This Binance hack explained guide covers the biggest crypto theft in history: on Thursday, October 29, 2026, attackers drained roughly $6.3 billion from Binance, the world’s largest crypto exchange, in about 20 minutes. Below is what happened, how the attackers pulled it off, who investigators blame, and the honest answer to the only question most people care about — is your money safe?
In this article
The short answer: hackers got into Binance’s internal systems — the exchange’s early findings point to a compromised employee laptop — and hijacked at least one major wallet using an Ethereum feature called EIP-7702, turning it into an automatic “sweeper” that forwarded funds to the attackers. Binance says customer losses will be covered in full. About $3 billion of the stolen crypto has already been frozen by stablecoin issuers. Withdrawals were paused while the exchange finishes security checks. Figures in this article are as reported on October 30–31, 2026, and may change as the investigation continues.
What happened: the 20-minute drain
The attack did not start on Thursday. Investigators at TRM Labs found small, discreet withdrawals in the roughly 36 hours before the main event — most likely rehearsals to test whether anyone was watching.
Then, on Thursday evening, the real drain began. Bitcoin, Ether, USDT, USDC, Solana and a long list of smaller tokens poured out of Binance’s hot wallets — the wallets an exchange keeps loaded to process customer withdrawals — across several blockchains at once. The whole burst lasted about 20 minutes.
The wallets hit were not random. They included the wallets known as “Binance 14” and “Binance 16” — the same wallets Binance lists in its monthly proof-of-reserves report as the assets backing customer balances. At one point, wallets linked to the attacker held more than $5.7 billion of the stolen crypto, including nearly $1.5 billion in Bitcoin alone, according to blockchain data firm Arkham.
| When | What happened |
|---|---|
| ~36 hours before | Small test withdrawals from Binance wallets — believed to be rehearsals |
| Thursday, Oct 29 (evening) | Main drain: about $6.3 billion leaves Binance hot wallets in ~20 minutes |
| Thursday night | Binance pauses withdrawals (deposits stay open); says user funds are safe |
| Within hours | Tether, Circle and other partners freeze roughly $3 billion of the stolen funds |
| Friday, Oct 30 | Binance sets aside $6.34 billion+ of company money to cover losses |
| November 1 | Next proof-of-reserves snapshot — will show whether stolen assets were replaced |
Estimates of the exact amount stolen vary between firms — Chainalysis put it near $5.9 billion at the time of the theft, TRM Labs near $6.36 billion — but every estimate makes this the largest crypto hack ever recorded. Reporting from CoinDesk and TRM Labs forms the backbone of what is publicly known so far.
How the hack worked
Two weaknesses appear to have combined. Neither involved breaking Bitcoin’s or Ethereum’s cryptography — the blockchains themselves were never the problem.
1. A compromised laptop. Binance’s initial investigation pointed to a DevOps engineer’s laptop. From there, the attackers allegedly reached a service container inside Binance’s systems and submitted unauthorized withdrawal transactions. Binance has said it found no evidence that any wallet private keys leaked.
2. A hijacked wallet. On Ethereum, the attacker used EIP-7702 — a feature that lets a wallet delegate control to a piece of software. Once Binance 14’s key signed that delegation, the wallet itself became a sweeper: any funds landing in it were forwarded straight to the attacker’s address. Etherscan records show 167,464 ETH leaving Binance 14 this way, plus a further 28,005.6 ETH from Binance 16.
It is the automation that made the damage so fast. A human moving funds by hand could never empty wallets on several chains in 20 minutes; a script could. It is the same double edge businesses see with automation generally — systems that work while you sleep also fail at machine speed when a single instruction goes wrong, which is why the controls around them matter as much as the tools themselves (we see the same pattern in how AI agents save small businesses time when they are set up with the right limits).
The attacker did try to move some of the loot through decentralized platforms — swapping on Uniswap and using stolen USDT as collateral on the lending platform Aave to borrow wrapped Ether. But decentralized rails are also transparent rails: every move is public, which is part of why so much of the haul could be frozen so quickly.
Who is behind it?
Blockchain analysis firms Chainalysis and TRM Labs have linked the attack to North Korea’s state hacking operation — TRM names the unit known as TraderTraitor — with high confidence. Independent investigators, including the on-chain analyst ZachXBT and security firm Blockaid, reached the same conclusion. The rehearsals, the speed, and the willingness to hit the biggest target in the industry all match that group’s previous record thefts. Attribution in cases like this is an assessment, not a courtroom verdict, but the agreement across independent firms is unusually strong.
Is your money safe on Binance?
Binance’s position is clear: co-CEO Yi He said the exchange will cover all hacking losses, and on Friday the company said it has set aside more than $6.34 billion in company resources to restore customer balances — $5 billion of it already held in the exact tokens that were affected. Behind that sits the SAFU emergency fund, which holds around $1 billion in Bitcoin.
About $3 billion of the stolen funds were frozen by industry partners: Tether’s CEO said more than 1.567 billion USDT was frozen, and Circle’s USDC freeze was put at around $823 million. Frozen stablecoins cannot be spent, swapped, or cashed out.
One honest caveat, because it matters. The stolen wallets were Binance’s reserve wallets — the ones backing customer deposits. On October 1, Binance’s reserves covered customer Ether at exactly 100%, and the roughly 204,500 ETH taken is about 5.6% of its Ether reserves, which would leave ETH backing near 94% until it is topped back up, as CoinDesk’s review of the reserve data shows. Binance says it is already buying assets to close the gap. The November 1 proof-of-reserves snapshot is the first public check of whether that actually happened.
Withdrawals remain paused while Binance completes its security checks — the exchange indicated a window of roughly 45–48 hours — while deposits have stayed open.
How to protect your own crypto
You cannot control an exchange’s security. You can control how much of your money depends on it:
- Keep long-term holdings in your own wallet. An exchange account is a promise; a hardware wallet is possession. Move anything you are not actively trading.
- Turn on withdrawal address allowlisting. Most exchanges let you lock withdrawals to addresses you approve in advance, with a waiting period for new ones.
- Use an authenticator app or security key for two-factor authentication — not SMS codes, which can be hijacked with a SIM swap.
- Never sign wallet permissions you do not understand. This hack abused a delegation feature. The same trick is used in small-scale phishing against ordinary users every day.
- Split what stays on exchanges. If one platform freezes withdrawals, you still have access to the rest.
What happens next
Three things to watch. First, whether withdrawals reopen on the timeline Binance indicated, without new restrictions. Second, the November 1 proof-of-reserves report — specifically whether the Ether and stablecoin backing ratios are back at or above 100%. Third, the recovery process for the frozen funds: freezing is fast, but legal recovery of stolen crypto has historically taken years, not weeks, as USA Today’s coverage of the fallout notes.
The bigger lesson is not really about Binance. The largest exchange in the world, with one of the largest security budgets in the industry, appears to have been undone by one employee’s laptop and a wallet feature most users have never heard of. In crypto, the weakest link is rarely the blockchain. It is everything around it.
Frequently asked questions
How much was stolen in the Binance hack?
Estimates range from about $5.9 billion (Chainalysis) to $6.36 billion (TRM Labs); Binance’s own figure is around $6.3 billion, moved out of its hot wallets in roughly 20 minutes on October 29, 2026. By any of these measures it is the largest crypto theft on record.
Will Binance users lose their money?
Binance says no. The exchange has said it will cover all hacking losses and has set aside more than $6.34 billion of company resources to restore balances. Customer balances are expected to be honored in full.
Who hacked Binance?
Chainalysis, TRM Labs and independent investigators attribute the attack to North Korea’s state-backed hacking unit known as TraderTraitor, with high confidence, based on the methods, rehearsals and laundering patterns.
When will Binance withdrawals reopen?
Binance paused withdrawals after the attack and indicated they could resume roughly 45–48 hours later, once security checks are complete. Deposits remained open throughout. Check Binance’s official channels for the current status, as timings may change.
Keep reading
More explainers and guides from Dear Thoughts:
- How NVIDIA Microduck Learns to Walk: Inside Its Open-Source Training Stack
- Top 10 AI Tools That Will Replace Hours of Manual Work in 2026
- Best AI Chatbot in 2026: ChatGPT vs Claude vs Gemini
Article updates
- October 31, 2026 — Article published. This is a developing story: figures are estimates reported by Binance, CoinDesk, TRM Labs and Chainalysis on October 30–31, 2026, and may be revised as the investigation continues.
