Binance hack: $6.3 billion stolen, $3 billion frozen, withdrawals paused

The Binance hack on 29 October is the largest theft in crypto history. Binance puts the damage at about $6.3 billion, Chainalysis at $6.4 billion and Elliptic at $6.43 billion, more than four times the $1.46 billion taken from Bybit in February 2025. Binance and the stablecoin issuers have frozen about $3 billion. Withdrawals stay paused, and Binance says it will cover the losses in full.

How the night went, hour by hour

All times are UTC.

29 October:

• 20:05: five Binance wallets on the XRP Ledger send 233 million XRP to one attacker address.
• 20:24: the largest single transfer, about $2.53 billion, leaves on Ethereum. Within the next 30 minutes the attacker empties wallets on 11 blockchains, from Bitcoin and Tron to Solana and Polygon.
• 20:58 to 21:01: the attacker deposits 60 million stolen USDT into Aave and borrows 19,762 wrapped ETH, about $44.6 million.
• About 37 minutes after the USDT lands, Tether freezes the main attacker wallet with 1.18 billion USDT inside. Circle freezes 823 million USDC in the same wallet.
• 21:12: CoinDesk reports a possible hack. Co-CEO Yi He writes that Binance is "actively investigating."
• 21:42: Aave starts freezing its markets. By 23:04 it has blocked new deposits and loans in 292 reserves on 20 networks.
• 22:15: Binance halts withdrawals.
• 22:36: World Liberty Financial freezes $27 million in USD1.
• 23:35: Binance says verified frozen assets have reached $2.54 billion. Ripple starts freezing RLUSD five minutes later.

30 October:

• 00:07: Binance suspends deposits too.
• 00:52: frozen assets reach $3 billion. The Arbitrum Security Council locks another $30.5 million.
• 02:25: Binance names the entry point, a compromised laptop of a DevOps engineer.
• 04:17: Yi He says withdrawals should resume within 48 hours. Deposits work again.
• 08:37: Binance reports "additional points of breach" beyond the laptop and says it remains on track to reopen withdrawals.

What Binance says

The exchange says the attacker used the engineer's laptop to reach a service container and submit withdrawal requests the system took for legitimate ones. "We have found no evidence of any wallet private key leak," Binance said. Blockaid chief Ido Ben-Natan reads it the same way and calls it "key misuse" in the signing setup.

Co-CEO Richard Teng described a longer chain of steps than one stolen laptop and said Binance will pay from the SAFU insurance fund and its own money. "Our investigation has not attributed responsibility to any individual," Teng wrote. Yi He promised a full post-mortem once the investigation ends, and Binance plans to publish fresh proof of reserves after it rebuilds the withdrawal service.

“I don't manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered”

— Changpeng Zhao, Binance founder, on X, 29 October 2026, as quoted by The Block, https://www.theblock.co/news/markets/2026-10-29-binance-investigating-hack-suspicious-outflows-5-billion-432171

Who is behind the attack

TRM Labs attributes the hack to TraderTraitor, the North Korean unit of the Lazarus Group, with "high confidence." The FBI earlier tied the same group to Bybit, and Chainalysis CEO Jonathan Levin reached the same conclusion. Investigator ZachXBT found Binance money and proceeds of the September Bitget hack at one address: "This indicates the same actor is likely behind both incidents."

Elliptic is more careful. The overlap is small, about $39,000 of Binance funds next to $510,000 from Bitget, and the laundering runs faster than North Korea usually moves. No government has named the attacker yet.

Other exchanges

Binance.US says customer funds are secure and services run as usual. Coinbase is blocking transfers to the attacker's wallets, and Brian Armstrong offered help: "At times like this, the industry needs to respond together." Bybit CEO Ben Zhou and Gate CEO Han Lin say their platforms were not hit. OKX head Star Xu called the Bybit, Bitget and Binance cases a wake-up call and proposed shared rules: delays on large withdrawals and faster freezing of stolen coins.

The same evening Polymarket stopped trading after a breach at a third-party provider, with losses under $3 million; CoinDesk treats it as a separate incident. On 27 October Bithumb found an intruder in the system its staff use to message each other. Market makers disclosed their exposure to Binance: under 20% of net equity at Wintermute and under 5% at GSR.

Markets

By 01:19 UTC, per CoinGecko, bitcoin had lost 4.9% to about $76,900, ether 5.7% to $2,211 and BNB 8% to $693. AAVE fell 11.3%, and the Fear & Greed index dropped to 30, its lowest since August.

Standard Chartered's Geoffrey Kendrick wrote that the hack could speed the move to decentralised trading, adding: "The decentralized exchange (DEX) has never had any exploits." That same night Aave, the largest DeFi lender, had to freeze its own markets to stop the attacker from borrowing.

Our count

• Binance held about $144 billion before the attack, per DefiLlama. The theft equals 4.4% of that.
• Of $6.3 billion, about $3 billion is frozen. The remaining $3.3 billion matches Elliptic's estimate of assets no issuer can freeze, spread across about 43 addresses.
• The SAFU fund holds about $1 billion in bitcoin. That covers under a third of the unfrozen gap, so most of the bill falls on Binance's own balance sheet.
• Stablecoins made up $3.46 billion of Elliptic's $6.43 billion, or 54%. Tether and Circle froze the largest wallet within the first hour, but about $786 million had already been swapped into ETH and TRX. The 18,270 stolen BTC sit on 19 addresses and have not reached any service yet.

If your coins sit on Binance, mark 04:17 UTC on 1 November, when the 48 hours from Yi He's update run out. Then check whether the proof of reserves comes before withdrawals reopen or after.

This text reports events and is not advice on buying or selling any asset. Figures may still change as the investigation goes on. Timeline from Cointelegraph's live coverage and Elliptic, freeze totals from Binance, Tether and Circle.