In roughly 20 minutes on the evening of October 29, 2026, billions in cryptocurrency left Binance’s hot wallets and headed to addresses controlled by unknown attackers. The world’s largest crypto exchange has confirmed unauthorized withdrawals totaling about $6.3 billion across ten blockchains, an amount blockchain analysts call the largest cryptocurrency theft on record.
Most of the money moved starting at 20:05 UTC. TRM Labs put the total closer to $6.36 billion when valued at the moment of transfer. Ethereum carried the heaviest load at roughly $3.79 billion, followed by about 18,270 bitcoin worth $1.47 billion, hundreds of millions more on Tron and the XRP Ledger, and smaller sums on Solana and several other networks. The scale dwarfs the previous record, the $1.5 billion Bybit theft in February 2025.
Binance’s early investigation pointed to a compromised DevOps engineer’s laptop that gave attackers access to internal systems used to authorize withdrawals. On Ethereum, the attackers exploited a feature known as EIP-7702 that lets a wallet temporarily hand control to smart-contract code. That turned one of the exchange’s operational wallets into a tool that swept funds outward. On other chains, valid signatures for ordinary transfers appeared in a short window, suggesting the signing systems themselves had been compromised. Binance has said it found no evidence that private keys were leaked.
Blockchain intelligence firms TRM Labs, Chainalysis, and Elliptic have attributed the operation with high confidence to TraderTraitor, a North Korea-linked group previously tied by the FBI to the Bybit attack. The firms cite matching on-chain patterns, preparation that began at least 36 hours earlier, and links to earlier attributed activity. Binance has not named any perpetrator while its investigation continues. North Korean responsibility remains an expert assessment, not a public finding by law enforcement in this case.
Roughly $3 billion of the stolen assets has been frozen through cooperation with Tether, Circle, Ripple, and other partners. Freezing stops the tokens from moving further; it does not automatically return them. Attackers still control a large portion of harder-to-restrict assets, mainly bitcoin and ether.
Binance suspended withdrawals while it locked down systems and has stressed that customer deposits were not touched. The company has set aside more than $6.34 billion from its Secure Asset Fund for Users and corporate reserves to cover the full amount and has promised an updated proof-of-reserves report. Deposits continued operating.
The speed and size of the theft have renewed questions about how even the largest exchanges protect the systems that authorize withdrawals. For American investors who hold crypto on centralized platforms, the episode underscores both the industry’s ability to freeze certain assets quickly and the limits of that protection when attackers move first. The investigation remains active, and a fuller technical accounting is still to come.
