Eight Weeks of Quiet Access Preceded Record $6.3 Billion Binance Heist

The hackers who stole approximately $6.3 billion from Binance on October 29 reportedly held access to the exchange for eight weeks before they acted. The theft itself was swift; the setup was not, and that gap has become the most uncomfortable part of the story. The heist targeted Binance's hot wallets — the internet-connected wallets exchanges keep online to process day-to-day customer deposits and withdrawals — and ranks as the largest digital asset theft to date.

Twenty Minutes of Action, Weeks of Patience

The attack began at around 20:05 UTC on October 29, 2026, with most of the operation unfolding within roughly 20 minutes. In that window, the attackers moved funds across more than ten blockchains, including Ethereum, Bitcoin, and Solana. Running a coordinated drain across that many networks takes planning rather than improvisation. The dispersal also narrows recovery options: the tools for tracing and freezing stolen funds differ from chain to chain, and not every asset in motion can be intercepted.

The preparation reportedly stretched back much further. Research into the incident points to a preparation period that began no later than June 2026. The timeline also includes specific steps on October 20, and testing of internal access reportedly took place approximately 36 hours before the attack.

How They Got In

Binance's investigation found the breach came from a multi-layered campaign built on social engineering, meaning the manipulation of people and trusted workflows rather than a direct cryptographic break. The tactics included a fake job interview and tampered software development tools, which gave the attackers entry into Binance's internal systems. From there, they could push through unauthorized transactions.

Notably, the attackers did not need to compromise private keys. Private keys are the cryptographic passwords that control crypto wallets, and they are usually treated as the crown jewels of exchange security.

The breach has been attributed to TraderTraitor, a North Korean state-sponsored hacking group. The same group is linked to earlier attacks, including the $1.5 billion theft from Bybit in February 2025, which at the time stood as a landmark loss for a centralized exchange. The Binance figure is more than four times larger.

Binance's Damage Control

Binance paused withdrawals immediately after the theft and later restored them in phases. The exchange allocated approximately $6.34 billion from corporate resources to cover the losses, and by October 31 it indicated that about 98% of the stolen assets had been replenished.

Partners and stablecoin issuers also stepped in. Roughly $2.85 billion to $3 billion of the stolen funds were frozen or intercepted. Stablecoin issuers can lock tokens at the contract level, effectively neutralizing a portion of the loot for the thieves. That control exists only for tokens whose contracts issuers manage, which is why a haul scattered across so many chains cannot be neutralized this way in full.

Binance also commissioned an independent security review. Its stated purpose is to analyze the breach and strengthen the exchange's resilience going forward.

A Familiar Playbook at a Bigger Scale

North Korea-linked hackers have spent years refining a specific approach to crypto targets, and the Binance case fits the pattern: patient infiltration, human manipulation, then a fast exit.

Fake job interviews are a particularly effective lure. A developer who believes they are completing a technical assessment may run code or install tools without the scrutiny they would apply to an unknown file. Tampered development tools extend the same idea: engineers trust their toolchains, and that trust becomes the entry point.

What This Means

For exchanges, the clearest lesson is that hot wallet security is only as strong as the internal systems that can authorize transactions from them. Protecting private keys is necessary but plainly not sufficient when an intruder can operate inside the approval pipeline.

The reported eight-week access period will likely draw the most scrutiny. Detection, not just prevention, is where the independent review will need to deliver answers.

The partial freeze of roughly $2.85 billion to $3 billion highlights another dynamic: stablecoin issuers and partner firms now act as a de facto emergency brake on large thefts, which strengthens the case for centralized intervention tools that some in crypto still resist.

For users, the practical takeaway is less about Binance specifically and more about how custody works. Funds on any centralized exchange depend on that exchange's internal controls, its reserves, and its ability to absorb a hit when those controls fail. Binance had the reserves this time. The open question for the industry is how many other platforms could say the same if a group with weeks of quiet access chose them next.