What is known about the $6.3 billion Binance crypto heist

Binance estimated that the security incident affected roughly $6.3 billion in assets. TRM Labs separately traced about $6.36 billion in transfers from Binance wallets across 10 blockchains.

The exchange was hacked during the week of Oct. 26, 2026. Most of the stolen assets moved during a period of about 20 minutes that began at 20:05 UTC on Oct. 29, according to TRM Labs.

Binance’s early investigation pointed to a compromised laptop used by a DevOps engineer. Investigators also identified unauthorized withdrawals carried out through a service container. Binance said it had not found evidence that attackers obtained wallet private keys.

The technical method included an Ethereum EIP-7702 delegation and authorizations that had been signed in advance. Those details describe how the transfers were enabled, but the available research does not establish that the incident involved a leak of Binance’s wallet keys.

Binance temporarily halted deposits and withdrawals on the networks affected by the incident. The exchange also said it would make up the losses using its Secure Asset Fund for Users, known as SAFU, together with company funds. Binance said customers affected by the incident would be repaid.

Asset freezes followed the transfers. Binance reported that approximately $3 billion in affected assets had been frozen on-chain. TRM Labs said stablecoin issuers and Arbitrum had frozen approximately $2.7 billion by Oct. 30. A separate account from KPBS, carrying NPR reporting, said Binance partners froze about $3 billion in stolen cryptocurrency.

The figures differ slightly because the sources describe the incident from different positions: Binance estimated the overall impact, while TRM Labs tracked transfers across blockchains. The research does not provide a final accounting of how much money remained unrecovered after the freezes.

TRM Labs attributed the attack to TraderTraitor, which it described as a North Korean hacking unit. The same unit was identified in the NPR-syndicated explainer as being linked to the attack.

The reported loss exceeded the $1.5 billion cryptocurrency theft from Bybit in February 2025. The incident also intensified concerns about the security and regulation of cryptocurrency exchanges.

Crypto exchanges provide venues where customers can trade digital assets, and they often hold those assets on customers’ behalf. That custody role helps explain why a compromise involving an exchange’s systems can affect both the platform and its customers. In this case, Binance’s response combined temporary transaction restrictions, efforts to freeze assets and a commitment to repay affected customers.

The available research establishes the estimated size of the incident, the technical indicators identified by investigators and the immediate response from Binance and its partners. It does not provide a complete public breakdown of every affected asset or a final recovery total.