Biggest Crypto Hack Ever? Binance Joins the List of Exchange Hacks

Update 10:45 UTC: trail leads to North Korea, withdrawals within 48 hours. Investigators at TRM Labs attribute the Binance hack with high confidence to North Korea's TraderTraitor group, and Chainalysis points to the same group; Binance has not named an attacker. According to TRM Labs, about $6.36 billion left across ten blockchains, about $2.7 billion is frozen, and the attacker holds more than 420,000 ETH and 18,270 BTC across all wallets. Binance expects to reopen withdrawals within 48 hours; deposits work. Everything in one place: North Korea behind the Binance hack? What we know.

Update 02:30 UTC: Binance puts the damage at $6.3 billion. In an official announcement Binance estimates the total impact at around $6.3 billion, of which about $3 billion is frozen on-chain. According to the initial investigation, a DevOps engineer's laptop was compromised, which let the attacker access a service container and submit unauthorized withdrawal transactions. Binance says it has found no evidence of a private key leak. The exchange will cover all losses from the SAFU fund and company funds; deposits and withdrawals remain suspended, and an updated proof of reserves will follow.

Update 01:25 UTC: Binance confirms the hack. Co-founder Yi He wrote at 00:04 UTC that user funds are safe and Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while the exchange runs security checks, freezes funds and works with law enforcement. According to on-chain investigator ZachXBT, more than $2.83 billion is now frozen. Before the freezes, the attacker had supplied 60 million USDT to Aave and borrowed 19,762 wETH, about $45 million, against it, as Marc Zeller of the Aave Chan Initiative explains.

User funds are safe. Binance will cover all hacking losses. Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.

Yi He (@heyibinance) October 30, 2026

At about $2.8 billion, the suspected Binance hack of October 29, 2026 would be the largest theft ever suffered by a crypto exchange. The previous record belonged to Bybit with about $1.5 billion in February 2025. Unlike then, most of the loot is already frozen this time: Tether and Circle have blocked stablecoins worth about $2.4 billion. Binance says it is investigating reports of a potential security issue, co-founder Changpeng Zhao says it does look like a hack. We place the case in the line of major crypto hacks and explain why exchanges are hit more and more often.

What happened to the wallet is in our Binance hack report, how the market reacted in our crypto crash timeline.

Advertisement, for readers in the EU: If you no longer want to keep your coins on Binance after the hack, Bitpanda compares itself with Binance, Kraken, Coinbase and Crypto.com and shows a three-step guide to moving your crypto. Bitpanda is licensed in the EU under MiCA. Other MiCA-licensed alternatives in the EU are Coinbase (licensed via Luxembourg) and OKX (licensed via Malta).

Which EU-licensed exchanges are a Binance alternative, what they charge and how to move your crypto is covered in our guide Binance alternatives: 4 MiCA-licensed exchanges compared.

The biggest crypto hacks in history

The table shows the damage at the time of the theft. Several cases were later fully or partly covered or recovered.

Why do crypto exchanges get hacked so often?

There are not more attacks, there are bigger ones. According to Chainalysis about $3.4 billion in crypto was stolen in 2025, about $2 billion of it by groups attributed to North Korea, as Bloomberg Law reported. The number of North Korean attacks fell while the loot per attack rose. Four reasons explain it:

• Hot wallets hold billions. Exchanges need coins they can pay out instantly. These hot wallets are online, and the bigger the exchange, the more they hold.
• Professional attackers. Groups like Lazarus work like intelligence services: they prepare attacks for months, apply for jobs at crypto firms under false identities and go through employees and service providers instead of the blockchain.
• New attack surfaces. In the Binance case the attacker used EIP-7702, a feature live on Ethereum since the Pectra upgrade in May 2025. With a single signature a wallet can hand its control to a contract. Whoever obtains that signature owns the wallet.
• People, not machines. In the 2025 Bybit hack the entry point was not the exchange itself but a developer's computer at a service provider. AI-written messages make such attacks even more convincing, as Changpeng Zhao warned before the incident.

Tornado Cash, Tron and the dark web: where does the money go?

Many ask why money from a Binance wallet flows "into the dark web". Strictly speaking it stays on the blockchain, visible to anyone. Three tools make it opaque:

• Tornado Cash is a mixer on Ethereum, not part of the Tor network. It pools deposits of many users so that it is no longer traceable who withdrew what. In the Binance case the attacker's address was funded with 0.1 ETH from Tornado Cash, so the gas money leaves no trail to his identity.
• Tron and bridges. Stolen funds often move across bridges to other blockchains. Tether is especially widespread on Tron and is often swapped for cash there through over-the-counter dealers.
• Decentralized exchanges. What cannot be frozen, such as Ether, attackers swap in small tranches. About 195,460 ETH still sit on an attacker address according to Etherscan.

That Tether and Circle could freeze so fast this time is the biggest difference to earlier cases. In the Bitget hack in September the stablecoins were swapped into Ether within minutes and only about $318,000 could be frozen, as Decrypt reported.

More on the Binance hack

• Binance hack: how the hot wallet was drained
• On-chain analysis: what the blockchain shows about the hack
• Live ticker and timeline: the crypto crash after the hack
• USDT frozen: what Tether and Circle really blocked
• Binance withdrawals: which networks are paused
• Is this the end? Three scenarios for Bitcoin
• Ethereum: the hacker sits on 195,000 ETH
• Solana below $100: is $80 next?
• BNB crash: another FTT moment?
• How to short Bitcoin in the crash
• Why is crypto down today?

What did past exchange hacks mean for prices?

The list shows a pattern: what mattered for the market was never the amount but whether the exchange stayed solvent.

• Covered and kept trading: Binance 2019, Bybit 2025 and Bitget 2026 covered the loss from their own funds or protection funds. Prices dipped briefly and recovered once withdrawals ran.
• Insolvent: Mt. Gox 2014 and FTX 2022 collapsed. There the market fell for weeks because customer money was missing.

Before the hack, DefiLlama's public address data showed just under $145 billion in customer assets on Binance, excluding its own tokens such as BNB; the damage of around $6.3 billion that Binance reports equals a little over 4% of that, and about half of it is frozen. On current information the first pattern looks more likely than the second. How low Bitcoin could fall in either case is covered in our three scenarios after the Binance hack.

How to protect your coins from the next hack

• Only keep what you trade on an exchange. Larger holdings belong on a hardware wallet whose keys only you hold. Our hardware wallet comparison shows the devices.
• Look for licences and protection funds. Which exchanges are regulated is shown in our comparison of regulated exchanges.
• Never sign what you do not understand. Since EIP-7702 a single signature can hand over control of a wallet. Check every request your wallet shows and reject what you did not trigger yourself.

This article is not investment advice. We will update the list as Binance completes its investigation.