Binance loses $6.3 billion in crypto hack, half now frozen

A security incident at Binance on Thursday, October 29, 2026, hit some $6.3 billion in client assets, the largest crypto theft on record, CNBC reports.

How big the theft is, and how much is frozen

In a statement relayed by Cryptoticker, Binance put the overall damage at roughly $6.3 billion, and said close to $3 billion of that sum has been frozen on-chain. Bybit held the earlier record for an exchange heist, having lost around $1.5 billion in February 2025.

TRM Labs reports somewhat different numbers: roughly $6.36 billion moved out over ten blockchains, with around $2.7 billion now frozen. Stablecoins worth close to $2.4 billion were blocked by Tether and Circle. Binance stated that it hopes to resume withdrawals within 48 hours, while deposits already function.

The damage was limited to Binance’s offshore platform. Its regulated U.S. exchange was untouched, and Coinbase and Robinhood were unaffected, though their shares fell on Friday.

How the attack worked and who is suspected

Binance’s initial investigation found that a DevOps engineer’s laptop had been compromised. That gave the attacker access to a service container, from which unauthorized withdrawals were submitted. Binance said it found no evidence that a private key leaked. It later said on social media that the investigation had uncovered additional points of breach, without specifying them.

Cryptoticker reports that the intruder relied on EIP-7702, a function available on Ethereum since the Pectra upgrade in May 2025, which allows a wallet to delegate control to a contract through one signature. Tornado Cash, a mixer that blends deposits together so that nobody can trace where the money came from, supplied 0.1 ETH to the address the attacker used.

With high confidence, TRM Labs ties the attack to TraderTraitor, a North Korean group, and Chainalysis names that same group. Binance itself has not identified who was behind it. For 2025, Chainalysis puts total crypto theft at roughly $3.4 billion, of which around $2 billion came from groups linked to North Korea.

What Binance and others did the same day

• Yi He, co-founder of Binance, wrote: “User funds are safe. Binance will cover all hacking losses.” The SAFU fund, along with the company’s own money, is meant to pay for those losses.
• Deposits and withdrawals were suspended, and an updated proof of reserves was to follow.
• After a hack of an outside data provider, Polymarket paused trading for a time on its international platform, and at least $2.7 million was drained from users’ wallets.

Experts interviewed by CNBC disagree on whether funds are safe on exchanges. Tyler Moore, a cybersecurity professor at the University of Tulsa, said: “I think you should be very wary of leaving any significant amount of funds in an exchange… there are no built-in protections for when these inevitable hacks take place.”

Ido Ben-Natan, CEO of the blockchain security company Blockaid, held the opposite opinion: “I actually think no users will lose any money.” Brett Falk, a professor who runs the Crypto and Society Lab at the University of Pennsylvania, argued that American rules probably would not have prevented this incident: “Most of the regulation doesn’t touch the specific software stack you have to use to authenticate people.”

Ryan Kirkley, CEO of Global Settlement Network, was more cautious: “I do not think there’s anything right now that is a common solution in the marketplace where your assets are truly safe.”

On regulation, Commodity Futures Trading Commission Chairman Michael Selig said on CNBC that offshore exchanges “don’t have the same sorts of safeguards that we have in our financial markets.” He said the agency wants to offer a federal option for them to register with the CFTC and be subject to the same cybersecurity safeguards as U.S. markets.

Photo: Roger Brown / Pexels