering all losses using its Secure Asset Fund for Users (SAFU) and company funds.
Withdrawals paused - Multiple networks remain suspended while the exchange hardens security.
Asset freezing - Tether and Circle are actively freezing funds they identify as linked to the exploit.
Public warnings - Binance urges users to be vigilant against scams using the incident as bait.
Investigation ongoing - A detailed technical post-mortem is promised once facts are fully verified.

Comparison to Previous Hacks

Incident	Amount Stolen	Year	Attributed To
Binance Hack	~$6.3B	2026	Suspected DPRK (Lazarus Group)
Bybit Hack	$1.5B	2025	DPRK (Lazarus Group)
Ronin Network	$624M	2022	DPRK (Lazarus Group)
Poly Network	$611M	2021	White hat (returned)

If confirmed, this would dwarf all previous cryptocurrency heists by a significant margin.

Security Lessons

Endpoint security is critical - The compromise of a single engineer’s laptop proved sufficient to access hot wallet operational systems. Endpoint detection, zero-trust access controls, and device posture checks are essential.
Hot wallet risk - Despite cold storage best practices, operational hot wallets remain a high-value target. Limiting hot wallet balances and requiring additional approvals for large withdrawals could limit damage.
Supply chain/ops security - DevOps environments with broad access to signing/transaction systems need strict segmentation and just-in-time access.
Rapid response matters - Coordinated freezing by stablecoin issuers helped contain roughly $2.3B so far, demonstrating the importance of industry cooperation.
State-sponsored threats - The suspected DPRK attribution highlights the persistent threat from well-resourced nation-state actors targeting crypto infrastructure.