Binance breach: about $6.3 billion stolen in the largest crypto theft on record, exchange says user funds will be covered
Binance confirmed on October 29, 2026 that attackers drained about $6.3 billion in cryptocurrency from its wallets in about 20 minutes after breaching its systems, including a DevOps engineer’s laptop; the exchange suspended deposits and withdrawals, says user funds are safe and that it will cover all losses, and about $2.7 billion of the stolen assets have been frozen.
What happened
On Thursday, October 29, 2026, attackers drained approximately $6.36 billion in cryptocurrency from wallets Binance uses to process transactions, most of it in about 20 minutes starting at 20:05 UTC, across ten blockchains. Binance confirmed the breach in a statement shared with BleepingComputer on Thursday. The exchange said the initial access involved a DevOps engineer’s compromised laptop, which let the attackers reach a service container and submit unauthorised withdrawal transactions, and that it has not yet found evidence of a leaked wallet private key. Co-CEO Richard Teng said the attack “involved a more complex attack process” than one person’s permissions, and Binance later said its investigation had “uncovered additional points of breach” and was still gathering the facts. Binance suspended deposits and withdrawals while it conducts security checks, revoked authorisations for the affected address, and is working with blockchain intelligence partners and law enforcement to trace and recover the funds. At about $6.3 billion, this is the largest crypto theft on record — roughly four times the $1.5 billion Bybit hack of February 2025.
TRM said the attackers compromised Binance’s “signing infrastructure” — the system that authorises transactions — which let them issue instructions that emptied the affected wallets; in one expert’s summary to Reuters, the attacker may not have stolen the vault key so much as hijacked the system that tells the vault to release money. The theft rattled the wider market on Friday, with bitcoin falling to a six-week low, and it follows the pattern of the February 2025 Bybit hack, which the FBI attributed to North Korean hackers and which used a compromised developer machine as the way in.
Blockchain analysis firm TRM Labs attributed the attack to TraderTraitor, the North Korean state-backed unit also tracked as Lazarus Group and APT38, and Chainalysis said it reached the same conclusion with a high degree of confidence. Binance itself has not attributed the attack to anyone.
Who is affected
Binance’s customers worldwide — the exchange says it has over 335 million registered users. No customer personal data has been reported taken in this incident: what was stolen was cryptocurrency held in Binance’s own transaction wallets. Binance.US, a separate exchange, said it was not affected. Stablecoin issuers and partners have frozen roughly $2.7 billion of the stolen assets, including about $2.67 billion in stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial; TRM estimates about $2.4 billion in bitcoin and ether is beyond the issuers’ reach.
How serious
This was direct theft of assets at the exchange level, not a leak of customer records. For customers, the immediate impact is operational: deposits and withdrawals were suspended during the response, and access to funds depends on the exchange, not on anything a customer did. Binance has said user funds are safe and that it “will cover all losses from the SAFU fund and the company’s funds” — the SAFU fund is a $1 billion bitcoin reserve the exchange holds for exactly this kind of event — and that it will publish an updated Proof of Reserves once remediation is complete. That coverage promise is the protection customers are relying on, and it is a promise, not yet a completed reimbursement. The predictable second risk is scams: fake “Binance support” accounts and “verify your wallet to unlock withdrawals” pages always follow a breach headline this size.
What to do now
Do not act on any message about this incident that asks you to verify, unlock or move your funds: Binance does not restore withdrawals through links in emails, texts or social-media replies, and no legitimate step requires your wallet recovery phrase or private key. Check the status of deposits and withdrawals only inside the official Binance app or on its official website, typed in yourself. If you hold significant funds on any exchange, this is the standing lesson: keep only what you are actively trading there, and treat every “urgent action required” message in the days after a breach as hostile until you have confirmed it through the official channel.
Sources: BleepingComputer, October 30, 2026 · Reuters, October 30, 2026