Binance hack drains $6.3 billion from hot wallets in largest crypto theft

Binance reported on October 30 that attackers drained hot wallets across roughly 10 blockchains on October 29, removing approximately $6.3 billion in assets. The breach began around 20:05 UTC and unfolded in about 20 minutes, marking the largest crypto theft recorded to date.

Technical details of the October 29 incident

Binance traced the initial compromise to a DevOps engineer’s laptop that allowed unauthorized withdrawals through a service container. Subsequent analysis identified additional breach vectors, including exploitation of EIP-7702 on Ethereum and deployment of malware designed to erase forensic evidence. Investigators found no signs that private keys had been exposed.

Blockchain analytics firms TRM Labs and Chainalysis attributed the transfers to TraderTraitor, a North Korean state-linked group previously connected to the February 2025 Bybit incident. Elliptic assessed North Korean involvement as likely. Binance has not publicly identified the perpetrators. The stolen sum equals roughly four times the prior record loss of about $1.5 billion.

Approximately $3 billion of the taken assets, primarily stablecoins such as USDT and USDC, were frozen on-chain by issuers including Tether and Circle. Analysts estimate the remaining $3.3 billion was converted into non-freezable assets such as ETH and BTC before further tracing could occur.

Binance measures and recovery timeline

Binance immediately suspended withdrawals while deposits and trading continued. The exchange stated it would cover all losses using its SAFU fund, which holds more than $1 billion in BTC, along with corporate treasury reserves. Company filings show reserves exceeding $6.34 billion, including $5 billion already matched in tokens, covering roughly 80 percent of the shortfall with the balance acquired through market and OTC purchases.

Withdrawals are scheduled for phased resumption within 34 to 40 hours of the October 30 updates, pending final security verification and aimed before a Sunday deadline. A Proof of Reserves snapshot will be published shortly, with results expected by Monday, November 2, 2026. Binance is cooperating with law enforcement, asset issuers, and intelligence firms to pursue recovery of the remaining funds.

Market reaction and security context

Bitcoin and other major assets faced immediate selling pressure following the announcement. Full technical details of the exploit remain under review, and a comprehensive post-mortem will be released once the investigation concludes. The incident underscores ongoing risks to centralized exchange infrastructure despite prior industry improvements in wallet segregation and multi-signature controls.

Trading volumes on Binance remained stable after the initial suspension, and no customer funds beyond the reported hot-wallet drain have been affected. Industry observers continue to monitor on-chain movements of the unfrozen portion of the stolen assets.