Binance Suffers Record $6.4 Billion Crypto Hack
Binance lost more than $6 billion in a historic cryptocurrency theft, with investigators linking the attack to suspected North Korean hackers.
Binance, the world’s largest cryptocurrency exchange by trading volume, suffered the biggest crypto theft on record after attackers drained billions of dollars from its wallets on October 29, 2026.
The exchange estimated its losses at approximately $6.3 billion, while blockchain analytics firm Elliptic identified $6.43 billion stolen across 11 blockchain networks. The incident surpassed the previous record set by the $1.46 billion Bybit hack in February 2025.
How the Binance Hack Unfolded
The attackers targeted Binance-controlled hot wallets, which are connected to the internet and used to process cryptocurrency transactions.
According to Elliptic, Ethereum accounted for approximately $3.8 billion in stolen assets across 186 tokens. The attackers also took 18,270 Bitcoin (BTC), valued at approximately $1.48 billion, alongside substantial amounts of USDT, USDC, XRP and other cryptocurrencies.
Binance initially traced the incident to a compromised laptop belonging to a DevOps engineer. The attackers reportedly accessed internal infrastructure and used the exchange’s transaction systems to initiate unauthorized withdrawals.
A subsequent investigation uncovered additional points of compromise, suggesting a more complex attack. Binance reported finding no evidence that wallet private keys had been leaked.
Elliptic’s analysis also identified the misuse of Ethereum’s EIP-7702 functionality, which allows wallets to delegate certain operations to smart contracts. The attackers apparently exploited Binance’s transaction authorization infrastructure to gain control over funds.
The findings indicate that the breach targeted operational security rather than the underlying blockchain networks.
North Korean Hackers Suspected
Elliptic linked the theft to suspected North Korean cybercriminals based on similarities with previous attacks and the movement of stolen funds.
Investigators identified overlapping laundering activity involving cryptocurrency from a separate Bitget exploit previously associated with North Korean actors.
The attack also resembled methods used by TraderTraitor, a North Korea-linked hacking operation associated with the Lazarus Group.
However, the attribution remains preliminary. Neither law enforcement authorities nor Binance had formally confirmed who carried out the attack.
The suspected connection is particularly significant because North Korean hacking groups have been linked to several major cryptocurrency thefts, including the 2025 Bybit incident.
Binance Freezes Billions and Pledges Full Coverage
Following the breach, Binance temporarily suspended withdrawals, revoked affected authorizations and worked with law enforcement and blockchain analytics companies to trace the stolen assets. Deposits remained operational.
The coordinated response helped prevent the attackers from accessing a substantial portion of the funds.
- Approximately $3 billion: Total assets Binance reported frozen onchain.
- $2.84 billion: Frozen assets independently verified by Elliptic.
- 44%: Share of the estimated theft that Elliptic confirmed had been frozen.
Most frozen assets consisted of stablecoins such as USDT and USDC. Their issuers can restrict specific wallet addresses, preventing stolen tokens from being transferred.
Unlike these stablecoins, Bitcoin and Ether cannot be frozen by a centralized issuer, making recovery more difficult once stolen funds are converted into these assets.
Binance committed to covering the losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
The exchange also reported setting aside more than $6.34 billion in company funds to address the incident and announced plans to publish updated Proof of Reserves data and a detailed security investigation.
A Record Theft Exposes Crypto Security Risks
The Binance incident exceeded several previous major cryptocurrency thefts:
- Bybit (2025): $1.46 billion stolen.
- Ronin Network (2022): Approximately $625 million stolen.
- Poly Network (2021): Approximately $611 million stolen.
A separate attack affected prediction-market platform Polymarket on October 29. Blockchain analytics firm Bitquery traced approximately $2.73 million stolen from 737 accounts, with Polymarket attributing the incident to a compromised third-party provider.
Polymarket temporarily halted trading and pledged to reimburse affected users. The incidents were separate, but both involved weaknesses surrounding transaction authorization rather than failures in blockchain cryptography.
The record-breaking Binance theft demonstrates how vulnerable even major cryptocurrency platforms can become when their internal systems are compromised. At the same time, the freezing of billions in stolen assets shows the growing importance of blockchain monitoring and coordinated security responses. Protecting digital assets depends not only on blockchain technology, but also on the infrastructure and people responsible for controlling access to them.
Learn More with CryptoPulse.News
- What Is Crypto Custody? From Private Keys to Custodians
- How to Store Cryptocurrency Securely: A Beginner’s Guide
- 10 Common Cryptocurrency Mistakes Beginners Should Avoid
- Top Crypto Exchanges for Beginners
