$6.3 billion stolen · nearly $3 billion frozen
On Thursday, Binance, the world's biggest crypto exchange, said a "security incident" had affected about $6.3 billion of assets on its platform. If the figure holds, it is the largest crypto theft ever, ahead of the $1.5 billion Bybit hack of February 2025. The good news: nearly $3 billion of the stolen money has already been frozen on-chain.
The story in short
Binance has promised to cover all user losses from its SAFU fund and its own money. Deposits and withdrawals are paused for now and are expected to resume within about 48 hours.
The size of the theft differs a little by source, because assets are priced differently:
Source | Estimate | Note |
|---|---|---|
Binance | $6.3 billion | Assets affected |
Elliptic | $6.43 billion | At time of theft, across 11 blockchains |
Chainalysis | About $5.91 billion | At time of theft; nearly 4x the next largest heist |
Tether froze more than 1.567 billion USDT and Circle about 800 million USDC. The frozen share of the theft (using Elliptic's figures) is:
How the attack worked
Binance says early findings point to the laptop of a DevOps engineer: from there the attacker reached a service container and submitted unauthorized withdrawal transactions. Binance stresses that no wallet private key was leaked and that this was not a one-click attack; its investigation has found further points of breach.
The 50-authorization trick
The analysis by TRM Labs has an interesting technical detail. A wallet keeps a counter of its transactions (a nonce), and an authorization is valid only at one specific count. Binance's hot wallet processes withdrawals all the time, so its counter keeps moving; the attacker therefore prepared signatures for 50 counts in a row, so that one would surely be valid when the transaction ran:
# A simplified illustration of the idea (not real exploit code)
current_nonce = hot_wallet.nonce() # the wallet's running transaction count
authorizations = [
sign(delegate_to=sweeper, nonce=n) # one pre-signed authorization per count
for n in range(current_nonce, current_nonce + 50)
]
submit(authorizations) # whichever count is current when it runs is validElliptic's conclusion (paraphrased): the attacker apparently did not steal the keys, but got Binance's own systems to sign transactions for them. The cryptography held; the infrastructure and the people around the wallets were the target.
Binance has not yet published a root cause.
Who is behind it?
TRM Labs and Chainalysis attribute the attack, "with high confidence", to groups linked to North Korea (TraderTraitor, the group behind the Bybit hack). Their reasons:
Stolen Binance funds and funds from the recent Bitget exploit went to the same Ethereum address.
The attacker's wallet was funded with a few small Tornado Cash withdrawals.
The code was tested in advance and pre-signed transactions were executed in a single burst.
Elliptic is more cautious: the laundering looks different this time. The attacker held the stolen USDT for 37 minutes on Ethereum and 46 minutes on Tron, and used market makers and lending protocols instead of the cross-chain bridges seen after Bybit. Chainalysis also sees never-before-seen automated patterns: thousands of short transactions that circle money among addresses.
How much is frozen, and how much does the attacker hold?
According to Elliptic, $2.84 billion has been frozen, but the attacker still controls about $3.33 billion that no issuer can freeze, because it is in Bitcoin, Ether, XRP and TRX spread over about 43 addresses (18,270 BTC, 511,861 ETH, 233 million XRP and 670 million TRX). Nothing has been frozen on Bitcoin, the XRP Ledger, Solana or NEAR. The chart below is interactive; switch between "Stolen" and "Frozen":
Binance's response
Deposits and withdrawals are paused, and the authorization of the affected addresses was revoked.
The compromised infrastructure was contained and new security controls were added.
It is working with law enforcement and blockchain-intelligence firms to trace and recover funds, and says it takes "full responsibility".
Co-CEO Richard Teng said the investigation has not pinned responsibility on any individual.
My take
This part is my opinion, not news reporting. The lesson here is not about the cryptography but about people and infrastructure: an infected laptop, a container, and a system that signs. The same pattern showed up at Bybit. The more money sits in one hot wallet, and the more automatic its signing, the more a small weakness is worth. Until Binance publishes a root cause, all analyses are estimates.
Source
Report by The Hacker News (by Ravie Lakshmanan, 30 October 2026), and data from Elliptic, TRM Labs and Chainalysis. I built the charts from Elliptic's figures. The story is still developing and the numbers may change.
