Last updated: November 1, 2026. This is a fast-moving story, and details may change as Binance and law enforcement release more information.

The short version

  • On or about October 29, 2026, attackers drained roughly $6.3 billion in crypto from Binance wallets, making it the largest cryptocurrency theft on record, according to CNBC and blockchain analytics firms.

  • About $3 billion was frozen on-chain with help from stablecoin issuers and other partners.

  • On Saturday, the FBI said North Korea was responsible, attributing the theft to the group it tracks as TraderTraitor, per CBS News.

  • Binance says it will absorb the losses, not its users, and began a phased resumption of withdrawals on Sunday, November 1.

  • Binance has said deposits were unaffected. Its investigation is ongoing, and it has promised a full technical post-mortem.

What happened at Binance

Binance is the world’s largest cryptocurrency exchange. On October 29, 2026, an attacker moved roughly $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes, according to blockchain intelligence firm TRM Labs (reported by CBC News).

Binance publicly flagged a “potential security issue” and suspended withdrawals while it investigated. Binance co-CEO Richard Teng later confirmed that the exchange’s own hot wallet was affected. He explained that the vast majority of user assets sit in offline cold storage and are only moved into a hot wallet when users withdraw, as reported by PBS NewsHour and the Associated Press.

The initial explanation involved a compromised laptop, reportedly belonging to a DevOps engineer. Binance then said further investigation had uncovered additional points of breach beyond that laptop, though it has not said publicly what they are. Teng added that the attack was not the work of a single person and that the attackers used a self-destruct mechanism that makes the investigation harder.

Timeline

When

What happened

About Oct 27–28

TRM Labs says preparation began at least 36 hours before the theft, with attackers funding wallets through the Tornado Cash mixer

Oct 29

Roughly $6.3B+ drained from Binance wallets in about 20 minutes

Oct 29–30

Binance flags a security issue, suspends withdrawals, and works with partners to freeze funds. Circle, Tether and Ripple freeze tied assets; Tether’s CEO said more than $1.5B of USDT was frozen

Oct 30

Binance confirms about $6.3B in client assets were affected and says it will cover losses. Bitcoin falls more than 4%

Oct 31

FBI attributes the theft to North Korea (TraderTraitor). Binance says it set aside more than $6.34B of company funds

Nov 1

Binance begins phased withdrawal resumption, starting with major assets such as Bitcoin and Ethereum

Who is behind it?

TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-linked hacking unit. Chainalysis also assessed that group was likely responsible and said it saw funds from a separate recent exploit commingling with funds stolen from Binance (The Hacker News). The FBI then publicly confirmed the attribution.

The same group was blamed by the FBI for the roughly $1.5 billion Bybit hack in February 2025. TRM pointed to shared tradecraft: small Tornado Cash withdrawals to fund an operator wallet, staging well before the theft, and pre-obtained signatures executed in one burst.

The FBI says the attackers are converting the stolen assets into Ethereum and expects further laundering through decentralized finance and instant-swap services.

Is my money safe?

Based on what Binance has said so far:

  • Binance says it will cover the losses. It has reported setting aside more than $6.34 billion in company funds and has said it restored backing for most of the affected assets. Reports differ on the exact share (roughly 90% to 95%).

  • Deposits were reportedly unaffected.

  • Solvency does not appear to be at immediate risk, according to an analyst quoted by CNBC, though one report noted that net outflows after withdrawals reopened were large, so conditions can change.

  • No source reviewed says user passwords or personal data were stolen. Binance’s investigation is still open, so that could change. Treat any official update as the authority, not social media rumors.

What to do if you used Binance

You do not need to panic, but you should act deliberately.

  1. Check your balances and transaction history. Log in only through the official app or by typing the address yourself. Look for withdrawals or API activity you do not recognize.

  2. Secure your login now, even if nothing looks wrong. Change your password (unique, from a password manager), and move 2FA to an authenticator app or a hardware security key instead of SMS.

  3. Review API keys and connected devices. Delete API keys you do not actively use, restrict the rest by IP address, and remove withdrawal permissions unless you truly need them. Sign out of unfamiliar devices.

  4. Turn on withdrawal address whitelisting and an anti-phishing code. Both make it harder for an attacker, or a scam email, to redirect your funds.

  5. Expect phishing. Big security incidents reliably trigger fake “withdrawal resumption,” “compensation claim,” and “account verification” messages. Binance will not ask for your password, 2FA codes, or seed phrase. Do not click links in emails, texts or social media DMs. Go to the official app instead.

  6. Ignore “fund recovery” services. Anyone who contacts you offering to recover stolen crypto for a fee is almost certainly running a second scam.

  7. Keep records. Screenshot balances and save official notices in case you need to document anything later.

  8. If you lose money or are targeted by a scam, contact Binance support through the official app, and report it to the FBI’s Internet Crime Complaint Center (IC3.gov) or the equivalent agency where you live.

Protect your identity, not just your coins

Exchanges hold sensitive know-your-customer data such as ID documents and addresses. There is no confirmation that this data was exposed in this incident, but it is smart to prepare. Consider placing a credit freeze with the major credit bureaus (Experian, Equifax and TransUnion), enabling credit monitoring and alerts, and staying alert for phishing that uses your real name or account details.

How to avoid losing crypto in an exchange hack

No exchange is immune. Even a well-resourced platform with cold storage was breached, and security experts quoted by CNBC and PBS expect more incidents, including ones that exploit AI-assisted attacks. You cannot control an exchange’s security, but you can control your exposure.

  • Do not keep long-term holdings on an exchange. Treat exchanges as a place to trade. Move funds you plan to hold into self-custody with a hardware wallet, and keep your seed phrase offline.

  • Spread your risk. Avoid keeping everything with a single custodian.

  • Use phishing-resistant authentication. Hardware security keys or passkeys beat SMS codes, which can be intercepted through SIM-swapping.

  • Use unique passwords everywhere. A password manager makes this practical.

  • Lock down API access. Grant the minimum permissions, whitelist IP addresses, and rotate keys.

  • Verify before you click. Bookmark the official site, and treat urgent messages with suspicion.

  • Understand what “covered” means. Exchange reserve funds and promises are not insurance guarantees. Binance’s reserve fund, SAFU, was reported at roughly $1 billion, far smaller than this loss, which is why the company is using its own funds.

  • Keep your own records of balances, transfers and tax information in case of platform disruptions.

Lessons for the industry

Several security researchers have noted how this attack resembles earlier North Korea-linked heists: patient preparation, access obtained through a person or device rather than a flaw in the blockchain itself, and rapid movement of funds once approvals were in hand. One cybersecurity executive told the Associated Press the attack looked like a single approval had granted long-lived, broad access to a hot wallet. That is an outside assessment, not something Binance has confirmed. The broader takeaway is that human and endpoint security, strict approval controls, and short-lived credentialsmatter as much as cold storage.

Frequently asked questions

How much was stolen in the Binance hack?
Binance said about $6.3 billion in client assets were affected. TRM Labs measured about $6.36 billion moved out of Binance wallets, and some outlets cite figures up to $6.4 billion. Estimates vary by source and may be revised.

Who hacked Binance?
The FBI attributed the theft to North Korea, specifically the TraderTraitor group. Blockchain analytics firms TRM Labs and Chainalysis reached the same conclusion.

Will I get my money back?
Binance says it will absorb the losses and that users will not bear the financial impact. Check Binance’s official channels for the latest on balances and withdrawals.

Can I withdraw from Binance now?
Binance began phased withdrawals on November 1, starting with major cryptocurrencies, and said it would restore more assets and networks as security checks are completed.

Was my personal information stolen?
No source reviewed for this article reports that user personal data was taken, but the investigation is ongoing. Watch for official updates and for phishing.

Is it safe to keep crypto on an exchange?
Experts interviewed by CNBC disagree on how worried traders should be. A common risk-reducing approach is to keep only what you actively trade on an exchange and hold the rest in self-custody.

Sources

This article is for informational purposes only and is not financial or legal advice.