Binance Hack Timeline: $6.3 Billion Theft, Asset Recovery and Sunday Withdrawal Plan
Key Takeaways
- •Hackers drained approximately $6.3 billion from Binance hot wallets across several blockchains, making it the largest cryptocurrency theft on record and surpassing the $1.5 billion Bybit theft of February 2025.
- •Industry partners froze roughly $3 billion of the stolen assets, and Binance reserved more than $6.34 billion in company funds, including $5 billion already held in the affected tokens, to cover the losses.
- •Binance co-CEO Richard Teng said attackers used an EIP-7702 delegation from Ethereum's Pectra upgrade to gain control of a hot wallet without passing normal approval checks, and a self-destruct mechanism erased tools and traces of the intrusion.
- •TRM Labs linked the attack to North Korea's TraderTraitor group, though Binance has not publicly confirmed the attackers' identities, and Chainalysis identified thousands of rapid transactions suggesting automated laundering.
- •Binance withdrawals remain suspended, with a staged reopening planned for Sunday, November 1, alongside a proof-of-reserves snapshot due Monday and additional technical findings expected within roughly 48 hours.
Hackers stole approximately $6.3 billion from Binance on Thursday in what is now the largest cryptocurrency theft on record, according to the exchange and blockchain investigators. Industry partners froze roughly $3 billion of the affected assets, while Binance said it would cover the losses with company funds.
What Happened
On October 30, 2026, Binance co-founder He Yi said the exchange had suffered a cyberattack affecting approximately $6.3 billion in assets. Around $3 billion had been frozen with assistance from industry partners, according to a post shared by Wu Blockchain on X: “Binance Co-Founder He Yi Explains the $6.3 Billion Hack On October 30, 2026, Binance co-founder He Yi @heyibinance said Binance had suffered a cyberattack affecting approximately $6.3 billion in assets, of which around $3 billion had been frozen with assistance from industry…” X post
Binance has not disclosed how much of the stolen cryptocurrency has been returned to its control. TRM Labs traced the first unauthorized transfers to approximately 8:05 p.m. UTC on Thursday and said Binance wallets were drained across several blockchains.
The attackers targeted hot wallets, which exchanges keep connected to the internet to process withdrawals, in contrast to the offline cold storage used for long-term holdings. TRM Labs linked the attack to North Korea’s TraderTraitor group. The FBI previously blamed the same group for the $1.5 billion theft from Bybit in February 2025, which had been the largest cryptocurrency theft on record before this week’s attack. Binance has not publicly confirmed the attackers’ identities.
How the Attack Worked
Binance co-CEO Richard Teng said the attackers used an EIP-7702 delegation, an Ethereum standard activated as part of the network’s Pectra upgrade in May 2025. The feature allows a wallet to authorize software to act on its behalf. According to Teng, the delegation gave the attackers control of a hot wallet without passing Binance’s normal approval checks.
In a transcript shared on X, Teng said: “Hi everyone, firstly, I want to thank you all for the support. Difficult times like these are a great reminder how strong our industry is when we work together. We are grateful to our partners that acted quickly to freeze the hacked assets; to global law…” Teng’s X post
Teng also said a “self-destruct mechanism” erased tools and traces, making the investigation more difficult.
“To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” Teng said.
Blockaid CEO Ido Ben-Natan said compromised signing systems likely enabled the theft. He said the attackers could have stolen the funds without EIP-7702, although the feature may have helped them bypass safeguards.
Binance said investigators found additional breaches beyond the first suspected compromised employee laptop. The exchange said it found no evidence that wallet private keys had leaked. Chainalysis identified thousands of rapid transactions that could indicate automated laundering. The funds moved among multiple addresses and, in some cases, returned to wallets used earlier.
Binance Says It Will Cover the Losses
Binance said it had reserved more than $6.34 billion in company funds to cover the losses. The amount includes $5 billion already held in the affected tokens. The exchange is purchasing the remaining tokens through exchanges and over-the-counter transactions.
A Binance spokesperson declined to provide wallet addresses, citing security concerns. CertiK said it needed additional information to verify the holdings.
Teng said the attack affected Binance’s own hot wallet rather than customer funds. However, a CoinDesk review of reserve data found that the compromised wallets had previously been listed among assets backing customer balances. Proof-of-reserves disclosures are meant to show that an exchange holds enough assets to cover what customers are owed.
The theft affected cryptocurrency markets. Decentralized lender Aave paused new deposits and borrowing as a precaution before reopening its markets on Friday afternoon. Such pauses are a standard risk-control measure for lending protocols during periods of market stress.
Binance withdrawals remain suspended while the exchange rebuilds and tests its systems. Deposits and other unaffected services continue to operate. Binance plans to begin reopening withdrawals in stages on Sunday, November 1, after completing security checks.
The exchange also plans to take a proof-of-reserves snapshot within 12 hours of its announcement, with the results due Monday. Binance expects to release additional technical findings within approximately 48 hours.
