Binance hack 2026: the largest crypto hack in history

Binance told its customers that their money was safe. The wallets that were emptied, however, appeared on the exchange's own list of assets backing those customers, published four weeks earlier. Both statements can be true at the same time, and the gap between them is the most useful thing to understand about the Binance hack 2026.

The facts first. On the evening of October 29, an attacker drained hot wallets at Binance, the world's largest cryptocurrency exchange, across roughly ten blockchains. Binance puts the damage at about $6.3 billion, most of it moved in around 20 minutes. That makes it the largest crypto hack in history, roughly four times the Bybit theft of 2025. Binance paused deposits and withdrawals and pledged to cover every loss.

Some of the numbers below will move. The story is two days old, and Binance has not yet published its post-mortem; treat every figure as a snapshot from October 30 and 31.

What happened in the Binance hack 2026, minute by minute

Speed was the weapon here. But that speed was bought with patience, and the patience is what makes this look like a professional operation rather than a lucky break.

Twenty minutes across ten blockchains

According to blockchain analytics firm TRM Labs, the attacker began funding wallets through Tornado Cash, a mixing service that hides where coins come from, on the morning of October 28. That is at least 36 hours before a single coin left Binance.

The first outflows came at 20:05 UTC on October 29, on the XRP Ledger. Bitcoin followed at 20:20 UTC. At the same minute, the attacker submitted 50 authorization requests to a Binance hot wallet on Ethereum. About three and a half minutes later, that wallet was swept clean in one transaction. Further sweeps continued until 23:56 UTC, with a second wave on Avalanche and Polygon around 23:05 UTC.

Shortly before midnight UTC, it was over.

Where the $6.3 billion came from

The money did not come from one place. It came from hot wallets on at least ten networks, which tells you the attacker had some form of access to Binance's withdrawal machinery on several chains at once.

Source: TRM Labs, data as of October 30, 00:30 UTC.

You will see different totals in the news, and that is normal. Binance says about $6.3 billion. TRM Labs counts $6.36 billion at the moment of theft. Chainalysis says roughly $6.4 billion, and Elliptic $6.43 billion across 11 chains. The gap comes from pricing time and which chains each firm includes; nobody disputes what happened.

How EIP-7702 turned a Binance hot wallet against itself

The Ethereum part of the Binance hack is clever, and it has drawn most of the attention. It is also, on its own, an incomplete explanation.

Hot wallets and cold storage, in plain terms

An exchange stores crypto the way a shop stores cash. Most of it sits in a vault, which in crypto is "cold storage": keys kept offline and deliberately slow to move. A smaller amount sits in the till so customers can withdraw quickly. That till is the hot wallet, connected to the exchange's systems and able to sign transactions on demand.

Hot wallets are meant to hold a fraction of total assets. At an exchange the size of Binance, though, a fraction can still be billions of dollars.

Fifty signatures and a hole in the theory

EIP-7702 is an Ethereum upgrade that went live with the Pectra update in May 2025. It lets an ordinary wallet hand control of its actions to a piece of smart contract code, as long as the wallet signs an authorization. Think of it as a power of attorney for a bank account.

The attacker used exactly that. TRM Labs reports that the attacker prepared 50 signed authorizations, each tied to a different transaction counter, so that one of them would match the wallet's current state. One did. The hot wallet then ran the attacker's "sweeper" code and sent its tokens away in a single move. Binance co-CEO Richard Teng said the delegation bypassed the exchange's normal approval controls.

Here is the part that does not add up for me. EIP-7702 exists only on Ethereum and compatible chains. It cannot explain how 18,270 BTC left a Bitcoin wallet, or how Tron and XRP funds moved. Those required ordinary signed transfers, which suggests the attacker reached Binance's signing infrastructure itself.

Binance's own account has already shifted. Its first update — posted within hours of the theft — blamed a single compromised laptop belonging to a DevOps engineer, which gave access to a service container, and said there was "no evidence of private key leak." A day later, the exchange said it had found "additional points of breach." Neither version is wrong, necessarily. But a story that changes in 24 hours is a reason to wait for the post-mortem before drawing firm conclusions.

Binance says your funds are safe. Read the fine print

For ordinary users, the Binance hack 2026 comes down to one sentence from the exchange, repeated in every update. Binance's message has been consistent: customer funds are safe, and the exchange will cover all losses from its emergency fund and company money. I have no reason to think the exchange will fail to pay. The question is what kind of promise this is.

What SAFU can and cannot cover

Binance says it has reserved $6.34 billion to cover the hack, of which about $5 billion is already held in the affected tokens. It is buying the remainder on the market and through over-the-counter desks. Frozen assets are not counted in that figure.

The Secure Asset Fund for Users, or SAFU, gets mentioned often. It is smaller than many assume. Binance describes it as roughly $1 billion, and its on-chain Bitcoin wallet holds about 15,000 BTC, worth around $1.17 billion at Friday's prices. Sean Farrell of Fundstrat estimates that SAFU could cover about a third of the unfrozen losses. The rest comes from Binance's own balance sheet.

That is a fine outcome if the balance sheet is strong. Still, SAFU's own rules give Binance "full discretion" over payouts, and lawyers quoted by the BBC warned that the pledge may not be legally binding. A promise backed by billions is still a promise, not a contract.

The proof-of-reserves problem

Proof of reserves is a public list of wallets an exchange uses to show it holds at least as much crypto as its customers deposited. CoinDesk checked Binance's October 1 report and found that the drained Ethereum wallet, labelled Binance 14, was on it.

The roughly 204,500 ETH taken in the hack at Binance was about 5.6% of the ether Binance listed as customer backing. Until that ether was replaced, ETH reserves sat near 94% of customer balances instead of above 100%. Binance may top this up quickly, and its USDC backing stood at 108%. But "customer funds were not affected" is better read as "customers will not bear the loss," which is a different claim.

To be fair, Farrell sees no meaningful solvency risk. His test is simple: how fast withdrawals reopen, and whether outflows stay orderly.

Binance hack freezes: why stablecoins came back and Bitcoin did not

Freezing is the one part of this story that worked, and it worked for a reason that crypto purists often dislike.

Stablecoins such as USDT and USDC are issued by companies that control the token contract. They can freeze, burn and reissue tokens. TRM Labs logged the response: Tether froze funds at 21:01 UTC, Circle at 21:04, Ripple at 22:01, World Liberty Financial at 22:10, and Arbitrum's Security Council shortly after midnight.

By Elliptic's count, $2.84 billion is now frozen, about 44% of the theft and almost all of it in stablecoins. Binance's own estimate is close to $3 billion.

Bitcoin and ether have no issuer. Nobody can switch them off. TRM estimates that roughly $2.4 billion in BTC and ETH remains under the attacker's control. Investigators can follow those coins on public blockchains and try to intercept them at exchanges, but that takes time.

Even frozen money is not returned overnight. In comments to CNBC, Ari Redbord of TRM Labs said that a freeze "stops the money from moving," while recovery requires a court order. Chainalysis head of research Eric Jardine said returning funds "can take months or years."

How the Binance hack ranks among the largest in history

Headlines have focused on the size of the record. The pattern behind it worries analysts at TRM Labs and Elliptic more, because they have tracked it several times this year.

TRM Labs and Chainalysis both attribute the attack with high confidence to TraderTraitor, a North Korean state-backed hacking unit. Part of the evidence is on-chain: the Binance proceeds were mixed with funds stolen from Bitget a month earlier. Elliptic is more cautious, and no government has made a formal attribution yet. Binance itself has not named a culprit.

The method is familiar — long preparation, transactions signed in advance, then one massive burst before anyone can react. The same pattern showed up at Bybit, KelpDAO and Bitget. By TRM's count, North Korea has stolen $12.8 billion in crypto since 2017, and $7.4 billion of that in 2026 alone, about 85% of the value taken in hacks this year. The industry has known this playbook for at least 20 months. It still worked at the biggest exchange in the world.

Market and political news after the Binance hack

Markets took the hit calmly, by crypto standards. CNBC reported Bitcoin down 4.1% to about $77,446 on Friday, with ether down 4.4% and BNB down 6% to around $701. More than $1.6 billion in leveraged positions were liquidated over 24 hours, according to CoinGlass data.

The political response came fast. The FBI said it was aware of the incident, and the US Secret Service said it was working with Circle. CFTC Chairman Michael Selig said the hack "proves our exact point" for the agency's October 5 proposal to require offshore exchanges serving Americans to register. Binance.US, a separate company, said it was not affected.

What Binance users should do while withdrawals are paused

After the Binance hack, the threat most users will actually meet this week comes from scammers. They follow every major crypto hack with fake "withdrawals are back" messages and "refund" forms that ask for your login or recovery phrase.

Binance says it aims to restart withdrawals on Sunday, November 1, and to publish a full proof of reserves by Monday, November 2. Until then, a few sensible steps:

• Use only the official Binance app or the website you type in yourself. Ignore links in DMs, emails and search ads.
• Review your account's API keys, logged-in devices and withdrawal whitelist, and remove anything you do not recognize.
• Never share a recovery phrase or 2FA code. No real support agent will ask.
• When withdrawals reopen, check the network and address twice. Rushed transfers cause their own losses.

There is also a longer-term lesson. Coins you plan to hold for years do not need to sit on any exchange. A hardware wallet you control removes this whole category of digital risk, though it adds a new one: you become responsible for your own keys.

The Binance hack 2026 verdict: a promise, not a guarantee

Binance will probably make every customer whole. It has the money, and it has every commercial reason to do so. That is the reassuring part.

The uncomfortable part is that users are relying on Binance's willingness, not on a legal obligation, and that the exchange's account of how it was breached has already changed once. The post-mortem will show whether this was one bad laptop or something deeper in the way the world's biggest exchange signs its transactions.

So here is the question worth asking of any platform holding your crypto after the Binance hack: if it lost billions tomorrow, what exactly would you be owed, and by whom? If you cannot answer that, this week is a good time to find out.

Marco Lucchetti

Marco Lucchetti is a senior content strategist and blockchain analyst at Plisio. With over 7 years of experience in cryptocurrency research, DeFi protocols, and payment technologies, Marco specializes in creating clear, data-driven content for a global crypto audience. His work focuses on transaction tracing, crypto compliance, and the future of blockchain infrastructure.