What happened in the Binance hack?
Binance confirmed on Oct. 29, 2026, that funds were leaving its hot wallets without authorization. The exchange put the damage at roughly $6.3 billion in token assets, spread across several blockchains. Within hours it had paused withdrawals and asked customers to wait while it investigated.
Industry observers had flagged concerns hours before Binance confirmed the incident, the BBC reported. The exchange initially said about half of the affected assets had been frozen, while acknowledging that many remained in the hands of the attackers.
Crypto-tracing firm Chainalysis said the transfers began around 4:20 p.m. Eastern Time on Oct. 29. Wallets on at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana, were drained, according to analysis by TRM Labs cited by Wired. TRM said most of the money moved in about 20 minutes.
The scale is without precedent. The previous record was the $1.5 billion stolen from the Bybit exchange in 2025, which US authorities also blamed on North Korean hackers. The Binance figure is more than four times larger.
Binance is the world's largest crypto exchange. The BBC reports that it is estimated to have more than 300 million registered users and said in 2024 that it held more than $160 billion in assets under custody. A theft of this size therefore touches a very large population of retail and institutional account holders.
The company was founded in China in 2017 and became the largest crypto trading platform within a year of launch, according to CNN. It has since faced regulatory scrutiny in several jurisdictions, including the United States, where co-founder Changpeng Zhao stepped down as chief executive in 2023 after pleading guilty to anti-money laundering violations.
A hot wallet is a crypto wallet connected to the internet, which an exchange needs to process customer withdrawals. That convenience is also the weakness: if an attacker can reach the system that authorizes transfers, the wallet's holdings become reachable too. Cold storage, by contrast, is kept offline.
How did the attackers get into Binance's hot wallets?
Binance's first explanation pointed to a compromised employee laptop. Co-CEO Richard Teng said the initial investigation suggested an engineer's laptop was breached, giving an attacker access to a service container where unauthorized withdrawals were submitted. The company later said it had found additional points of breach.
Teng pushed back on the idea that one password or one click was enough. The attack was "a more complex attack process", he said, adding that investigators had found "no evidence of any wallet private key leak". Binance has not published a full technical account and declined to discuss further details with CNBC.
Chainalysis described a more specific Ethereum-side mechanism. An operational wallet, funded through the mixing service Tornado Cash, submitted valid signed authorizations that let a Binance hot wallet run code deployed by the attacker. The attacker then called that wallet to sweep assets into addresses under their control.
TRM Labs said the operation was rehearsed. Preparation began at least 36 hours before the theft, with the attacker testing code on two wallets and then practicing on a third, according to the firm's analysis reported by Wired. About four hours after that rehearsal, the same code was installed on a Binance hot wallet.
The unexplained parts still matter. Investigators have not said how the engineer's laptop was infected, which software was involved, or how many employees and systems were reached. Binance has promised a technical post-mortem once its investigation concludes, but no date has been given.
Reuters reported that Teng described a "complex attack" involving a compromised laptop and malicious software designed to delete evidence of its activity. Reuters said that design made the intrusion harder to trace and investigate.
How much of the $6.3 billion has been frozen?
Freezing began quickly, but it could not reach everything. Chainalysis said freezes started by 5:14 p.m. Eastern Time on Oct. 29 and that about $2.8 billion had been frozen. Elliptic put the figure at roughly $2.8 billion, or about 44 percent of the total, and said almost all of it was stablecoins.
Stablecoin issuers did much of the work. The BBC reported that Tether and Circle froze a total of about $2.4 billion in response to the hack. World Liberty Financial, a crypto company linked to President Donald Trump's family, said it had also worked with partners to freeze stolen funds.
The attackers tried to outrun those freezes. Chainalysis said they swapped $325 million in stablecoins for $285 million in ETH over nearly 20 minutes, moving value into an asset that issuers cannot blacklist. The gap of about $40 million was the cost of converting that quickly.
Freezing a stablecoin means the issuer adds an address to a blacklist, which stops those tokens from moving. That is why the attackers rushed to convert USDT and USDC into ether. Chainalysis said they first moved $500 million of stablecoins into a dedicated swap wallet, then sent the remaining $175 million to stopover wallets about ten minutes later.
The rest is harder to stop. Elliptic's Tom Robinson told Wired that the remaining $3.3 billion is mostly bitcoin, ether and XRP, which no one can freeze centrally. Those coins can only be intercepted when they reach an exchange or another service that checks the addresses against sanctions and watchlists.
Robinson was blunt about the ceiling on recovery. "I don't expect the frozen share to rise much further," he said. Pangolin Intelligence, a Singapore-based tracing firm, told CNN that the "cat and mouse game" over the money had barely begun.
Why does the FBI blame North Korea?
The FBI published an alert on Oct. 31, 2026, stating that North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about Oct. 29. The bureau said it refers to this specific malicious cyber activity as "TraderTraitor". The FBI worked with the US Secret Service and the IRS Criminal Investigation unit.
The alert said TraderTraitor actors were converting stolen assets primarily into Ethereum. The FBI expects them to keep laundering the funds through decentralized finance and instant swap services. It published a long list of Ethereum addresses and urged node operators, exchanges, DeFi services and analytics firms to block transactions tied to them.
Private analysts had reached a similar conclusion earlier. Chainalysis said it had high confidence that TraderTraitor was responsible. Its strongest evidence was watching Binance funds commingle on-chain with money from an earlier Bitget exploit that had been attributed to North Korean actors.
TRM Labs pointed to familiar patterns, including small Tornado Cash withdrawals used to fund an operator wallet and staging that began well before the theft. Elliptic's Robinson said the firm saw overlaps with North Korean activity but had not tied this hack specifically to TraderTraitor.
Check Point said TraderTraitor is also known in the industry as the Lazarus Group. That unit was blamed for the $1.5 billion Bybit theft in 2025. Western security agencies have said North Korean crypto thefts help finance the country's nuclear weapons and missile programs. Pyongyang has denied involvement in past hacks.
Binance did not directly answer BBC questions about a possible North Korean link. It said it was working with law enforcement partners to confirm the identity of the criminals and bring them to justice. Elliptic's Robinson said the stakes are hard to overstate: "If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date."
Is Binance covering the stolen funds?
Binance says customers will not absorb the loss. The company said it had set aside more than $6.34 billion in reserves to cover the impact, including $5 billion held in the exact tokens that were stolen. It drew on its corporate treasury, part of its Futures insurance fund and part of its Secure Asset Fund for Users, known as SAFU.
SAFU is a roughly $1 billion bitcoin reserve that Binance keeps for emergencies. Reuters reported that the replenishment involved a partial deployment of that fund. Binance also said its ten largest listed tokens are "fully backed 100%": BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC.
By Oct. 31, Binance said about 90 percent of the stolen assets had been replaced. The remaining 10 percent consists of less liquid tokens outside the top ten. Binance said it would keep buying those assets through market and over-the-counter channels until coverage reaches 100 percent.
The company's co-CEO, Yi He, thanked token issuers for freezing assets and restated the priority. "Safety first: withdrawals are currently disabled until the environment is confirmed to be secure," she said, according to the BBC.
The distinction between coverage and recovery is important. CNBC noted that restoring backing for 90 percent of the assets does not mean Binance has recovered 90 percent of the money from the attacker. The exchange is making customers whole from its own balance sheet while investigators chase funds that may never be returned.
Binance also took a fresh proof-of-reserves snapshot at midnight GMT on Saturday, part of its effort to show that customer balances are backed. Users holding the ten listed tokens should be able to verify at least 1:1 backing once the full proof is published. A snapshot is a point-in-time check, not a guarantee against future breaches.
What does the hack mean for crypto users?
The immediate impact fell on Binance.com customers. The exchange suspended withdrawals on Oct. 29 and said trading was unaffected. Its US affiliate, Binance.US, said it was a separate platform and was not affected, and Coinbase said it was unaffected and monitoring the situation.
The market reaction was sharp but not panicked. The BBC reported that bitcoin fell more than 4 percent after alerts about a possible hack circulated. CNN reported that bitcoin and ether were still 2 to 3 percent lower by midday Friday in Hong Kong, having regained part of the initial drop.
The episode highlights a structural risk in crypto. Exchanges hold customer assets in custody, which makes them attractive targets and concentrates losses when controls fail. Unlike a stock brokerage, where ownership is recorded in a central system, a crypto exchange's hot wallets are directly drainable if the signing path is compromised.
Researchers describe TraderTraitor as a specialist in large, high-value intrusions. Sophos's Rafe Pilling told Wired that the group focuses on these bigger operations and has built fake applications to get inside organizations. The group has also targeted employees directly, which is consistent with Binance's account of a compromised engineer's laptop.
It also shows how much power stablecoin issuers now hold. Tether and Circle could freeze about $2.4 billion because they control the contracts behind USDT and USDC. That power limited the damage here, but it also means private companies can decide which balances are spendable.
Proof-of-reserves has limits too. A published snapshot can show that liabilities were backed on a given day. It cannot show whether the systems that authorize withdrawals are secure, which is the failure mode in this case. Users can check Binance's official announcements for the withdrawal schedule and proof-of-reserves updates.
What happens next in the Binance investigation?
The first milestone is withdrawals. Binance said it remained on track to reopen them on Sunday, Nov. 1, subject to security checks and final confirmation. That target had not been confirmed as met at the time of writing, so customers should treat the date as a plan rather than a guarantee.
The second is disclosure. Binance has promised a comprehensive technical post-mortem once its investigation is complete. That document should explain how the engineer's laptop was compromised, how many systems were reached and what controls failed. Until it appears, the public account rests on brief statements and third-party tracing.
The third is the money trail. Chainalysis said the laundering showed signs of automation, with thousands of transactions and many addresses first receiving exactly 1 TRX before moving funds onward. That pattern suggests a programmatic process aimed at obscuring the trail, and it means tracing could take months.
TRM Labs' Ari Redbord told the BBC that the hack is a "watershed moment" for the industry. He said the attacker still holds an enormous sum, which means efforts to trace and recover the funds are far from over.
Law enforcement is involved on several fronts. The FBI, Secret Service and IRS-CI are coordinating, and the Secret Service said it was working with Circle and the US Attorney's Office for the District of Columbia. Binance said it had revoked authorizations on affected addresses and was cooperating with token issuers and blockchain intelligence firms.
The larger question is whether the industry changes its security model. Check Point's Jayant Dave said the attack resembles earlier incidents in one key respect. "They target the systems and people with authority to use them," he said. If that is right, then more cold storage and more audits will not be enough on their own.