The Largest Crypto Heist in History: Inside the $6.3 Billion Binance Hack

On the night of October 29, 2026, the world’s largest cryptocurrency exchange, Binance, was hit by what is now confirmed as the largest crypto theft in history. Attackers drained the exchange’s hot wallets across 10 blockchains in roughly 20 minutes, stealing an estimated $6.3 billion in digital assets.

The main burst of transfers began at approximately 20:05 UTC and most funds were moved within about 20 minutes, with a further wave reaching Avalanche and Polygon later that evening. The total attack window lasted just under four hours.

The biggest single transaction hit Ethereum’s main victim wallet: Binance 14 (0x28C6c062…bf21d60) at 20:24:23 UTC, sweeping 167,464 ETH plus 63 other tokens, including 1.615 billion USDT. A second wallet, Binance 16, transferred an additional 28,006 ETH less than a minute later.

The Numbers: How Much Was Stolen?

The total amount is estimated to be around $6.5 Billion (USD) worth of crypto, including Bitcoin, Ether, XRP, SOL, TRX and stablecoins like USDT and USDC.

Asset	Amount	Estimated Value
Bitcoin (BTC)	18,270 BTC	~$1.47 billion
Ethereum (ETH) + ERC-20 tokens	200,630 ETH + multiple tokens	~$3.79 billion
Tether (USDT) on Tron	612.7 million USDT	Part of $628M Tron outflows
XRP	233.46 million XRP	~$296 million
Solana (SOL)	970,500 SOL	~$96 million
TRX	46.4 million TRX	Included in Tron outflows

The 10 affected blockchains were: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Avalanche, Arbitrum, Optimism, Base, and Polygon.

How the Hack Worked

Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions. However, co-CEO Richard Teng later clarified that the attack was far more complex:

“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.”

Key technical details that emerged:

EIP-7702 delegation exploit: On Ethereum, the attacker used EIP-7702 delegation to a custom sweeper contract, along with “nonce spraying” to bypass verification.
50 Ethereum authorizations were identified in a single transaction targeting Binance 14 (per Blockaid).
Self-destruct mechanism: Teng revealed the attacker used a “self-destruct mechanism” to destroy tooling and traces as it went.
Multiple breach points: Binance later revealed “additional points of breach” beyond the initial laptop compromise.
No private key leak: Binance confirmed it found “no evidence of any wallet private key leak from wallets.”
Pre-prepared signatures: TRM Labs noted that transaction signatures were obtained in advance, with preparations made well before the theft.

Notably, on October 27, just two days before the hack, Binance had disclosed that it blocked North Korea-linked attacks using fake job interviews, a known social engineering tactic.

Who Was Behind It?

Multiple blockchain intelligence firms attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit linked to the Lazarus Group:

TRM Labs attributed the attack with “high confidence” based on on-chain and off-chain intelligence, noting shared characteristics with previous North Korea-linked incidents.
Chainalysis confirmed the attribution, with CEO Jonathan Levin posting: “DPRK are up to their old tricks.”
ZachXBT, the independent blockchain investigator, described the attacker as “likely Lazarus.”
Check Point confirmed the unit is also known as the Lazarus Group.

However, Binance has not publicly named a culprit, and no government has formally attributed the attack yet. The next signal is likely to come from the US government, which formally named TraderTraitor after the 2025 Bybit hack.

Who is TraderTraitor? The name originated in an April 2022 joint advisory by the FBI, CISA, and the US Treasury Department. It refers to a cluster of North Korean state-sponsored cyber activity targeting the cryptocurrency industry. The group operates from North Korea’s Reconnaissance General Bureau, a military intelligence agency. Different security vendors track the same activity under different names: Jade Sleet (Microsoft), UNC4899 (Google), Slow Pisces (Palo Alto Networks), and APT38.

The FBI previously identified TraderTraitor as responsible for the $1.5 billion Bybit hack in February 2025. Chainalysis also spotted funds from September’s Bitget exploit commingling with the Binance loot, suggesting a pattern of ongoing operations.

The Recovery Effort

As of October 30, approximately $3 billion in stolen assets had been frozen on-chain:

Entity	Amount Frozen
Tether (USDT)	~$1.567 billion
Circle (USDC)	~$800–823 million
Ripple	Contributed
World Liberty Financial	Contributed
Arbitrum Security Council	Contributed

The remaining ~$3.3 billion is still being tracked. Analysts noted the attack used “never-seen-before” laundering patterns, making recovery more challenging than typical crypto thefts. Some of the funds were locked in AAVE protocols using ETH borrowings, which is one of the DEFI operations that allow putting collateral in stablecoins like USDT or USDC to take out liquid ETH in return. That amount is under $100 million at the time of writing.

The US Secret Service confirmed it is helping to track the stolen funds.

Impact on Customers

Binance took immediate action to protect its users:

All deposits and withdrawals suspended while the exchange overhauled its withdrawal security systems.
Deposits continued to operate normally (per co-founder Yi He).
Binance pledged to cover ALL losses through its SAFU fund (worth approximately $1–1.2 billion) and company reserves.
The exchange reserved $6.34 billion in its own funds to restore customer balances, separate from the $3 billion frozen by partners.
No cyber insurance was in place, meaning the full financial burden falls on the exchange.
Withdrawals were expected to resume within 48 hours.

Binance stated: “These figures do not include frozen or protected assets. Currently, $3 billion has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets. We will continue to use company resources to cover confirmed shortfall… Ultimately, all user funds will be verified publicly through our Proof of Reserves.”

Solvency Concerns

Despite the scale of the theft, analysts were relatively calm about Binance’s financial health:

Sean Farrell at Fundstrat Global Advisors said the breach “does not currently appear to pose a significant solvency risk for Binance.”
However, CoinDesk noted that Binance 14 appeared in the exchange’s October 1 Proof of Reserves, meaning the stolen crypto was part of the assets backing customer balances. This left Ethereum backing estimated at ~94% and several other assets below 100% until the exchange replaces what was stolen.

Market Reaction

The hack sent shockwaves through crypto and broader markets:

Bitcoin fell to a six-week low of ~$76,000 (down ~3%).
Ethereum dropped more than 3% to ~$2,186.
Coinbase Global shares slid 4.8%.
Strategy (formerly MicroStrategy) fell nearly 6% in extended US trading.
Wall Street closed sharply lower, with the hack compounding existing AI cash-burn concerns.

Historical Context

The Binance hack dwarfs every previous crypto heist:

Incident	Amount	Date
Binance	~$6.3 billion	October 29, 2026
Bybit	~$1.5 billion	February 21, 2025
Mt. Gox	~$460 million	2014

Both the Bybit and Binance hacks have been attributed to TraderTraitor, underscoring North Korea’s escalating role in crypto theft as the regime seeks to circumvent international sanctions.

The full list of all major crypto hacks to date is available in this post.

What Happens Next

Law enforcement attribution: The US government (FBI, Secret Service) is expected to issue a formal attribution, similar to what happened after the Bybit hack.
Fund recovery: Ongoing efforts to trace and freeze the remaining ~$3.3 billion.
Technical post-mortem: Binance promised a detailed technical analysis once the investigation is complete.
Proof of Reserves: Binance committed to publicly verifying all user funds.
Regulatory scrutiny: The hack is likely to intensify calls for stronger regulation of crypto exchanges, particularly around hot wallet security and insider threat mitigation.

☝Disclaimer: This article reflects information available as of October 30, 2026. Details may be updated as the investigation continues.

Stay informed and level up your crypto strategy

Sign Up for the Crypto Corner Newsletter and join 10,000+ users to receive my monthly updates and market analysis and keep up to date with the latest releases and developments in the crypto arena.