Binance hit by $6.3 billion hack, the largest on record; about $3 billion frozen
Binance says a compromised DevOps engineer's laptop may have let an attacker submit unauthorized withdrawals. TRM Labs and Chainalysis link the theft to North Korea's TraderTraitor; Binance pledges to cover all losses.

TL;DR
- Binance estimated the impact of a security incident disclosed on Oct. 29, 2026 at about $6.3 billion, with around $3 billion frozen on-chain so far, according to CNBC.
- Binance said its initial investigation points to a compromised DevOps engineer's laptop and that it found no evidence of a wallet private key leak.
- TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit; the BBC notes it eclipses the $1.5 billion Bybit hack of 2025.
- Binance suspended withdrawals and pledged to cover all losses from its SAFU fund and company funds; co-founder Yi He said withdrawals should start to resume within 48 hours.
The largest exchange in crypto just suffered what may be the largest theft in crypto history. Binance estimated the impact of a security incident at about $6.3 billion, with around $3 billion of affected assets frozen on-chain so far, CNBC reported. The BBC calls it potentially the largest hack in history, eclipsing the record $1.5 billion Bybit hack in 2025.
Binance said its initial investigation suggests "the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The exchange added: "We have found no evidence of any wallet private key leak."
Who froze what
Stablecoin issuers moved fast. Tether CEO Paolo Ardoino said his firm froze around $1.6 billion, and Circle CEO Jeremy Allaire said Circle froze more than $800 million in assets linked to the incident, according to the BBC. CNBC reported that Ripple helped halt the movement of $200 million, per Binance co-founder Yi He.
Binance has temporarily suspended withdrawals, revoked the affected address authorization and engaged law enforcement and blockchain intelligence firms. Yi He said deposits continued to operate normally and that Binance expects to begin resuming withdrawals within the next 48 hours, CNBC reported. Binance says it will cover all losses from its SAFU fund and company funds, and will publish a technical post-mortem and an updated Proof of Reserves. Binance.US said it is not affected, according to the BBC.
North Korea link
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored unit the FBI previously linked to the Bybit hack, CNBC reported. TRM estimated that about $6.36 billion was moved from Binance wallets across 10 blockchains, most of it within about 20 minutes, and that preparations began at least 36 hours before the theft. Chainalysis CEO Jonathan Levin also pointed to TraderTraitor.
Solvency and market reaction
Sean Farrell of Fundstrat Global Advisors told CNBC the breach "does not currently appear to create meaningful solvency risk for Binance." He estimated about $3.3 billion remained unfrozen and that the SAFU fund, worth roughly $1.2 billion, could cover about a third of that, with the rest coming from Binance's own funds. The tell to watch, he said, is how quickly withdrawals resume and whether outflows stay orderly.
Markets reacted sharply. Bitcoin fell more than 4% to $77,994.96, ether dropped 4.84% to $2,247.45 and BNB slid 7.68% to $694.45, according to CNBC's markets live blog.
What it means for Web3 teams – Analysis
The attack vector reported so far is not a broken smart contract or leaked key, but a workstation and an internal service container. For any team holding user funds, endpoint security, withdrawal-signing controls and incident communication are now board-level topics. Freezes worked fastest on issuer-controlled stablecoins; native assets like bitcoin and ether depend on tracing and cooperating venues. This is not investment advice.
FAQ
How much was affected in the Binance hack?
Binance estimated the total impact at about $6.3 billion, with around $3 billion frozen on-chain so far.
How did the attack happen?
Binance's initial investigation suggests a compromised DevOps engineer's laptop allowed an attacker to access a service container and submit unauthorized withdrawals. Binance found no evidence of a wallet private key leak.
Who is suspected?
TRM Labs and Chainalysis attributed the attack to TraderTraitor, a North Korean state-sponsored hacking unit.
Will customers be reimbursed?
Binance says it will cover all losses using its SAFU fund and company funds.
Sources
News summary based on the sources above. Not investment, legal or tax advice. Editorial policy & corrections · Report an error
Building in Web3? Turn the news into trust.
Positioning, KOL programs, LinkedIn systems and claim-safe content for Web3 and fintech teams.
Related

Polymarket halts trading after $2.65 million exploit via compromised third-party script, pledges full refunds
A wallet-draining script served through website-monitoring provider DebugBear hit Polymarket.com on Oct. 29, 2026. Trading resumed within about an hour; the company says all affected traders will be reimbursed.

NYSE owner ICE teams with Trade[XYZ] to bring Hyperliquid-based perpetual futures to the U.S.
Intercontinental Exchange announced on Oct. 29, 2026 a definitive agreement to run a regulated U.S. market for Trade[XYZ]'s perpetual contracts, subject to regulatory approvals. ICE is also investing in the company.

FCA settles HTX case: exchange exits UK and pledges no unlawful crypto promotions until 2031
The UK regulator said on Oct. 29, 2026 that Huobi Global gave High Court undertakings covering HTX's website, apps and social media. UK users can no longer deposit or sign up.