Binance’s $6.3 Billion Hack and the Biggest Crypto Heists in History

In roughly 20 minutes on the evening of 29 October 2026, about $6.3 billion in digital assets left the wallets of Binance, the world’s largest cryptocurrency exchange. It is the biggest theft in the history of crypto, more than four times the previous record, and one of the largest thefts of any kind ever recorded.

The story is still unfolding. Here is what is known so far, how it compares with the major hacks that came before it, and what these attacks teach anyone who holds digital assets.

What we know about the Binance hack

  • When and how much. Binance says its hot wallets (the online wallets an exchange uses for day-to-day withdrawals) were compromised at around 20:05 UTC on 29 October. Blockchain analytics firm TRM Labs estimates that about $6.36 billion was moved across 10 blockchains, most of it within about 20 minutes.
  • How it started. Binance initially said the attack may have begun with a compromised engineer’s laptop, which gave the attacker access to internal systems and the ability to submit unauthorised withdrawals. It later said it had found additional points of breach, and that it has seen no evidence that wallet private keys were leaked.
  • Who is suspected. TRM Labs and Chainalysis have linked the attack to TraderTraitor, a North Korean state-backed unit associated with the Lazarus Group. The FBI blamed the same unit for the 2025 Bybit hack. Binance has not attributed responsibility and says its investigation is ongoing.
  • What has been frozen. Binance says about $3 billion of the stolen funds has been frozen on-chain with the help of law enforcement, analytics firms and token issuers. According to Reuters, more than $2.3 billion of that was frozen by stablecoin issuers Tether and Circle.
  • What happens to customers. Binance says it will cover all losses and that user funds are safe. In its update of 31 October, it said it had set aside more than $6.34 billion from its emergency fund (SAFU) and corporate treasury, and that about 80% of the affected assets had already been replenished. Deposits continued to work; withdrawals were paused, with a phased restart targeted for the weekend. The company has promised an updated proof of reserves and a detailed technical report.
  • Market reaction. Bitcoin fell to a six-week low and Binance’s own BNB token dropped about 6% in the first hours, before markets steadied.

The biggest crypto hacks at a glance

[embed: node/e2498e4b-31b5]

The Binance theft is larger than the other nine on this list combined. Two of the ten happened in 2026.

The heists that came before

Amounts are in US dollars at the value of the assets when they were stolen. Different trackers report slightly different figures.

Bybit, February 2025: about $1.5 billion. Until this week, the record. Attackers manipulated the signing process for a transfer from the Dubai-based exchange’s cold wallet, the offline storage that is normally considered the safest place for crypto. The FBI formally attributed the theft to North Korea’s TraderTraitor. Bybit covered customer losses.

Ronin Network, March 2022: about $625 million. Ronin is the blockchain behind the video game Axie Infinity. Attackers took control of enough validator keys, the digital signatures needed to approve transactions, to drain its bridge. The attack was also linked to North Korea’s Lazarus Group.

Poly Network, August 2021: about $611 million. A flaw in the smart contracts of this cross-chain protocol let an attacker take funds on three blockchains. In an unusual twist, the attacker returned almost everything within about two weeks.

BNB Chain bridge, October 2022: about $570 million. Binance’s earlier big incident. An attacker forged messages to the BSC Token Hub bridge and created 2 million BNB tokens out of thin air. Validators halted the network within hours. Binance said only about $100 to $110 million actually left its ecosystem, as the rest was frozen.

Coincheck, January 2018: about $530 million. Hackers stole NEM tokens from the Japanese exchange’s hot wallet. The case pushed Japan to tighten its rules for crypto exchanges.

Mt. Gox, 2011 to 2014: about $450 to $480 million. The original crypto disaster. The Tokyo exchange, which once handled most of the world’s bitcoin trading, revealed in 2014 that around 850,000 bitcoins were missing, and collapsed into bankruptcy. Creditors waited a decade to be partly repaid.

Bitget, September 2026: about $387 million. Just five weeks before the Binance attack, attackers manipulated the exchange’s internal withdrawal process and drained its hot and warm wallets. Chainalysis attributed it to North Korean actors. Bitget said its user protection fund would cover the loss.

Wormhole, February 2022: about $320 million, through a signature-verification bug in a cross-chain bridge. DMM Bitcoin, May 2024: about $305 million in bitcoin, after a private key compromise attributed to North Korea.

Binance has been hit before, too. In 2019 hackers stole more than 7,000 bitcoins, worth about $40 million at the time; the exchange covered the loss from its emergency fund.

What the biggest hacks have in common

The weak point is rarely the blockchain itself. Bitcoin and Ethereum have not been “hacked” in these cases. Attackers went after what surrounds them: exchange wallets, signing systems, bridges between chains, and the people who operate them.

Keys and signatures are the crown jewels. Whoever controls the keys controls the funds. Ronin, Bybit, DMM Bitcoin and, according to early reports, Binance all came down to attackers obtaining or abusing the authority to approve transactions. Chainalysis notes that centralised services are suffering increasingly large losses from this kind of compromise.

Bridges are a magnet. Cross-chain bridges hold large pools of locked assets and rely on complex code. Ronin, Poly Network, the BNB Chain bridge and Wormhole were all bridge attacks.

People are the way in. A compromised laptop, a fake job offer, a malicious software update: the most damaging attacks start with social engineering against employees, not with brute force. Chainalysis reports that North Korean operators increasingly embed fake IT workers inside crypto companies or pose as recruiters and investors to gain privileged access.

One state actor dominates. Chainalysis estimates that North Korea-linked groups stole at least $2.02 billion in 2025, about 60% of all crypto stolen that year, bringing their cumulative total to at least $6.75 billion. If the attribution of the Binance attack is confirmed, 2026 alone would far exceed that.

What it means for anyone holding crypto

None of this is investment advice. But the history of these attacks points to a few practical questions worth asking.

  1. Who holds the keys? On an exchange, the platform holds them for you, and your protection depends on its security and its finances. In a self-custody wallet you hold them, and the responsibility shifts entirely to you. Neither option is risk-free; the point is to know which risk you are taking.
  2. What happens if the platform is hacked? Large exchanges increasingly cover losses from their own reserves, as Bybit, Bitget and now Binance have pledged to do. That is a company decision, not a legal guarantee like a bank deposit scheme. Check whether a platform publishes proof of reserves and has an emergency fund.
  3. Is the platform regulated where you live? In the EU, the MiCA regulation requires crypto-asset service providers to be authorised and to meet custody and security standards. Authorisation doesn’t make hacks impossible, but it sets rules for how customer assets must be protected.
  4. Don’t put everything in one place. Spreading holdings limits the damage any single failure can cause.
  5. Watch out for the scams that follow. After every big hack, fraudsters pose as support staff, “recovery services” or the exchange itself. No legitimate platform will ask for your password, seed phrase or a payment to release your funds.

FAQ

Is the Binance hack the biggest ever? Yes. At about $6.3 billion, it is more than four times the $1.5 billion Bybit theft of 2025, the previous record.

Did Binance customers lose money? Binance says it will cover all losses and that user funds are safe, and it has set aside more than $6.34 billion to do so. As of 31 October 2026, withdrawals were temporarily paused while security checks were completed.

Who was behind it? Blockchain analytics firms TRM Labs and Chainalysis have linked it to North Korea’s TraderTraitor unit. Binance and law enforcement have not yet confirmed attribution.

Can stolen crypto be recovered? Sometimes in part. Stablecoin issuers and some blockchains can freeze tokens, which is how about $3 billion of the Binance haul was blocked. Funds that are quickly swapped and laundered are much harder to trace and recover.

Was Binance hacked before? Yes: about $40 million in bitcoin was stolen in 2019, and in 2022 an exploit of the BNB Chain bridge created about $570 million in tokens, most of which was frozen before it could leave.

This article reflects information available on 31 October 2026 and will be updated as the investigation develops.

Sources

Share this article

Latest