The Biggest Crypto Theft in History: How $6.3 Billion Vanished From Binance in About 20 Minutes

Developing story, reported October 31, 2026. Figures in this article are estimates published by Binance and by blockchain analytics firms TRM Labs, Chainalysis and Elliptic, as reported by CoinDesk, Bloomberg and other major outlets named at the end. Amounts may be revised as the investigation continues.

Twenty minutes. That is roughly how long it took for about $6.3 billion to leave Binance, the world’s largest crypto exchange, in what analysts are calling the biggest theft in crypto history.

This was not a smash-and-grab on a small platform. Binance is the biggest exchange on earth, and the amount taken is more than four times the $1.5 billion stolen from Bybit in February 2025 — the previous record. Yet the most unsettling part is not the size. It is how the money left: Binance’s own systems approved the withdrawals.

Here is what happened, how the attackers got in, who investigators believe is behind it, and what it means for anyone who holds crypto on an exchange.

What happened

On Thursday evening, October 29, 2026 (UTC), Binance’s hot wallets — the online wallets an exchange uses to pay out customers — began sending their balances to addresses controlled by a single attacker. According to blockchain intelligence firm TRM Labs, the drain started at about 20:05 UTC and hit ten blockchains, including Bitcoin, Ethereum, the XRP Ledger, Tron and Solana. Most of the money moved in a single burst of roughly 20 minutes.

TRM Labs puts the total taken at about $6.36 billion, valued at the prices at the time of each transfer. Binance’s own estimate is “around $6.3 billion.” The haul included roughly $3.79 billion on Ethereum, 18,270 bitcoin worth about $1.47 billion, and about $628 million on Tron, alongside large amounts of the stablecoins USDT and USDC and smaller tokens.

The attack had been rehearsed. Analysts found that the operation’s wallet was funded more than a day earlier with small withdrawals from the mixing service Tornado Cash, and that test transactions — some worth only a few dollars — were run in advance. On Ethereum, the attacker used EIP-7702, a feature added in Ethereum’s 2025 Pectra upgrade that lets a normal wallet temporarily hand its control to a smart contract. In one transaction, the attacker executed 50 authorizations signed by a Binance hot wallet — permissions gathered in advance, then fired all at once.

How did they get in?

Binance’s first findings point to a strikingly ordinary door: a laptop.

The exchange said its initial investigation suggested a DevOps engineer’s laptop had been compromised, giving the attacker access to an internal service environment used to prepare withdrawals. From there, the attacker could submit unauthorized withdrawal requests that Binance’s systems treated as legitimate. Binance stressed it found no evidence that any wallet private keys had leaked — the attackers did not steal the keys; they got the machine that uses them to say yes.

That may not be the whole story. Co-CEO Richard Teng later said investigators had uncovered “additional points of breach” and described a complex attack, making clear the compromised laptop alone does not explain everything. Binance has promised a detailed technical post-mortem once its investigation is complete and verified.

It is worth noting the timing. Just two days before the hack, Binance said it had blocked North Korea-linked attempts that used fake job interviews to trick people into running malicious code — a signature technique of the very group analysts now blame for the theft.

Who is behind it?

TRM Labs attributes the attack, “with high confidence,” to TraderTraitor — North Korea’s elite state-backed hacking unit, also linked to the Lazarus Group and blamed by the FBI for the Bybit theft. Chainalysis says it reaches the same conclusion, and Elliptic’s analysis points the same way: the rehearsal pattern, the Tornado Cash funding, and similarities to earlier North Korean operations, including the Bybit hack and an April 2026 exploit of KelpDAO.

Two cautions belong here. Binance itself has not named an attacker, and as of publication, no government agency has made a formal attribution. In the Bybit case, the FBI publicly named TraderTraitor five days after the theft — so an official word may still come. North Korea has historically denied involvement in crypto thefts.

The money: stolen, frozen, and still missing

The freeze operation was fast. Within roughly an hour of the drain, Tether and Circle had locked billions in stolen stablecoins — something only possible because USDT and USDC are centrally issued and can be frozen at an address. Bitcoin and ether have no such switch, which is why most of what the attacker still holds is BTC and ETH.

Is user money safe?

Binance says yes — and it has put money behind the words. The exchange says it set aside more than $6.34 billion in company resources to restore customer balances, separate from the frozen assets, with $5 billion of it already held in the same tokens that were taken. It has pledged to cover all losses, drawing on company funds and its SAFU user-protection fund.

What users are living with right now is the pause. Binance halted withdrawals while it rebuilds and re-checks its withdrawal systems, kept deposits open, and said it expected withdrawals to resume within roughly 45–48 hours of its Friday update. It has also promised an updated proof of reserves.

The honest summary: the pledge and the set-aside are real commitments reported by major outlets, but the investigation is unfinished — the “additional breach points” are still being explained, and the final post-mortem has not been published. Judge the follow-through over the coming days, not just the statements.

Why this hack is different

Every previous mega-hack taught one lesson. This one teaches a harder one.

• Bybit (2025, $1.5B): attackers compromised a third-party signing interface so approvers signed a malicious transaction blind.
• Binance (2026, $6.3B): attackers allegedly reached the internal systems that prepare withdrawals, and stockpiled signed authorizations in advance — then executed them in minutes, across ten chains at once.

In both cases the cryptography worked exactly as designed. What failed was everything around it: laptops, internal access, and the human processes that turn “a request” into “an approved withdrawal.” The industry’s weakest point is no longer the blockchain. It is the office network behind the exchange.

What should you do if you hold crypto on an exchange?

This is general education, not financial advice — but these are the steps security professionals repeat after every major exchange incident:

1. Don’t keep everything on one exchange. An exchange account is a place to trade, not a vault. Large, long-term holdings belong in a wallet you control, ideally a hardware wallet.
2. Split what you do keep. If you use exchanges, spreading balances means one incident cannot freeze or threaten everything at once.
3. Turn on the strongest login protection available — passkeys or a hardware security key where offered, not just SMS codes.
4. Use withdrawal address allowlists if your exchange offers them, so funds can only leave to addresses you approved in advance.
5. During a freeze, do nothing in a panic. Don’t click “support” links in social replies or messages offering to “restore” your account — scammers swarm every major incident within hours. Use only the exchange’s official app and announcements.
6. Keep your own records. Screenshots or exports of your balances are cheap insurance if any platform’s records are ever in dispute.

What happens next

Three things will decide how this story ends:

• Withdrawals. Whether Binance reopens them on its stated 45–48 hour timeline — and whether users actually take their money out when it does.
• The post-mortem. Binance’s detailed technical report should explain the “additional breach points” and how the signed authorizations were gathered. Other exchanges will be reading it as a checklist of their own weaknesses.
• The remaining $2.4 billion. What the attacker still holds is in bitcoin and ether that cannot be frozen. Tracing firms and law enforcement will be watching those addresses; how the attacker tries to launder them will be the next chapter. You can follow major crypto prices on our exchanges page, which shows delayed market snapshots.

One record has already been rewritten. Four times larger than Bybit, executed in about 20 minutes, against the largest exchange in the world — this is now the benchmark every exchange’s security team has to answer for. And the oldest line in crypto is still the one worth keeping: an exchange is not a wallet. After this week, it is hard to argue otherwise.

Sources: CoinDesk, “Binance arranges $6.34 billion to cover losses from biggest crypto hack ever” (Oct 30, 2026), coindesk.com · Bloomberg via BusinessWorld, “Binance estimates $6.3 billion hacked in crypto’s biggest heist” (Oct 30, 2026), bworldonline.com · TRM Labs analysis reported by SecurityWeek, “$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor” (Oct 30, 2026), securityweek.com · Seoul Economic Daily (Oct 30, 2026), sedaily.com

Disclaimer: This article is for general education only and is not financial, legal, or tax advice. Figures are estimates from Binance and blockchain analytics firms as reported on October 30–31, 2026, and may change as the investigation continues.