Hackers Stole $6.3 Billion From Binance in 20 Minutes. Here’s How

Hackers stole approximately $6.3 billion in cryptocurrency from wallets operated by Binance, the world’s largest cryptocurrency exchange. Most of the money moved within around 20 minutes, in what blockchain researchers describe as the largest cryptocurrency theft on record.

The attack happened on October 29, 2026, when funds began leaving Binance-controlled wallets across multiple blockchain networks. But the most important question is not simply how quickly the money disappeared. It is how attackers managed to make the exchange’s own systems authorise transactions they were never supposed to approve.

Binance’s initial investigation pointed to a potentially compromised laptop belonging to a DevOps engineer. The exchange later said investigators had found additional points of breach. Meanwhile, blockchain intelligence firm TRM Labs identified evidence suggesting that attackers had compromised the infrastructure used to approve transactions.

Binance says it will cover the financial impact through its Secure Asset Fund for Users (SAFU) and company funds. It has also reported that approximately $3 billion in affected assets have been frozen on-chain.

The investigation remains ongoing. Binance has promised a detailed technical report, but its October 31 update did not include a completed post-mortem.

How the $6.3 billion theft unfolded

The incident began on October 29, when large amounts of cryptocurrency started moving out of Binance wallets.

According to TRM Labs’ investigation, an attacker transferred approximately $6.36 billion in assets from Binance wallets across ten blockchain networks. These included Bitcoin, Ethereum, Tron, Solana, the XRP Ledger, Avalanche, Polygon, Arbitrum, Optimism and Base.

Most of the money moved within roughly 20 minutes, beginning at around 20:05 UTC. TRM also identified a later wave of transfers, meaning the entire incident did not end within that initial period.

The stolen assets included different cryptocurrencies and tokens. Several Binance wallets sent funds to addresses controlled by the attacker, with the transfers taking place across multiple networks.

TRM valued the transferred assets at approximately $6.36 billion using prices at the time of the theft. At the prices used in its later calculation, those same assets were worth about $6.23 billion. The difference shows why reported cryptocurrency theft values can change as market prices move.

The scale was far greater than the February 2025 Bybit theft, in which approximately $1.5 billion was stolen. The Binance incident therefore represents a much larger reported loss.

The first suspected entry point was a compromised laptop

Binance’s first public explanation, published on October 30, pointed to a possible compromise involving a DevOps engineer’s laptop.

DevOps refers to the people and systems responsible for building, maintaining and operating software. Their work can involve access to internal services, deployment tools and the technical environments that keep a platform running.

In its initial security incident update, Binance said the compromised laptop may have allowed an attacker to access a service container and submit unauthorised withdrawal transactions.

A service container is an isolated environment in which an application or part of a service runs. Think of it as a separate workspace inside a larger computer system. If an attacker gains access to the wrong environment, they may be able to interact with services that should not be under their control.

However, Binance’s next update changed the picture.

In its second incident update, the exchange said its initial investigation had suggested a compromised laptop, but subsequent work had uncovered additional points of breach. It also said it had found no evidence that wallet private keys had been leaked.

This distinction matters. The laptop remains a possible entry point, but Binance has not publicly established that it explains the entire attack.

The exchange has also not published a complete account of how the attackers moved from any initial access to the systems that authorised the withdrawals.

How attackers reportedly bypassed Binance’s transaction security

The most detailed technical explanation so far comes from TRM Labs.

Its analysis points to a compromise of Binance’s hot-wallet signing infrastructure. A hot wallet is a cryptocurrency wallet connected to systems that can access the internet, allowing an exchange to process transactions without the delays associated with keeping all funds offline.

The signing system is responsible for authorising transactions. It is therefore an important part of the security process protecting the money held in a wallet.

Consider a bank vault. The private key is similar to the key that gives access to the vault. But there is also a process for deciding which withdrawals should be approved. If an attacker compromises that approval process, the system may authorise transfers that the organisation never intended.

That is the distinction at the centre of the Binance incident.

According to TRM, the attacker used an Ethereum feature known as EIP-7702 to change how one Binance hot wallet operated.

EIP-7702 was introduced as part of Ethereum’s Pectra upgrade in May 2025. It allows an ordinary Ethereum account to use code from a smart contract through a signed authorisation.

A smart contract is software stored on a blockchain that carries out instructions when called. EIP-7702 can make ordinary wallets more flexible, but it also means that authorisations must be handled carefully. The feature itself is not a security vulnerability; the risk depends on how an authorisation is obtained and used.

TRM says the attacker prepared 50 signed authorisations in advance. These were designed around the wallet’s transaction sequence, increasing the chance that an authorisation would remain valid when the attacker’s transaction was processed.

One authorisation matched. According to TRM, this allowed the wallet to run a contract controlled by the attacker.

The contract acted like a sweeper: software that automatically moves funds from a wallet to another address. TRM says the attacker used it to drain the wallet and move additional funds that arrived later.

This is more specific than saying that someone simply stole a password or guessed a wallet key. The reported method involved a valid authorisation being used to make a wallet execute code controlled by the attacker.

However, this technical sequence comes from TRM Labs’ blockchain analysis. Binance has not yet confirmed every detail in a published technical post-mortem.

For background on the Ethereum feature, see the official EIP-7702 explanation.

Why the attack affected multiple blockchains

Binance operates wallets across several blockchain networks because it supports many different cryptocurrencies and tokens.

A blockchain is a digital record of transactions maintained by a network of computers. Different cryptocurrencies can operate on different blockchains, each with its own rules and transaction systems.

The attacker did not rely on a single Ethereum transaction to take all the funds.

TRM found that wallets on the other nine networks also sent funds through signed transfers during the incident. This is why the firm believes the theft points to a wider compromise of Binance’s hot-wallet signing infrastructure, rather than a problem limited to one Ethereum wallet.

The difference is important. A weakness affecting one wallet may be contained within a relatively small part of an exchange. A compromise that reaches transaction-authorisation processes across several networks raises broader questions about how the exchange separates and protects its systems.

Binance says it has contained the compromised infrastructure, revoked affected authorisations and introduced additional security controls. Its full explanation of how the different systems were compromised remains pending.

Who is behind the Binance attack?

Binance has not publicly identified the attackers.

However, TRM Labs attributes the incident to TraderTraitor, a North Korean state-linked hacking group. The company says its assessment is based on on-chain and off-chain intelligence and that it has high confidence in the attribution.

TRM identified similarities with previous attacks attributed to North Korean hackers, including the February 2025 Bybit theft. These similarities include preparations before the theft and the use of pre-signed authorisations.

This is an important intelligence assessment, but it should not be presented as a confirmed finding by law enforcement.

Reuters reported that the FBI was aware of the incident and was working with public- and private-sector partners to understand its scope, assess possible impacts and coordinate investigative steps. Binance was also cooperating with international law enforcement, including the FBI and US Secret Service.

The FBI’s reported involvement does not confirm that North Korea carried out the attack.

For now, the attribution remains TRM Labs’ assessment. Binance says it is working with law enforcement to establish who was responsible.

Why some stolen cryptocurrency can be frozen

After the transfers, blockchain investigators and cryptocurrency companies began tracing the stolen funds. Some of the assets could also be frozen, but this depends on the type of cryptocurrency involved.

Certain stablecoins, including Tether’s USDT and Circle’s USDC, are issued by companies that can freeze tokens at specific blockchain addresses. This allows an issuer to restrict the movement of funds when it identifies an address linked to theft or other serious incidents.

Bitcoin and Ether work differently.

Neither has a central issuing company that can freeze an individual’s coins. Once transferred, these assets cannot simply be disabled by a company in the same way as certain centrally issued stablecoins.

They can still be traced. Exchanges and other services may also restrict funds if they reach platforms that are able and willing to intervene. But identifying where cryptocurrency has gone does not automatically give investigators control over it.

According to TRM Labs, Tether, Circle, Ripple and World Liberty Financial froze approximately $2.67 billion in stablecoins. Arbitrum’s Security Council also took emergency action to freeze 8,426 ETH and 74.6 million ARB on its network.

TRM estimated that approximately $2.4 billion in Bitcoin and Ether remained beyond the direct freezing power of token issuers at the time of its analysis.

Binance’s October 31 update reported that approximately $3 billion had been frozen on-chain. The figures come from different reporting snapshots and methods, so they should not be treated as a final recovery total.

Frozen funds are not necessarily recovered funds. A freeze can restrict what an attacker can do with an asset, but it does not automatically return the money to Binance or its customers.

How investigators follow the stolen money

Cryptocurrency transactions are recorded on public blockchains. This means investigators can often see funds moving between addresses, even when they do not know who controls those addresses.

Blockchain analysis companies use this information to follow transfers, identify connections between wallets and flag addresses associated with suspicious activity.

However, following the money can become difficult when attackers move funds through many addresses, exchange one cryptocurrency for another or use services designed to make transaction links harder to establish.

TRM reported that preparations for the theft began at least 36 hours before the main transfers. Its analysis identified small withdrawals from Tornado Cash, code testing and rehearsals before the attack.

It also described a technique known as a peel chain. In simple terms, this involves moving funds through a series of transactions. Part of the money is sent onward while other amounts are left in separate addresses, creating a more complicated trail for investigators to follow.

TRM’s analysis also describes repeated movements and transaction activity consistent with automated preparation and fund movement. These patterns can make it harder to identify where the assets ultimately go, but they do not make public blockchain transactions invisible.

Binance says customers will not bear the loss

Binance has said it will cover the stolen assets through its Secure Asset Fund for Users, known as SAFU, and its own company funds.

In its October 31 update, the exchange said it had set aside more than $6.34 billion. It reported that more than $5 billion was already held in the same token assets affected by the theft, including USDC, USDT, Bitcoin, Ether and BNB. It said it was acquiring the remaining assets through market and over-the-counter transactions.

The exchange also said approximately $3 billion in affected assets had been frozen with help from law enforcement, blockchain intelligence firms, token issuers and other industry partners.

These are significant commitments, but two separate issues must be understood.

Replacing the value of stolen assets with company funds is not the same as recovering the original cryptocurrency from the attacker. Binance says it will cover the financial impact for users, while efforts to trace and recover the stolen assets continue.

The exchange also said it had contained the compromised infrastructure, revoked affected authorisations and temporarily suspended withdrawals while carrying out further security checks. Deposits and other unaffected services remained operational.

In its October 31 statement, Binance said it was aiming to restore withdrawals within approximately 34 hours, subject to security checks. It said the process would happen in phases, token by token. This was a target, not confirmation that withdrawals had resumed.

Binance also said it planned to publish an initial Proof of Reserves snapshot by November 2, 2026. A Proof of Reserves report can help users examine an exchange’s reported assets against customer balances. However, it is not a substitute for a detailed explanation of how an attacker reached the systems responsible for authorising withdrawals.

The exchange promised further technical findings within approximately 48 hours, provided they could be verified and their disclosure would not interfere with the investigation. It also committed to publishing a detailed technical post-mortem explaining what happened, the lessons learned and the additional safeguards being introduced. The completed report was not included in the October 31 update.

What the Binance attack means for cryptocurrency security

The theft raises a question that goes beyond one exchange: how much protection do cryptocurrency platforms need around the systems that approve transactions?

Keeping private keys secure is essential, but this incident shows why security cannot stop there.

Employee devices, internal software, service environments and transaction-approval processes can also become targets. If attackers can influence the system that authorises transfers, protecting the private key alone may not be enough.

For exchanges, the incident highlights the importance of separating signing systems from ordinary operational environments, limiting access, monitoring unusual authorisations and requiring independent checks before large withdrawals are approved.

For customers, Binance says it will cover the financial impact of the incident. Users should follow the exchange’s official updates rather than messages or social media accounts promising to recover stolen funds. Major security incidents can also create opportunities for impersonation and recovery scams.

The wider question is whether cryptocurrency exchanges can demonstrate that the systems behind their wallets are as secure as the assets they hold.

The investigation is not over

The Binance incident is not simply a story about $6.3 billion disappearing in 20 minutes. It is a warning about the infrastructure that allows digital assets to move.

TRM Labs has published a detailed account of how an attacker may have used pre-signed authorisations and compromised transaction-signing systems. Binance, meanwhile, says its investigation uncovered additional points of breach and that it has found no evidence of leaked wallet private keys.

The exchange has promised to cover the financial impact for users, while blockchain firms and law enforcement continue efforts to trace the stolen assets.

But important questions remain. How did the attackers reach the signing infrastructure? What were the additional points of breach? Have withdrawals been fully restored? And what changes will prevent a similar attack?

As of Binance’s October 31 update, the exchange had not published its completed technical post-mortem or confirmed that withdrawals had resumed. The company had reported approximately $3 billion frozen on-chain, but that figure should not be confused with the amount recovered.

Until Binance publishes its full technical report and investigators establish who was responsible, the complete story remains unfinished.