Binance reported an estimated $6.3 billion impact from a security breach on October 29, 2026. According to TRM Labs, about $6.36 billion moved from Binance wallets across 10 blockchains, mostly within roughly 20 minutes. The scale would make it the largest cryptocurrency theft reported to date.
2
17
What happened
TRM Labs placed the start of the outflows at about 20:05 UTC. The assets included a mix of cryptocurrencies, and the rapid transfers crossed multiple networks.
2
18 Binance temporarily halted withdrawals as it responded to the incident.
17
The reported loss is several times larger than the roughly $1.5 billion stolen in the 2025 Bybit hack, previously described as the largest crypto theft.
5
How the attackers may have gained access
Binance’s preliminary investigation pointed to a compromised laptop belonging to a development-operations engineer, according to reporting on the company’s findings.
11 A separate technical analysis describes the attackers as using Binance’s hot-wallet withdrawal infrastructure to sign and send assets to attacker-controlled addresses.
6
Those details do not amount to a complete, independently verified account of the breach. The available reporting does not establish every step between the laptop compromise and the withdrawals, or confirm how signing access worked across all affected blockchains. A compromised withdrawal process should not automatically be treated as proof that wallet private keys were stolen.
Who investigators suspect
TRM Labs and Chainalysis linked the incident to TraderTraitor, a group associated in reporting with North Korea.
1 That is an investigator assessment, not a confirmed attribution by Binance. Reporting on the incident says Binance’s own preliminary investigation had not named an attacker.
11
The attribution should therefore be treated as a lead rather than a settled finding. The available sources do not establish a connection to the Bitget exploit or substantiate other claims about North Korea’s past statements on the incident.
Binance’s response and the asset freeze
Binance said it worked with partners to freeze about $3 billion in affected assets and would cover the losses. Stablecoin issuers including Tether and Circle also froze assets linked to the theft, according to Reuters.
3
17 These are reported response measures; the sources do not show that every stolen asset was recovered or that reimbursement had already been completed.
Reuters also reported that Binance was working with the FBI, the U.S. Secret Service and other law-enforcement agencies.
19 The available reporting does not specify how much, if any, those agencies had recovered at the time.
Market reaction and what remains unclear
Cryptocurrency prices fell after Binance disclosed the security incident, and analysts warned that a theft of this scale could weigh on confidence in digital assets.
17 That market response does not, by itself, establish broader effects such as forced liquidations or a lasting loss of confidence.
Several details remain unsettled: the full technical path into Binance’s withdrawal systems, the final accounting of frozen and unrecovered assets, and any definitive attribution. The reported figures and investigator assessments describe what was known as of October 30, 2026; they may change as the investigation continues.