The Binance hack was a theft of about $6.3 billion in cryptocurrency from the exchange's hot wallets on October 29, 2026, the largest crypto heist on record. The FBI has blamed North Korea's TraderTraitor hacking group. Binance says the attack started months earlier with a fake job interview, that it will cover all losses from its own money, and that customer balances are safe.[1][2][3]
 | |
| Date | October 29, 2026, from 20:05 UTC |
|---|---|
| Target | Binance hot wallets |
| Amount | About $6.3 billion |
| Method | Fake job interview, malware, stolen credentials, EIP-7702 wallet permissions |
| Attributed to | TraderTraitor (North Korea), per the FBI; North Korea denies it |
| Frozen | About $2.85 billion to $3 billion, mostly stablecoins |
| Replaced by Binance | About 98% of affected tokens (November 3) |
| Withdrawals | Resumed November 1, 2026 |
| Previous record | Bybit, about $1.5 billion (February 2025) |
Binance is the world's largest crypto exchange by trading volume. The stolen money belonged to the exchange's hot wallets, the online wallets it uses to process customer withdrawals, not to individual user accounts.
What happened
Funds started leaving Binance hot wallets at 20:05 UTC on October 29. Most of the money moved within about twenty minutes, across ten blockchains, with Ethereum and Bitcoin taking the largest share. Binance stopped deposits and withdrawals, but it took until 00:10 UTC on October 30 to fully cut the attackers off.[1][2]
The delay came from how the wallets were built. Binance uses multiparty computation (MPC), where control is split across several keys, so no single key could cancel the permission the attackers had obtained.[1]
How the attack worked
Binance described the steps in a post-mortem briefing on November 3. Co-CEO Richard Teng called it "a campaign, built over many months".[1]
- June 2026. An engineer looking for an AI tool installed a tampered software package. Binance caught it and replaced the laptop, but the engineer and colleagues on the wallet team had already been exposed.
- September 2026. A software engineer was approached on a real job platform by someone posing as a project director. After a video interview with a fake HR person and a second with a fake "CEO", he downloaded a coding test onto his work computer. It contained malware that his security software did not detect.
- October 20. Using that computer and an internal AI tool, the attackers reached the machines of two wallet engineers.
- October 29. With stolen credentials they deployed a container and ran a script that used EIP-7702, an Ethereum feature that lets a wallet hand execution rights to code, to take control of a hot wallet.
Binance said it had blocked 57 suspected North Korean attempts earlier in the year.[1]
Who did it
Blockchain analysts TRM Labs and Chainalysis both pointed to North Korea within a day. The FBI then named TraderTraitor, a North Korean state group, which was also blamed for the 2025 Bybit hack.[2][3] North Korea has denied any link.
Are Binance users' funds safe?
Binance says yes. It pledged on day one to cover all losses itself rather than pass them to customers. Its SAFU emergency fund, worth about $1.2 billion, could only cover part of the gap, so most of the money comes from Binance's own reserves.[2][3]
| Date | Share of stolen tokens replaced |
|---|---|
| October 31 | About 90% |
| November 1 | About 95% |
| November 3 | About 98% |
The rest is mostly smaller tokens that take longer to buy on the market.[1][3]
Recovering the stolen money is a separate process. Stablecoins such as USDT and USDC can be frozen by the companies that issue them, which is why most of the frozen amount is stablecoins. Circle alone froze more than $1.1 billion in USDC. Bitcoin and ether have no issuer, so investigators can only follow them until they reach an exchange that can stop them. Analysts quoted by CNBC said this can take months or years.[2][3]
Market impact
Bitcoin fell below $78,000 on October 30. When withdrawals reopened on November 1, users took out $4.65 billion and deposited $1.01 billion in the first nine and a half hours, a net outflow of $3.64 billion. That was about 2.1% of the $171 billion Binance held in its last proof-of-reserves report. Binance said withdrawals then slowed.[2][3] Shares of other crypto companies also fell in the days after the hack.
Timeline
| Date (UTC) | Event |
|---|---|
| June 2026 | Engineer installs a tampered software package; device replaced |
| September 2026 | Fake job interview; malware lands on an engineer's work computer |
| October 20, 2026 | Attackers reach two wallet engineers' computers |
| October 29, 20:05 | Funds start leaving Binance hot wallets |
| October 30, 00:10 | Binance completes containment |
| October 30 | About $3 billion frozen; Binance says it will cover all losses |
| October 31 | 90% of losses replaced |
| November 1, 06:00 | Withdrawals restart on 15 networks; $3.64 billion net outflow that day |
| November 3 | Binance post-mortem; 98% replaced; independent review announced |
What happens next
Binance says it will bring in independent cybersecurity experts to review the incident.[1] Investigators will keep tracking the unfrozen bitcoin and ether as the attackers try to launder them. Expect regulators to ask how one fake job interview could end in a multi-billion-dollar loss at an exchange that holds customer money.
For ordinary crypto users, the lesson from the method is simple. Treat unsolicited job offers that ask you to download and run code with suspicion, and never run test projects on a computer that holds wallets or work credentials.
Frequently asked questions
What happened in the Binance hack?
Attackers took control of a Binance hot wallet on October 29, 2026 and moved out about $6.3 billion in crypto in roughly twenty minutes.
How much was stolen from Binance?
About $6.3 billion. Some analysts put it at $6.4 billion. Around $3 billion of it was frozen soon after.
Did Binance users lose money?
According to Binance, no. The loss came from company wallets, and Binance has replaced about 98% of the stolen tokens with its own funds.
Who hacked Binance?
The FBI says North Korea's TraderTraitor group. North Korea denies it.
Can I withdraw from Binance now?
Yes. Withdrawals reopened on November 1, 2026, starting with 15 networks.
Is this bigger than the Bybit hack?
Yes, about four times bigger. Bybit lost about $1.5 billion in February 2025.
References
- "Binance's $6.3 billion hack began with a fake job interview". CoinDesk. November 3, 2026.
- "Binance's $6.3 billion hack: What we know and what comes next". CNBC. October 30, 2026.
- "Binance sees $3.64 billion in net outflows as withdrawals resume after massive hack". CNBC. November 1, 2026.