Hackers drained roughly $6.36 billion from Binance's hot wallets across ten blockchains on Thursday, October 29, pulling off the largest cryptocurrency theft on record — a haul more than four times the size of the $1.5 billion Bybit hack of February 2025, the previous record. According to the exchange, the breach began with a compromised engineer's laptop, and most of the funds were gone within about 20 minutes. Tether and Circle froze approximately $2.6 billion of the stolen stablecoins within an hour, and Binance now puts the verified frozen total at around $3 billion. The company has pledged to cover every customer loss and has paused withdrawals, which it expects to reopen by Sunday.

Markets reacted immediately. BNB fell 8.7% in a single hour, Bitcoin slid below $77,000, and roughly $1.5 billion in leveraged positions were wiped out.

Breaking: The hackers behind the $6B #Binance hack, $1.5B #Bybit hack, and $388M #Bitget hack may all be linked to North Korea's Lazarus Group. — Lookonchain (@lookonchain) October 30, 2026

What Happened in the Binance Hack?

The attacker got Binance's own systems to sign withdrawals out of its hot wallets — the online wallets an exchange uses to pay out customers, typically holding only a working float while the bulk of customer assets sits in offline cold storage. On Friday, Binance said its initial findings point to a compromised DevOps engineer's laptop, which allowed the attacker to reach a service container and submit unauthorized withdrawal transactions. The company found "no evidence of any wallet private key leak."

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y — Binance (@binance) October 30, 2026

The heist had been staged for more than a day. A reconstruction by blockchain analytics firm TRM Labs lays out the timeline (all times UTC):

• October 28, morning: the attacker's operator wallet was funded with three small withdrawals from the Tornado Cash mixer, a privacy tool the U.S. Treasury sanctioned in 2022.
• October 29, earlier in the day: the attack code was tested on two wallets, rehearsed on a third, and installed on a Binance hot wallet roughly four hours later.
• 20:05–20:09: five Binance XRP Ledger wallets sent 233.46 million XRP to a single address.
• 20:20: a Binance Bitcoin hot wallet sent 18,270 BTC, and a Tron wallet followed with 612.7 million USDT within two minutes.
• 20:23: the main Ethereum hot wallet was emptied of 167,464 ETH and 1.615 billion USDT.
• 21:29: Binance posted that it was investigating "a potential security issue."
• 23:05: a second wave hit Binance wallets on Avalanche and Polygon.

On Ethereum, the attacker used EIP-7702, a feature introduced in the May 2025 Pectra upgrade that allows a standard wallet to hand its controls to a smart contract. The hot wallet signed 50 such handovers to a "sweeper" contract, meaning newly deposited funds kept being drained for hours — TRM counted six additional sweeps between 20:41 and 23:56.

TRM attributes the attack "with high confidence" to TraderTraitor, the North Korean-linked unit the FBI blamed for the $1.5 billion Bybit hack in February 2025. U.S. agencies track North Korean cyber operations under names that include both Lazarus Group and TraderTraitor, and United Nations investigators have linked the country's crypto thefts — running into the billions of dollars over recent years — to funding for its weapons programs. Binance has not named any perpetrator.

How Much Was Stolen, and How Much Was Frozen?

About $6.36 billion left Binance, and roughly $2.7 billion of it is frozen, according to TRM's count at 00:30 UTC on Friday, valued at prices at the time of each transfer. Binance's own figure is "around $6.3B" stolen and around $3 billion verified frozen, and it says that number may still rise.

Ethereum took the biggest hit, at about $3.79 billion, followed by the 18,270 BTC taken from the Bitcoin wallet, worth about $1.47 billion.

Stablecoins proved to be the attacker's weak spot, because their issuers can block addresses. The freezes came quickly:

• Circle: froze 823 million USDC in the main receiving wallet at 21:04 UTC. CEO Jeremy Allaire said on X that Circle acted "in coordination with law enforcement."
• Tether: froze 971.1 million USDT at 21:01, and CEO Paolo Ardoino put the total above 1.567 billion USDT by 21:25. TRM now counts about 1.77 billion USDT frozen across Ethereum, Tron, Avalanche and Polygon.
• Ripple: froze 40.5 million RLUSD at 22:01, after the attacker had already sold 48 million on decentralized exchanges.
• World Liberty Financial: froze 27.8 million USD1.
• Arbitrum: its Security Council forced 8,426 ETH and 74.6 million ARB — about $30 million — out of the attacker's wallet.

The remainder is on the move. TRM says the attacker still controls about $2.4 billion, including the stolen Bitcoin, which is being split into 1,000 BTC and 100 BTC chunks. About 325 million USDT was swapped for roughly 122,300 ETH through UniswapX, with the attacker paying more than 10% over the market price for the ether — the cost of getting out before Tether could act, since Ethereum cannot be frozen by an issuer.

A frozen balance, however, is not the same as money back in Binance's hands. Releasing it requires the issuers, law enforcement and, in some cases, courts — and none of them has given a timeline.

CZ Warned About Phishing for Days. What Has Binance Said Since?

Binance founder Changpeng Zhao (CZ) had spent the week urging traders to lock down their accounts. On October 23, he argued that AI poses a bigger threat to crypto users through leaked data and sharper phishing than through any attack on encryption itself. On Wednesday, he posted a security checklist after four data leaks in a single day, at Coinbase's vendor Amplitude, Korea's Bithumb and two Korean brokers. His line on breaches: "scammers move fast after one." The next day, his own exchange was the one in the headlines.

Binance has not explained how the engineer's laptop was compromised, but the incident points to the same weak spot CZ kept flagging: a single person's device. FBI advisories on TraderTraitor describe operatives approaching crypto-industry staff with fake job offers designed to plant malware — a playbook aimed at individuals rather than at exchange code.

Since the theft, CZ and co-CEO Yi He have repeated one message: users will not shoulder the losses. "Loss might be a bit higher than that, but will cover," CZ replied on Thursday night. Hours later he added: "It hurts, but we will survive."

The latest updates, as of Friday morning:

• Withdrawals: paused on all networks. In a service update at 04:36 UTC, Binance said it is rebuilding its withdrawal service and addresses and expects to resume "within 48 hours."
• Deposits: working as normal.
• Other services: Binance Alpha trading is suspended, and Friday's PREDICT listing is postponed.
• Root cause: "multiple factors," with a full post-mortem to follow.
• Binance.US: not affected, as it operates as a separate platform.

The phishing risk has now shifted to Binance's users as well. In her latest post on Friday, Yi He asked users to trust only official Binance channels and to avoid clicking unofficial links or sharing account details with anyone. Fake "refund" and "withdrawal verification" messages typically follow a hack of this scale.

How Did the Market React to the Binance Hack?

With a fast sell-off, followed by a partial bounce. BNB, Binance's exchange token, fell from $744.90 to $680 in the hour after 20:00 UTC, an 8.7% drop. Bitcoin went from $80,849 to $76,500 by early Friday, and Ether fell from $2,337 to $2,174.

Leverage magnified the damage. CoinGlass shows $1.55 billion in liquidations over 24 hours, hitting 239,610 traders, and 83.6% of that — $1.29 billion — came from long bets. Bitcoin positions accounted for $501.6 million and Ethereum for $360.6 million. Binance itself handled 49.4% of the total, including the largest single order: an $11.09 million BTCUSDT long closed at $79,254.71.

The Crypto Fear & Greed Index dropped from 51 to 30, into "fear" territory. Bitcoin's low came within $30 of its 200-day exponential moving average (EMA) at $76,473, and buyers stepped in there. It trades near $78,000 at the time of writing.

Can BNB Hold $680 After the Binance Hack?

So far, it has. BNB bounced to $720 by 03:00 UTC as Binance repeated that it would cover all losses, but sellers capped the rebound, and the token is back at $706, down 6.2% in 24 hours.

• Resistance: $720, Friday's rebound high, then $745.74, where BNB traded before the hack.
• Support: $692.49, the 200-day EMA, then $680, the low of the hack hour. Below that sits $674.60, the September 1 low.

The next test is the 48-hour window. If Binance reopens withdrawals by Sunday morning without a rush for the exits, the worst of this hack may already be priced in. If the reopening slips, $680 is the level to watch. Away from the charts, two threads remain open: the full post-mortem Binance has promised, and the process — issuers, law enforcement and, in some cases, courts — that determines when any of the roughly $3 billion in frozen assets is actually returned.