AnswersPublished21 sources
Binance’s Record $6.3B Hack: What Happened and What It Means for Crypto Markets
Binance estimated the October 29 theft at about $6.3 billion; Elliptic put it at $6.43 billion—more than four times the 2025 Bybit theft. Elliptic reported $2.85 billion frozen or seized, but a freeze is not the same as recovery.
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Binance estimated the October 29 theft at about $6.3 billion; Elliptic put it at $6.43 billion—more than four times the 2025 Bybit theft.
- Elliptic reported $2.85 billion frozen or seized, but a freeze is not the same as recovery.
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What is known as of November 1, 2026, about the record October 29 Binance hack and its market consequences, including Elliptic’s $6.43 billi. Article summary: The available reporting describes the October 29 Binance theft as the largest crypto hack on record, with Binance estimating roughly $6.3 billion stolen and Elliptic estimating $6.43 billion—more than four times the Febr. Topic tags: general, news, general web, user generated. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts w
The October 29, 2026 Binance theft is being described as the largest crypto hack on record. Estimates vary, but Binance put the impact at about $6.3 billion and Elliptic at $6.43 billion. Elliptic’s October 31 update also reported that the FBI attributed the theft to North Korea’s TraderTraitor group—so government attribution was no longer unconfirmed by November 1.12
The market story has three distinct parts: what was stolen, what has been frozen or pledged as coverage, and what might happen if the attacker sells assets that remain under their control. Those are not interchangeable measures of the loss.
How large was the theft—and why do estimates differ?
Binance estimated the impact at around $6.3 billion. TRM Labs estimated about $6.36 billion, while Elliptic put the amount at $6.43 billion.12 Elliptic’s estimate is more than four times the $1.46 billion stolen in the 2025 Bybit hack.
12
The figures are not identical because firms can use different asset prices and count different transfers as part of the incident. One report discussing the estimates notes that Elliptic excluded some outflows that other assessments may count.7
9 The available reporting does not establish a single final figure accepted by all parties.
What is known about the breach and attribution?
Binance’s initial investigation pointed to a potentially compromised DevOps engineer’s laptop. The exchange said the laptop may have allowed an attacker to access a service container and submit unauthorized withdrawals; Binance also said it had found no evidence of a wallet private-key leak. These were preliminary findings, and the company said a fuller technical account would follow after verification.
Early reporting linked the attack to TraderTraitor, but that attribution initially came from blockchain intelligence firms rather than a government announcement.1
6 Elliptic later reported that the FBI attributed the theft to North Korea and named TraderTraitor in an update timestamped October 31 at 23:55 UTC.
12 The source available here is Elliptic’s report of the FBI attribution, not the underlying FBI statement.
Frozen funds are not the same as recovered funds
Elliptic reported that $2.85 billion—about 44% of its estimated theft total—had been frozen or seized, almost entirely in USDT and USDC.12 Binance separately reported that about $3 billion had been frozen on-chain with help from blockchain partners.
Those totals should not be read as money already returned to Binance. A freeze can prevent some assets from moving, but tracing and recovery are separate steps; the U.S. Secret Service said investigators were working to identify, freeze, trace and recover the stolen funds.17 Reporting also described the attacker swapping stablecoins that issuers may be able to freeze into ETH, which does not have the same issuer-controlled freeze mechanism.
19
Binance pledged to cover all losses and said it had set aside more than $6.34 billion of company funds, including $5 billion in the affected token types, according to reporting on the company’s statement.2
5 Reuters reported that Binance said customer funds were safe. A coverage pledge speaks to Binance’s stated ability to absorb the loss; it does not mean the stolen assets have been recovered.
The Aave position: why ETH price movements matter
Reports said a wallet linked to the attacker deposited about $60 million in USDT to Aave and borrowed 19,762 WETH, worth roughly $44.6 million at the time. LlamaRisk described the position as overcollateralized and said Aave user funds were safe.
Because the debt is denominated in ETH while the collateral is a dollar-linked stablecoin, a rise in ETH’s price increases the debt’s dollar value without increasing the USDT collateral. That can make the position less safely collateralized; a fall in ETH’s price has the opposite effect. This describes the direction of the risk, not proof that the position was close to liquidation at a particular price.
Liquidation also does not automatically mean the borrower sells the borrowed ETH. A liquidator must repay the ETH-denominated debt and receives collateral in return. The resulting market effect depends on how the liquidator sources or hedges the ETH; the loan alone does not establish a forced sale of the borrower’s ETH holdings.
Aave froze markets as a precaution and later adjusted risk parameters across V3 and V4, according to its incident-response update.20 The supplied reporting supports the broad response, but does not establish every claimed operational detail, such as the exact number of reserves frozen or the status of every asset’s loan-to-value setting.
What could still affect crypto markets?
One report attributed more than 420,000 ETH and 18,270 BTC in attacker-linked wallets to TRM Labs.4 That is an estimate from a tracing report, not a confirmed final balance. If large amounts of ETH were eventually sold, those sales could add market pressure; converting stablecoins into ETH and later selling ETH are separate steps, and the first does not prove the second will happen.
Markets also saw sharp trading stress around the incident. One report cited $627.7 million in crypto liquidations within an hour and described declines in Bitcoin and Ether as traders reacted to suspicious Binance outflows. That timing does not show that the hack alone caused every liquidation or price move.
The key distinction is between Binance’s pledge to cover losses, assets investigators have frozen, and assets that may still be sold. The pledge addresses Binance’s stated financial backstop; the freeze figure describes containment; neither, by itself, resolves the market risk from any funds that remain movable.12
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "Binance’s Record $6.3B Hack: What Happened and What It Means for Crypto Markets"?
Binance estimated the October 29 theft at about $6.3 billion; Elliptic put it at $6.43 billion—more than four times the 2025 Bybit theft.
What are the key points to validate first?
Binance estimated the October 29 theft at about $6.3 billion; Elliptic put it at $6.43 billion—more than four times the 2025 Bybit theft. Elliptic reported $2.85 billion frozen or seized, but a freeze is not the same as recovery.
Sources
elliptic.coThe largest theft in history: North Korea behind the $6.4 billion Binance hack | Elliptic
cryptoticker.ioBinance Hack: FBI Names North Korea, 600 Addresses
marketscale.comBinance pauses withdrawals after a theft it puts at $6.3 billion, the largest crypto hack on record
npr.orgBlockchain intelligence firms link North Korea to $6.3B hack on Binance