Binance lost approximately $6.3 billion in digital assets from its hot wallets in roughly 20 minutes on October 29, 2026 — the largest cryptocurrency theft on record. Rival exchanges are now reinforcing their defenses and pressing for faster threat-intelligence sharing as the rest of the industry quietly checks its own locks.

The timing is uncomfortable. Crypto platforms are becoming more embedded in mainstream finance just as the biggest name in the business demonstrated how quickly a vault can be emptied.

What Happened at Binance

The attack began at approximately 20:05 UTC on October 29. Within about 20 minutes, attackers had drained around $6.3 billion in digital assets from the exchange's hot wallets.

Hot wallets are the internet-connected accounts exchanges use to process everyday withdrawals. They function like the cash drawer at the front of a store rather than the safe in the back — convenient, and that convenience makes them a target. Because they must stay online to handle withdrawals at scale, they also present a persistent attack surface that offline cold storage does not.

Blockchain analytics firms TRM Labs, Chainalysis, and Elliptic have linked the theft with high confidence to TraderTraitor, a North Korean hacking group that U.S. government agencies have tied to a series of cryptocurrency thefts in recent years. TraderTraitor is associated with the Lazarus Group, a U.S.-sanctioned, state-linked collective that appears regularly in crypto breach reports.

The damage could have been worse. Around $3 billion of the stolen assets — mostly USDT and USDC, the two most widely circulated dollar-backed stablecoins — was frozen on-chain by their issuers, Tether and Circle. Stablecoin issuers can blacklist specific wallet addresses, and once flagged, tokens held at those addresses become effectively unspendable. In this case, that mechanism locked up close to half the haul before it could move far.

Binance has pledged to cover all user losses. The exchange is drawing on its Secure Asset Fund for Users, known as SAFU — an emergency insurance fund the company created in 2018 — along with corporate reserves. The combined commitment totals more than $6.34 billion, including a $1 billion SAFU reserve.

The exchange temporarily paused withdrawals while it ran security reviews. Deposits stayed open, and Binance said it planned a swift resumption. It also told users that individual balances would not be directly affected. So far, there is no reported evidence that private keys were leaked.

How Rival Exchanges Are Responding

Across the sector, platforms are reviewing cold storage arrangements and studying the details of the breach. Kraken said it was watching industry incidents for lessons it could apply to its own defenses.

The loudest message from the sector is about speed. Exchanges are calling for faster sharing of threat intelligence, so that an attack pattern spotted at one platform can be flagged to others before it repeats.

The freeze of roughly $3 billion in stablecoins makes the case on its own. Coordinated, rapid action by Tether and Circle recovered more value than most exchange-level defenses ever could after the fact.

A Record Nobody Wanted

Before this month, the largest crypto theft on record was the roughly $1.5 billion taken from Bybit in February 2025 — a record that had stood for about 20 months. That attack was also tied to North Korean hackers. The Binance breach is more than four times that size.

The scale also stands out against Binance's own safety net. The exchange's $1 billion SAFU reserve, once pitched as a backstop for exactly this kind of event, covers only a fraction of the loss. The company is leaning heavily on corporate reserves to make users whole.

What This Means for the Market

Prices across major digital assets declined after the breach. The incident also sharpened skepticism about how centralized exchanges handle customer custody, putting hot wallet management practices under renewed scrutiny.

Binance's pledge to absorb the losses — rather than leaving customers to bear them — is expected to ease short-term panic. Users who see their balances intact are less likely to rush for the exits. How attackers accessed the hot wallets remains undisclosed — the exchange says there is no reported evidence that private keys were leaked — and roughly $3.3 billion of the stolen funds sits outside the stablecoin freeze. The resumption of withdrawals and further findings from the ongoing security reviews are the markers to watch.

The stablecoin freeze showed that centrally issued tokens can serve as a powerful recovery tool when hackers seize funds. It also reminded the market that issuers hold a switch capable of locking assets at the address level.

This article is based on reporting by CryptoBriefing and was edited by John Chen. Original source: CryptoBriefing.