Binance Hacked: $6.3 Billion Stolen in Biggest Crypto Heist Ever, $3 Billion Frozen

Oct 30, 2026 — Hackers have stolen about $6.3 billion from Binance, the world’s largest cryptocurrency exchange, in what analysts say is the biggest crypto heist in history. Binance suspended all deposits and withdrawals on Thursday after the breach, said about $3 billion of the stolen funds had already been frozen with the help of partners, and promised to cover all losses — while blockchain investigators pointed the finger at a North Korean hacking unit.

Key facts: the Binance $6.3 billion hack

How $6.3 billion moved in 20 minutes

According to Binance’s initial investigation, the attack did not begin with a broken vault door. A hacker gained access to an engineer’s compromised laptop, which allowed the attacker to reach a service container and submit unauthorised withdrawal transactions. From there, the theft moved at extraordinary speed: blockchain analytics firm TRM Labs said the hackers shifted most of the funds in about 20 minutes, across wallets on 10 blockchains.

Arkham Intelligence’s tally of the wallets believed to belong to the hackers gives a sense of the haul’s shape: about $5.788 billion held across 70 addresses, including 1.768 billion Tether (USDT), 18,270 bitcoin, 497,976 ether and about 824.6 million USD Coin (USDC). The mix matters, because stablecoins can sometimes be frozen by their issuers — and that is exactly what happened next. Tether froze nearly $1.57 billion linked to the incident, Circle froze more than $800 million, and Binance said that with partners it had located and frozen about $3 billion in total. The remaining $3.3 billion is the hard part: as the analytics firms note, funds that cannot be frozen are likely out of reach.

Who the investigators blame — and what is not proven

TRM Labs said it assessed with “high confidence” that the attack was carried out by TraderTraitor, the North Korean hacking unit investigators have linked to the Lazarus Group. Another tracking firm, Pangolin Intelligence of Singapore, reached the same conclusion. The Wall Street Journal reported that cybersecurity researchers saw blockchain activity consistent with TraderTraitor’s methods, and TRM’s global head of policy, Ari Redbord, called the attack “unprecedented” and a “watershed”.

Two cautions belong here. First, this attribution comes from blockchain intelligence firms, not from an official government finding on this specific hack; Binance itself said its investigation had not attributed responsibility to any individual. North Korea’s mission at the United Nations was contacted for comment, and Pyongyang has previously denied hacking allegations. Second, the money trail is the point for investigators: TRM notes that features of this attack match earlier North Korea-linked heists, and that between January 2024 and September 2025 the group had already stolen some $2.6 billion in crypto. This single hack pushes that figure past $5 billion.

Why this heist dwarfs every previous one

The previous record for a crypto theft was set in February 2025, when the Lazarus Group stole $1.5 billion from the Bybit exchange in an attack the FBI attributed to North Korea. The Binance theft is more than four times that size. It also lands in a year already full of crypto crime: TRM’s 2026 Crypto Crime Report counts $2.87 billion stolen across nearly 150 hacking incidents in 2025 alone. The Binance incident on its own is worth more than double that entire year’s total.

The market noticed immediately. Bitcoin fell about 5 percent after the heist, dropping below $77,000. As one crypto-markets expert told Al Jazeera, a blow to confidence in one of the largest centralised exchanges risks shocking confidence among retail investors more broadly — and could push more traders toward decentralised alternatives, on the argument that assets held at a centralised exchange are only as safe as the exchange itself.

What Binance users should do now

Binance has suspended deposits and withdrawals while security checks are completed and blockchain partners trace and recover funds, and it expects withdrawal services to resume by Sunday morning. The company says it will cover all losses and that user funds are safe — a pledge repeated by co-founder Yi He.

For users, the practical rules are simple. Follow only Binance’s own official announcements for the restoration timetable, and treat any message offering to “recover” stolen funds, unlock an account, or move assets to a “safe wallet” as a scam — recovery scams surge after every major hack. Do not move funds on the basis of social-media posts claiming to be Binance support. And if you hold assets on any centralised exchange, this is the week to check whether your own security basics — a unique password, two-factor authentication, and withdrawal address whitelisting where available — are actually switched on.

Related reading: for more on the platforms shaping daily digital life, see WhatsApp Message Scheduling: How to Schedule Messages That Send Even When Offline and OnePlus 16 Launched in China: Price in Pakistan, Specs and Features. For Apple’s latest hardware, see Apple HomeView Launched: Price, Preorders and Siri AI for Pakistan.

Frequently Asked Questions