Binance, the world’s biggest cryptocurrency exchange, has suffered the largest crypto theft ever recorded. On October 29, hackers took about $6.3 billion (nearly ₹59,000 crore) in digital money from Binance’s online wallets. Most of it was moved out in just about 20 minutes.
The FBI has said that North Korea is behind the attack. Binance has promised that its customers will not lose any money, and it says it has already replaced around 95% of the stolen funds from its own pocket. Here is the full story, explained in simple words.
Binance Hack: Key Details
| Date of hack | October 29, 2026 (around 4:05 pm US Eastern Time, or about 1:35 am IST on October 30) |
| Amount stolen | About $6.3 billion |
| Time taken | Most of the money left in about 20 minutes |
| Blockchains hit | About 10, including Ethereum, Bitcoin, TRON, XRP Ledger and Solana |
| Who did it | North Korea-linked hacking group TraderTraitor (as per the FBI) |
| Money frozen so far | About $3 billion |
| User losses | Binance says it will cover all of them |
| Withdrawals | Paused after the hack, reopened in phases from November 1 |
What Happened at Binance?
Like every crypto exchange, Binance keeps some of its customers’ money in “hot wallets.” A hot wallet is a crypto wallet that stays connected to the internet so that people can withdraw their money quickly. Think of it like the cash counter at a bank branch, while most of the money stays locked in the vault.
On the afternoon of October 29 (US time), hackers found a way to send money out of these hot wallets. The attack started on the XRP Ledger and then moved to Ethereum and Bitcoin. In about 20 minutes, billions of dollars were gone. Blockchain research firm TRM Labs put the total at around $6.36 billion, while Binance itself estimated the loss at about $6.3 billion.
The stolen money was spread across many coins. Around $3.8 billion was on Ethereum, about $1.5 billion was Bitcoin (18,270 BTC), around $628 million was on TRON and about $296 million was in XRP. The single biggest transaction alone was worth more than $2.5 billion.
To give an idea of the size, the previous biggest crypto theft was the $1.5 billion hack of the exchange Bybit in February 2025. The Binance hack is about four times bigger. Experts at Elliptic said it is almost certainly the single largest theft of any kind ever known, not just in crypto.
How Did the Hackers Break In?
The hackers did not break Bitcoin or Ethereum themselves. The blockchains worked normally. Instead, the attackers got inside Binance’s own systems.
Binance co-CEO Richard Teng said the company’s first investigation showed that the attack may have started with the laptop of a DevOps engineer, a staff member who looks after the company’s technical systems. That laptop was compromised, and it gave the hacker access to an internal service that could send withdrawal requests.
Binance later said the attack was bigger than just one laptop. Teng said it was “not a single ‘one-click’ action” and “involved a more complex attack process.” The company also found “additional points of breach” and said its investigation “has not attributed responsibility to any individual.” In simple words, Binance is not blaming the engineer, and the hackers used more than one weak point.
Also Read: Best Stocks to Buy This Month
Here is what is known about the method so far:
- The hackers used an Ethereum feature called EIP-7702. According to TRM Labs, they used 50 pre-signed approvals to turn one of Binance’s hot wallets into a “sweeper.” This means every time Binance put new money into that wallet, it was automatically pulled out to the hackers.
- Teng said the hackers’ setup “did not pass through our normal approval controls.” Normally, big withdrawals need several checks. The hackers found a way around them.
- The attackers used malicious software that deleted itself and its traces as it moved through Binance’s systems, which made the investigation harder.
- Investigators believe the hackers prepared for at least 36 hours before the theft, and their wallets were funded through Tornado Cash, a tool used to hide the source of crypto.
- Binance said there is no sign that its wallet private keys, the secret passwords that control the wallets, were leaked.
Who Is Behind the Binance Hack?
On October 31, the FBI said North Korea was responsible. It linked the attack to a group called TraderTraitor, which works for the North Korean state and is believed to be part of the well-known Lazarus Group. The same group was blamed for the Bybit hack in 2025 and for a hack on another exchange, Bitget, in September. Blockchain firm Chainalysis said money from the Binance hack was mixed with money from the Bitget theft.
The FBI said the hackers were converting most of the stolen coins into Ethereum and were expected to keep moving the money through many steps to hide it. It shared a list of the hackers’ wallet addresses and asked crypto companies to block any transaction linked to them. The US Secret Service and the IRS are also working on the case.
US President Donald Trump said, “I’m not concerned. We’re learning about it. We don’t know if it’s North Korea, but if it is, we’ll talk to them about it.” He also said, “I think the bloodbath of AI hacking is to come. And there’s going to be a lot more pain.”
North Korea has not commented. The country has long been accused of stealing crypto to raise money for its government and weapons programmes.
What Binance Owner Changpeng Zhao (CZ) Said
Changpeng Zhao, better known as CZ, founded Binance in 2017 and is its biggest shareholder. He stepped down as CEO in 2023 after pleading guilty in the US to failing to stop money laundering on the platform, and he no longer runs the exchange. Still, he was one of the first to speak about the hack.
Soon after the money started moving, CZ wrote on X: “It does look like a hack on Binance.” He added, “User funds are safe!” and thanked the stablecoin companies for acting fast: “Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).”
He also made it clear that he expects customers to be fully protected. “I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered,” he wrote. Summing up the damage to the company, CZ said, “It hurts, but we survive.”
On November 1, CZ thanked US agencies for their help. “US Law Enforcement agencies (FBI, USSS, IRS and more) provided vital help in this incident,” he wrote. “A tweet can’t fully express our gratitude. Many crypto bros may not realize, a lot of the ‘why bitcoin didn’t drop more?’ credit goes to them.”
CZ also got into a public spat with Elon Musk, who posted laughing emojis and wrote “Everyday is Zeroday” about the hack. CZ replied, “Elon, have a lot of respect for you, but bad time to troll. Please stop.” He reminded Musk that Binance had invested $500 million in his Twitter takeover and added, “Would appreciate if you show a little support. Thanks!”
What Binance Did After the Hack
Binance moved quickly to calm its customers. Here are the main steps it took:
- Stopped withdrawals: Binance paused all withdrawals soon after the hack so that no more money could leave, and briefly paused deposits too.
- Promised full cover: Binance said, “Binance will absorb the financial impact of these stolen funds, not our users.” Teng told users, “your money is safe, and we’re covering every loss.”
- Set aside money: Binance said it reserved more than $6.34 billion to cover the loss, including about $5 billion that it already held in the same coins that were stolen.
- Bought back the coins: The money came from its emergency fund called SAFU (Secure Asset Fund for Users), its Bitcoin reserve, part of its Futures Insurance Fund and the company’s own treasury. By October 31, it had replaced 90% of the stolen coins, and by November 1 this rose to about 95%. The last 5% is made up of smaller coins that are harder to buy in large amounts.
- Reopened withdrawals: On November 1, Binance reopened withdrawals in phases, starting with Bitcoin, Ethereum, USDT, USDC, BNB and XRP. Other coins will open after their networks pass security checks.
- Proof of reserves: Binance has promised a full proof-of-reserves report, which shows whether it holds enough coins to cover every customer’s balance. The company has said it will publish it by November 3.
Binance.US, the separate American arm of the company, said it was not affected.
How Was $3 Billion Frozen?
A big part of the stolen money was in stablecoins, which are crypto coins linked to the US dollar. The companies that issue them can freeze coins in any wallet. Tether froze about $1.57 billion of USDT and Circle froze more than $800 million of USDC within hours. Ripple, First Digital and World Liberty Financial also froze their coins that were linked to the hack. In total, about $3 billion has been frozen.
The problem is that Bitcoin and Ethereum cannot be frozen this way, because no single company controls them. That is why a large amount, mainly in Ethereum and Bitcoin, is still in the hackers’ hands. Getting it back will depend on tracking the money and on exchanges blocking it when the hackers try to cash out.
Impact on Crypto Prices
The crypto market fell after the news. Bitcoin dropped around 4% to 5% and briefly went below $77,000, touching about $76,000. Binance’s own coin, BNB, fell about 8%. More than $1.3 billion worth of leveraged trades were wiped out as prices fell.
Many customers also took their money out once withdrawals reopened. Data from DefiLlama showed that the assets held on Binance fell by more than $16 billion between October 29 and November 2. Part of this drop came from lower prices and the stolen money, and part from users withdrawing.
What Indian Crypto Users Should Know
Binance has a large number of users in India. Binance says customer balances are safe and fully covered, and withdrawals for the main coins are already open. Users who hold smaller coins may have to wait until those coins pass the security checks.
Users should also be careful of scams. After big hacks, fraudsters often send fake emails, messages and links pretending to be from Binance, offering “refunds” or asking people to “verify” their accounts. Binance will never ask for passwords or two-factor codes. It is safest to use only the official Binance app or website.
Why This Hack Matters
The Binance hack shows that even the biggest and richest crypto company can be attacked through its own staff devices and internal systems, without anyone breaking the blockchain itself. It also shows the power stablecoin companies have to freeze money quickly, something that is not possible with Bitcoin or Ethereum.
The investigation is still going on. More details about how the hackers got in, and how much money can be recovered, are expected in the coming days as Binance, blockchain firms and US agencies share their findings.
Disclaimer: This article is for information only and is not financial or investment advice. Cryptocurrencies are highly risky and their prices can change sharply. Please do your own research or speak to a SEBI-registered investment adviser before investing.