LONDON — Binance, the world's largest cryptocurrency exchange, has suffered the biggest theft in the history of digital assets, with hackers draining about $6.3 billion from wallets it uses to process transactions late on Thursday, 30 October 2026, according to Reuters. The exchange halted withdrawals after the attack, said it would cover customer losses from company funds, and, working with industry partners, has frozen about $3 billion of the stolen assets so far.
The heist, which unfolded largely in about 20 minutes, has shaken an industry that is becoming more embedded in mainstream finance, Reuters reported on 30 and 31 October. Rival exchanges moved on Friday to shore up their own systems and reassure customers, while US blockchain analysis firms said the attack bore similarities to previous operations attributed to North Korean hackers — an attribution Binance itself has not made, and which North Korea routinely denies.
Illustration: A cryptocurrency exchange trading floor with digital coin symbols and a secure vault, representing Binance, the world's largest crypto exchange.
What Happened
According to Reuters, citing Binance and expert analysis of blockchain records, about $6.3 billion of cryptocurrencies were drained from wallets that Binance uses to process transactions. The bulk of the theft unfolded in around 20 minutes beginning shortly after 2000 GMT on Thursday, blockchain records show.
Binance co-chief executive Richard Teng said on X that the "complex attack" may have begun with a compromised software engineer's laptop, giving hackers access to systems used to process withdrawals, Reuters reported. The exchange initially thought the attack involved a compromised laptop, it said in a statement on X. The investigation is ongoing, and Binance has said it cannot yet confirm the cause of the hack.
Binance said it had worked with partners to freeze the affected assets, with about $3 billion located so far, Reuters reported. It gave no update on the status of the remaining roughly $3.3 billion. Binance co-founder Yi He said the company would cover "all hacking losses", and on Friday the exchange said it had reserved more than $6.34 billion in company funds, including $5 billion already held in impacted token assets, to deal with the fallout, Reuters reported.
Stablecoin issuers moved quickly to freeze tokens linked to the theft. Tether said it had frozen nearly $1.57 billion linked to Binance, while Circle said it froze $800 million, Reuters reported. About half the stolen assets were stablecoins that have since been frozen by issuers including Tether, Circle, Ripple and World Liberty Financial, according to TRM Labs, the US blockchain analysis firm.
Crypto prices fell on the news. Bitcoin fell more than 4% on Thursday and hit a six-week low, last down 3% at $76,469.82, while ether, the second-largest cryptocurrency, fell more than 5% on Thursday and was last down more than 3% at $2,185.83, Reuters reported. Both tokens recovered some ground on Friday.
Illustration: Falling digital coins beneath a downward market chart, as cryptocurrency prices dropped after the Binance theft was disclosed.
Background
US blockchain analysis firm TRM Labs said an attacker moved approximately $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes, and attributed the attack to TraderTraitor, a North Korean hacking group, "based on robust on and off-chain intelligence" and "with high confidence", Reuters reported. TRM said the breach shared characteristics with last year's attack on crypto exchange Bybit, which the FBI attributed to North Korean hackers.
Binance has not identified the attackers. Teng said its investigation had not yet identified them, Reuters reported. North Korea routinely denies involvement in cryptocurrency thefts, and its mission in Geneva did not respond to requests for comment, Reuters said. The attribution therefore remains, for now, the assessment of private analysis firms rather than a confirmed finding by Binance or by law enforcement.
Reuters reported on Friday that North Korean hackers linked to the theft are among the world's most prolific crypto thieves, and that the proceeds help fund the country's weapons programmes, according to cybersecurity experts. Chainalysis said in a December 2025 report that North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, including the $1.5 billion Bybit hack of February 2025, Reuters reported. A researcher with cybersecurity firm DTEX put the minimum total of North Korean crypto theft at roughly $13.5 billion, including a $387 million theft from exchange Bitget in September, Reuters said.
The Binance theft dwarfs previous crypto heists. Reuters' ranking of major thefts lists the February 2025 Bybit theft at $1.5 billion and the August 2021 Poly Network theft at $610 million, with hackers later returning nearly all of the Poly Network funds. At $6.3 billion, the Binance breach is more than four times the Bybit figure, making it the largest cryptocurrency heist on record, according to Reuters.
The attack also comes as crypto exchanges are becoming more embedded in mainstream finance, Reuters noted, which is why the industry's response — freezing assets, tightening key storage and sharing information — matters beyond the crypto market itself. Coinbase said it made adjustments to its systems that store cryptocurrency keys offline, Reuters reported on 31 October, as rival exchanges moved to reassure customers that their tokens were safe.
Why It Matters
First, the sheer scale tests the industry's promise that customer funds are safe. Binance says it will cover losses from company funds and through its secure asset fund for users, a $1 billion bitcoin reserve designed to protect customers in a security breach, according to its website as cited by Reuters. Co-founder Yi He said on Friday that Binance does not need to sell its SpaceX shares to cover the losses because its annual revenue is enough, Reuters reported. Whether customers are made whole quickly — and transparently, through the public proof-of-reserves verification Binance has promised — will shape trust in the largest exchange in the market.
Second, the freezing of about $3 billion shows both the power and the limits of crypto's plumbing. Stablecoins can be frozen by their issuers, which helped contain part of the theft, but TRM Labs estimated that about $2.4 billion worth of bitcoin and ether is beyond reach, with some funds already posted as collateral to borrow ether, Reuters reported. The race between freezing, laundering and borrowing against stolen funds is now the central technical contest of the investigation.
Third, the attribution question carries geopolitical weight. If law enforcement confirms a North Korean link, the theft would join a long series of crypto thefts that, according to the FBI, help fund North Korean nuclear and military programmes. The FBI said in an October 13 public service announcement that money raised by North Korean hackers and by North Koreans secretly working at tech and financial companies helps fund those programmes, Reuters reported. That would put the heist on the agenda of sanctions enforcement, not just of crypto regulation.
Illustration: Cybersecurity investigators tracing frozen digital assets on computer screens, as exchanges and law enforcement track the stolen Binance funds.
What Happens Next
Binance is working with law enforcement around the world, including the FBI and the United States Secret Service, a person familiar with the situation told Reuters on 30 October. The US embassy in London said it had no comment, and the Secret Service did not respond to a request for comment sent outside US hours, Reuters said. Further official statements on the attackers' identity, if any, are likely to come through those channels rather than through Binance alone.
Industry defences are already changing. Crypto exchanges called on Friday for quicker moves to bolster defences and greater industry-wide information-sharing after the heist exposed their vulnerability, Reuters reported on 31 October. Executives expressed confidence that Binance had sufficient resources to cover the losses and that the hack would not have broader financial repercussions, Reuters said — a claim markets will test as more of the stolen funds move, freeze or surface.
For customers and investors, the next checkpoints are concrete: how much of the remaining roughly $3.3 billion is located or frozen, whether Binance's proof-of-reserves verification confirms that all user funds are covered, and whether bitcoin and ether stabilise after Thursday's fall. For regulators, the question is whether the largest heist in crypto history accelerates new rules on exchange security, key storage and information-sharing — or whether the industry's rapid, coordinated freeze is presented as evidence that the current system worked.
Sponsored: explore today's featured sponsored offers
FAQ
How much was stolen from Binance?
About $6.3 billion of cryptocurrencies, according to Binance and expert analysis of blockchain records cited by Reuters — the largest cryptocurrency heist on record, more than four times the $1.5 billion Bybit theft of February 2025.
How quickly did the heist happen?
The bulk of the theft unfolded in about 20 minutes beginning shortly after 2000 GMT on Thursday, 30 October 2026, according to blockchain records cited by Reuters and TRM Labs.
How much has been frozen so far?
About $3 billion in assets has been frozen with help from industry partners, Binance said. Tether froze nearly $1.57 billion linked to Binance and Circle froze $800 million, Reuters reported. About $3.3 billion had no update on its status at the time of reporting.
Will Binance customers lose money?
Binance says no: co-founder Yi He said the company would cover "all hacking losses", and on Friday it said it had reserved more than $6.34 billion in company funds. All user funds will be verified publicly through its proof of reserves, Binance said, according to Reuters.
Who was behind the attack?
US blockchain firm TRM Labs attributes it to TraderTraitor, a North Korean hacking group, with high confidence, citing similarities to the Bybit attack. Binance has not identified the attackers, and North Korea routinely denies involvement in cryptocurrency thefts, Reuters reported.
Sources
Reuters, "Gone in 20 minutes: How the biggest heist in crypto history unfolded", 30 October 2026; Reuters, "Crypto exchanges call for quick moves to bolster defenses after Binance heist", 31 October 2026; Reuters, "Binance sets aside over $6.34 billion to cover losses from attack", 30 October 2026; Reuters, "Blockchain analysis firm TRM says North Korea behind Binance crypto theft", 30 October 2026; Reuters, "FBI and US Secret Service working with Binance after $6.3 billion hack, source says", 30 October 2026.
Comments
Post a Comment