The world's largest cryptocurrency exchange was hit on Thursday, October 29, 2026, in what investigators say is the biggest crypto theft ever recorded. The Binance hack, first flagged in on-chain data in the late afternoon in the United States, saw more than $5.7 billion in digital assets move out of wallets linked to Binance, according to blockchain analytics firm Arkham, dwarfing the previous record of about $1.5 billion stolen from the Bybit exchange in February 2025. Binance has suspended deposits and withdrawals while it investigates, says user funds are safe, and says it will cover all hacking losses — even as the exact total, the method used and the identity of the attacker remain unconfirmed by the company itself.
What is not in doubt is the scale of the scramble that followed. Stablecoin issuers Tether and Circle moved within hours to freeze more than $2.3 billion in tokens linked to the incident, Binance later said $3 billion in assets had been frozen in total, and crypto prices fell sharply as traders weighed the news. Bitcoin dropped below $77,000, ether fell more than 5 percent, and Binance's own BNB token dropped about 8 percent. The incident began at around 4:30 p.m. Eastern Time on Thursday, according to Arkham chief executive Miguel Morel, and was still unfolding in the hours that followed, with the suspected attacker's wallets moving funds through decentralised exchanges and lending platforms in a race against the freezes.
The first public signs came on Thursday afternoon, when blockchain trackers began reporting large, unusual outflows from Binance-linked wallets. Arkham's data indicated that billions of dollars appeared to have been taken by an unknown actor, and Morel said the incident began around 4:30 p.m. Eastern Time and appeared to be ongoing. A forensic account published by security firm Blockaid, and reported by TradingView, said the attacker targeted two Binance hot wallets, named "Binance 14" and "Binance 16", and directed the funds to a newly created address that had recently been funded through Tornado Cash, a privacy mixer that scrambles the trail of crypto payments.
Decrypt's on-chain tally, drawn from Etherscan and other blockchain records, put the scale in stark terms: at least $5.57 billion left Binance-linked wallets across three blockchains — $3.51 billion on Ethereum, $1.44 billion in 18,270 bitcoin on the Bitcoin network, and $630 million on Tron. The first Ethereum transaction, at 20:24 UTC, sent 167,464 ether plus 63 token transfers to a brand-new address, including 1.615 billion USDT. Three minutes earlier, Decrypt reported, an address funded through Tornado Cash had submitted a delegation for a Binance hot wallet using EIP-7702, an Ethereum feature that lets an ordinary wallet run smart-contract code. Binance itself has not confirmed that account of the mechanism, and the cause of the incident remains officially unconfirmed.
Arkham's breakdown of the hacker's wallets showed nearly $1.5 billion in bitcoin, $900 million in ether, roughly $1.5 billion in USDT and more than $800 million in USDC. A separate tally from FXStreet, also drawn from on-chain data, gave a similar picture with slightly different totals: $3.78 billion on Ethereum, $1.441 billion in bitcoin, $628 million on Tron, $290 million on the XRP Ledger, $94 million on Solana and $61 million across Arbitrum, Avalanche, Optimism and Base. The differences between the tallies are a normal feature of a fast-moving incident — trackers are watching different wallets, prices are moving, and some wallets may prove unrelated — and every firm involved has stressed that the figures will take time to settle.
Binance's own first statement was cautious. "Our teams are aware of reports of a potential security issue and are actively investigating," the company said on X. "Rest assured that user funds are completely safe." In a follow-up post, the exchange said withdrawals would resume as soon as the security issue was fully resolved, and warned users to beware of scams and to trust only official Binance channels. It later confirmed it was conducting security checks, freezing funds and working with law enforcement, and promised a full post-mortem once the investigation is complete.
Binance is, by trading volume, the largest cryptocurrency exchange in the world, with more than 335 million registered users globally and about $160 billion in assets under custody as of its 2024 annual report. A separate data provider, DefiLlama, put the assets held on the platform at roughly $144 billion immediately before the hack, which would make the stolen sum about 4 percent of those holdings. That scale cuts both ways: it makes Binance the most consequential target in crypto, and it also gives the company a balance sheet that, in the view of several market participants, can absorb a loss of this size.
The company has a dedicated cushion for exactly this kind of event. Its Secure Asset Fund for Users, known as SAFU and established in 2018, holds roughly $1 billion in bitcoin and is intended to protect customers during security breaches and other emergencies. Binance has not confirmed whether it plans to deploy the fund for this incident, and the company's public reassurances have rested instead on a broader promise: that customers will be made whole, whatever the mechanism. Wintermute chief executive Evgeny Gaevoy wrote on X that "Binance has enough to withstand 3-4x of current hit and still be largely intact."
The hack also fits into a grim pattern for the crypto industry. Researchers at TRM Labs counted $2.9 billion stolen across nearly 150 attacks last year, and in September 2026 the Bitget exchange said roughly $350 million had been stolen from its platform. Binance itself lost 7,000 bitcoin, worth about $40 million at the time, in a 2019 hack — a sum that now looks small beside a multi-billion-dollar heist. The February 2025 Bybit theft, at about $1.5 billion and linked by investigators to North Korea, had stood as the largest crypto hack on record until Thursday. If the early Binance estimates hold, the new incident is roughly four times that size.
One structural feature of crypto made Thursday's response possible in a way that would be impossible in traditional banking: stablecoins such as USDT and USDC are issued by central companies that can freeze tokens at specific addresses. When Tether and Circle froze the tokens linked to the attack, the attacker could no longer move, transfer or cash out those specific tokens — though, as CoinDesk noted, the transfers alone do not establish whether the remaining funds have become impossible to freeze or recover, because the attacker can swap frozen-able stablecoins for cryptocurrencies that lack central issuer controls.
The freeze race began almost immediately. Binance founder Changpeng Zhao, who stepped down as chief executive in 2023 but remains the company's largest shareholder, wrote on X: "User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m). I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered." Those early figures — about $1.79 billion combined — were soon overtaken. Tether chief executive Paolo Ardoino later said his firm had frozen more than $1.567 billion in USDT, Circle chief executive Jeremy Allaire said his firm had frozen more than $800 million in USDC, and Binance clarified that, as of around 7:20 p.m. Eastern Time, the verified total of frozen stablecoins stood at $2.54 billion, with the figure expected to keep rising.
By Friday morning in Asia, Binance said $3 billion in crypto assets had been frozen in total as it worked with law enforcement agencies, token issuers, blockchain intelligence firms and other industry partners to trace and freeze more. Ripple froze roughly $200 million, according to Yi He, and World Liberty Financial, a crypto company linked to U.S. President Donald Trump and his family, said it had worked with custodian BitGo to freeze funds stolen in the incident — $27 million in stablecoins and about $2 million worth of World Liberty tokens, according to Yi He. Freezing, however, is not the same as recovery: investigators must still establish who controls the wallets, trace the funds that were not frozen, and determine what happened before any recovery can be confirmed.
Meanwhile the suspected attacker was not standing still. Arkham's data showed the wallet linked to the exploit moving assets through the decentralised exchange Uniswap, and the exploiter borrowed at least 20,000 wrapped ether, worth around $44 million, through the decentralised lender Aave using stolen USDT as collateral. Decentralised exchanges and lenders let users trade directly from their wallets without a central exchange processing the transaction, which is precisely why they are attractive to someone trying to move stolen funds quickly — and why the freeze race matters so much in the first hours after a theft.
The market reaction was immediate and broad. CoinDesk reported bitcoin down 4.8 percent to below $77,000, ether down 5.7 percent, BNB down 8 percent and AAVE down 11 percent. In early Asian trading on Friday, Nikkei Asia reported bitcoin down about 2 percent to a six-week low of $77,646 and ether down about 2 percent to a two-month low of $2,238.76, with BNB down more than 8 percent over 24 hours to $694 according to CoinGecko. Shares of Coinbase slid 4.8 percent and shares of bitcoin buyer Strategy fell nearly 6 percent in extended U.S. trading. Crypto liquidations surged to $1.11 billion in the past 24 hours, according to Coinglass data reported by FXStreet, with bitcoin traders shedding $350 million and ether liquidations hitting $252 million, and TradingView reported that 3.13 percent of the total crypto market capitalisation had been wiped out, leaving it at $2.63 trillion.
Binance co-founder Yi He was the company's clearest voice on Thursday night. "Binance will cover all hacking losses," she said, adding in a fuller statement: "Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement. We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates." Zhao, for his part, acknowledged that "the loss might be a bit higher than that" — higher, that is, than the early frozen figures — but added that the company "will cover" the losses.
The security industry was blunt about the record being broken. "This is the biggest crypto hack in history," Ido Ben-Natan, co-founder and chief executive of crypto security firm Blockaid, told CoinDesk. TRM Labs' global head of policy, Ari Redbord, called it the "largest bank heist in human history" on the firm's estimate of more than $6 billion stolen. Taylor Monahan of blockchain security group SEAL 911 put the range more cautiously, saying attackers netted "well over $2 billion" and as much as $5.5 billion, and adding: "Information is changing fast, though, and it will take time to confirm exact" figures.
On attribution, the picture is contested and incomplete. TRM Labs and Pangolin Intelligence said the heist appears to have been conducted by North Korea's TraitorTraitor hacking group, which has been behind many of the largest crypto hacks in recent memory, and investigator ZachXBT and Blockaid also said North Korea was likely behind the hack. That attribution, if confirmed, would fit the pattern of the Bybit theft and of the North Korean IT-worker schemes that U.S. prosecutors have pursued this year — but Binance has not confirmed an attacker, and no law enforcement agency had publicly confirmed the attribution at the time of writing. Readers should treat the North Korea link as a researcher assessment, not an established fact.
Others used the moment to warn about the industry as a whole. "It's becoming very hard to counter hacks as AI can find vulnerabilities faster than you can fix them," said Bernardo Brites, chief executive of Trace Finance, a payments and stablecoin infrastructure company. "My view is that users will move away from smaller and medium-sized exchanges, [it is] becoming too risky to park your money somewhere that couldn't cover a hack of meaningful size." Binance.US, the exchange's separate U.S. arm, said it was not affected by the incident, and Coinbase said it was unaffected and was monitoring the situation.
This hack matters first because of its sheer size. A theft of $5.7 billion to $5.9 billion — or more than $6 billion on the highest estimate — is not just a crypto story; it is, on the figures currently circulating, one of the largest thefts of any kind ever recorded, and it happened in a single evening against the largest platform in the industry. If an exchange of Binance's scale and resources can be drained this quickly, the question every smaller exchange and every retail holder must ask is what, if anything, protects them.
It matters secondly because of what it reveals about how crypto security actually works in a crisis. The industry's defence on Thursday night was not a single company's security team: it was a network of stablecoin issuers, blockchain intelligence firms, rival companies and law enforcement agencies freezing tokens, tracing wallets and sharing information in real time. That network worked fast enough to freeze $3 billion — but it could only freeze the tokens whose issuers have a freeze switch. Bitcoin, ether and other decentralised assets cannot be frozen that way, which is why the attacker immediately began swapping stablecoins for assets that lack central controls.
It matters thirdly for ordinary users, and here the message is mixed but practical. Binance says user funds are safe and that it will cover all losses, and its scale and its SAFU reserve give that promise more weight than a similar promise from a smaller platform would carry. But deposits and withdrawals were suspended, trading on Binance Alpha was paused, and users were warned about scams exploiting the confusion — the classic second wave after any major hack, when fake support messages and phishing links target worried customers. Anyone with funds on any exchange should, for now, rely only on official channels, be sceptical of unsolicited messages, and avoid moving funds in a panic on the basis of unverified social media claims.
The immediate next step is Binance's investigation and its promised post-mortem. The company says withdrawals will resume as soon as the security issue is fully resolved, and that the frozen total could increase as it works with law enforcement, token issuers and blockchain intelligence firms to trace and freeze more assets. Until that post-mortem arrives, the key open questions are the confirmed total stolen, the confirmed mechanism — including whether the hot-wallet and EIP-7702 account is correct — and whether the North Korea attribution is confirmed by investigators.
Markets will give an early verdict on Friday. Bitcoin's slide to a six-week low and ether's to a two-month low in early Asian trading, together with the $1.11 billion in liquidations, show how quickly a security incident at one exchange can become a market-wide event. If Binance restores withdrawals quickly and its loss-coverage promise holds, the damage may be contained; if the investigation drags on, or if more funds prove unrecoverable, the pressure on crypto prices — and on confidence in centralised exchanges — will grow.
Regulators and lawmakers are also likely to take note. The incident comes in a year already marked by major crypto thefts, and it strengthens the hand of those arguing that exchanges holding customer funds at this scale need stronger security, clearer disclosure and credible loss-coverage arrangements. For now, though, this is a developing story: the figures are still moving, the attribution is still contested, and the most important document — Binance's own account of what happened — has not yet been published.
How much was stolen in the Binance hack?
Estimates vary because the incident is still being traced. Arkham put the figure at more than $5.7 billion, Chainalysis at roughly $5.9 billion at the time of the theft, and TRM Labs at more than $6 billion. Binance has not published a confirmed total, and the figures may change as trackers verify which wallets are linked to the attack.
Are Binance user funds safe?
Binance says user funds are completely safe and co-founder Yi He says Binance will cover all hacking losses. Deposits and withdrawals were temporarily suspended while security checks are carried out, and the company says they will resume once the security issue is fully resolved.
How much money has been frozen?
Binance said $3 billion in crypto assets had been frozen in total. That includes nearly $1.57 billion in USDT frozen by Tether, more than $800 million in USDC frozen by Circle, roughly $200 million frozen by Ripple, and funds frozen by World Liberty Financial and BitGo. Binance's verified frozen-stablecoin total stood at $2.54 billion as of around 7:20 p.m. Eastern Time on Thursday.
Who is behind the Binance hack?
Researchers at TRM Labs and Pangolin Intelligence pointed to North Korea's TraitorTraitor hacking group, and investigator ZachXBT and Blockaid also said North Korea was likely behind it. Binance and law enforcement agencies have not confirmed an attacker, so the attribution remains a researcher assessment for now.
Is this the biggest crypto hack ever?
Yes, on current estimates. The previous record was about $1.5 billion stolen from Bybit in February 2025. At $5.7 billion or more, the Binance incident would be roughly four times that size, and Blockaid's chief executive called it the biggest crypto hack in history.
Related coverage on US News Pulse: Robinhood Q3 earnings miss as crypto revenue falls 55% and shares drop, North Korea IT worker scheme: defense contractor pleads guilty in Virginia, and Big Tech earnings test: Alphabet, Amazon and Apple face AI spending verdict.
Leave a Comment
| Today's Date:
