The Binance Hack, Explained: How $6.3 Billion Was Stolen and What to Do Now

This is a developing story. Binance has not published its final report, and this post will be updated as facts are confirmed.

On October 29, 2026, attackers took about $6.3 billion from Binance's hot wallets, the largest crypto theft on record. The FBI attributes it to North Korea's TraderTraitor group. Binance says it will absorb the loss and had covered about 95% by November 1, when withdrawals began resuming in phases. About 18,270 bitcoin was stolen, and no issuer can freeze bitcoin the way stablecoins were frozen. Binance has not published a final root cause and says it found no evidence that private keys leaked.

The headline facts

• Date: October 29, 2026, starting around 20:05 UTC
• Loss: about $6.3 billion, by Binance's estimate. TRM Labs counts $6.36 billion across ten blockchains.
• Speed: most of the funds left in about 20 minutes, according to TRM Labs
• Bitcoin taken: about 18,270 BTC, worth roughly $1.47 billion
• Attribution: North Korea's TraderTraitor group, according to the FBI
• Frozen: about $3 billion on-chain, according to Binance
• Covered so far: about 95% as of November 1, according to Binance
• Scale: roughly four times the $1.5 billion Bybit hack of February 2025

How the attackers got in

Binance's first update pointed to a compromised laptop belonging to a DevOps engineer, which gave the attacker access to a service container and let them submit unauthorized withdrawals. Its next update said the investigation had found additional points of breach. Binance also said it had found no evidence that wallet private keys were leaked.

TRM Labs, a blockchain analytics firm, assesses that the attacker compromised the infrastructure that signs transactions for Binance's hot wallets, the online wallets an exchange keeps ready for everyday withdrawals. On Ethereum, TRM describes a single transaction carrying 50 pre-signed authorizations that handed control of a hot wallet to an attacker's contract. The attacker had been preparing for at least 36 hours. That account is TRM's assessment, and Binance has not confirmed it.

If the early findings hold, the attacker never needed to steal a private key, because the system could be made to sign. Bybit lost $1.5 billion in 2025 when a compromised signing interface showed its signers the wrong transaction. Bybit used multisig, but one company controlled every key, so compromising that company reached the whole quorum. Bitget lost $387.5 million in September when attackers used stolen internal credentials to issue fraudulent withdrawal commands. Binance says a full post-incident report is coming.

Cold storage helps, but it doesn't settle the question

Keeping coins offline protects against this kind of attack. The stolen funds came from hot wallets, not from Binance's offline reserves. But Bybit's loss came during a transfer out of cold storage, so offline keys don't help if the approval process can be fooled. What matters is who can approve a transaction, and whether one breach reaches all of them.

Who is paying for it

Binance says customers will not bear the loss. As of its November 1 update, it had covered about 95% of the impacted amount, and the remaining 5% is in less liquid tokens that take longer to buy. The money came from its SAFU emergency fund, part of its futures insurance fund, and its corporate treasury. Binance set aside more than $6.34 billion, and an analyst quoted by CNBC saw no meaningful solvency risk from the breach. By 10:30 a.m. ET on November 1, Binance had processed about $4.6 billion in withdrawals against $1 billion in deposits, according to CNN.

Binance has done what it promised so far. Its pledge is still a business decision backed by its own money. "Nothing in the law requires it to," Onramp CEO Michael Tanguma told CNBC. Crypto on an exchange has no FDIC or SIPC protection, and a smaller exchange facing a loss of this size could not make the same promise.

Why the bitcoin is the hardest part to recover

About $3 billion of the stolen money has been frozen, and most of that froze because a company stands behind the token. Tether and Circle can block their own stablecoins, and they moved within hours.

Bitcoin has no issuer, so no company can freeze it. TRM Labs reports that the attacker moved the 18,270 BTC through a chain of smaller transfers, in round amounts of 1,000 and 100 BTC, to make it harder to trace. Investigators can follow those coins on-chain and exchanges can refuse them, but recovery depends on the coins reaching someone who will stop them.

Once bitcoin leaves, there is no bank to call and no issuer to ask, so the protection has to work before a transaction is signed.

What to do if you hold bitcoin

If you have funds on Binance: there is no need to rush. Binance began restoring withdrawals in phases on November 1, starting with 15 networks including bitcoin, and warned that some withdrawals may be delayed or need a retry. If you move funds, send a small test amount first and confirm that it arrives before sending the rest.

Watch for scams. Large hacks are followed by fake support messages, fake refund offers and fake verification links. No legitimate company will ask for your password, your verification codes or your recovery words. Get updates from Binance's official channels only, and ignore anyone offering to recover funds for a fee.

If you hold on any exchange: use an authenticator app or a physical security key instead of text message codes, use an email address and password you use nowhere else, and turn on an allowlist of approved withdrawal addresses. Exchanges generally treat a stolen login as the customer's loss, so these settings matter even when the exchange itself is never hacked.

If your funds are stolen: act within the first hour if you can. Contact the exchange to freeze your account, change your passwords from a device you trust, save the transaction details, and file a report with the FBI at ic3.gov.

If you hold your own keys: this hack does not touch your coins, and self-custody remains a sound choice for people who want it. Your weak points are different ones: a lost device, a backup found by the wrong person, a tampered wallet, a transaction approved under pressure, or a family that can't reach the funds after a death. Moving savings off an exchange trades one kind of risk for another.

Why this is bigger than one exchange

The Binance hack capped a year of failures on both sides of the custody debate. In July, a firmware flaw in Coldcard hardware wallets exposed seeds their owners believed were random. In September, Bitget lost $387.5 million. In October, Ledger confirmed a hardware implant in a device sold by an authorized reseller, and Keystone disclosed that an attacker had taken 25,964 buyer records and the key it uses to verify its devices are genuine, and it is destroying 18,835 wallets as a result. Keystone says recovery phrases and private keys were not compromised.

In each case, one company, one device or one approval system stood between the owner and a loss. Onramp's report The Third Way makes that argument in full.

The same concentration runs through US bitcoin ETFs. Funds naming Coinbase as custodian hold more than 80% of US spot bitcoin ETF assets. After the Binance hack, Coinbase's chief security officer said it was blocking transfers to the compromised wallets and had adjusted its cold storage systems as a precaution. There is no evidence that Coinbase or any ETF was compromised. The point is structural: when most of a market sits with one provider, that provider's security becomes the market's security.

Three questions to ask about any custody setup

Is your bitcoin pooled? An exchange typically holds customer coins in shared wallets, so one compromised signing system reaches many customers at once. In a segregated setup, your bitcoin sits at its own on-chain address, verifiable by you at any time.

Who can approve a transfer? If every approval runs through one organization's staff, laptops and software, one breach can reach all of them. Ask how many independent institutions must agree, and whether they share systems.

What do you own if something goes wrong? Ask whether you hold your bitcoin or a claim on a company, and whether it is ever lent out. When FTX and Celsius failed, the law treated customers as creditors, not owners of their coins, and they waited in line with everyone else the company owed. Proof of Reserves can't answer this. Binance posted a fresh reserve snapshot after the hack, and a snapshot shows balances at a moment in time. It says nothing about how those balances could leave.

How Multi-Institution Custody is built differently

Three institutions protect your bitcoin. No one of them can lose it, move it, or use it, and nothing moves without your permission.

Multi-institution custody works like a bank vault that needs two keyholders to open: it takes two of the three (Onramp, BitGo, and CoinCover) to move your bitcoin. Onramp, BitGo, and CoinCover each secure a key offline, never on a consumer device, in a 2-of-3 multisig. You never hold a key yourself.

The design answers the three questions above. Each client's bitcoin sits in a segregated vault at its own on-chain address, never pooled or lent out, and you can verify it on any block explorer at any time. Withdrawals require an independent second signature from BitGo after separate identity verification, so a breach at one organization doesn't reach the others. That is the difference from Bybit, where every key sat inside one company. Client bitcoin is legally the client's property, not part of any Onramp bankruptcy estate. Onramp holds $1B+ in bitcoin under Multi-Institution Custody.

No custody system is unbreakable, and any firm claiming otherwise this week should be ignored. The claim here is narrower: no single failure, including one at Onramp, can move client bitcoin.

Frequently asked questions

What happened in the Binance hack?

On October 29, 2026, attackers took about $6.3 billion from Binance's hot wallets across ten blockchains, most of it in about 20 minutes. It is the largest crypto theft on record. Binance paused withdrawals, pledged to cover all losses, and began restoring withdrawals in phases on November 1.

Who hacked Binance?

The FBI attributes the theft to TraderTraitor, a North Korean state-sponsored group. The FBI tied the same group to the $1.5 billion Bybit hack in 2025. TRM Labs and Chainalysis reached the same conclusion on North Korea.

How much bitcoin was stolen from Binance?

About 18,270 BTC, worth roughly $1.47 billion, according to TRM Labs. The rest of the $6.3 billion was mostly ether, stablecoins and other tokens.

Did Binance customers lose money?

Binance says customers will not bear the loss. It had covered about 95% of the impacted amount by November 1, using its SAFU fund, part of its futures insurance fund and its corporate treasury. Customers were unable to withdraw while services were paused.

Is Binance safe now?

Binance has resumed withdrawals and says its top ten assets are fully backed, but it has not published a final root cause, and it says it is rebuilding and retesting its infrastructure. Any exchange remains a single institution holding your bitcoin, so how much to keep there depends on what you can afford to have tied up or at risk.

Should I move my bitcoin off Binance?

Exchanges are built for buying and selling, and long-term savings are usually better held elsewhere. If you move funds, go slowly, send a small test amount first, and use only official channels. Moving trades exchange risk for a different risk, so choose where the bitcoin is going before you send it.

Can the stolen bitcoin be recovered?

Bitcoin can't be frozen by an issuer, so recovery depends on tracing the coins and on exchanges or law enforcement stopping them. Binance says it is working with partners and law enforcement. Frozen stablecoins are easier to pursue, though returning them can take months or years.

Is cold storage safer?

Keeping coins offline protects against attacks on hot wallets like this one, but it doesn't protect against a fooled approval process. Bybit's $1.5 billion loss came during a transfer out of cold storage.

Is it safer to split bitcoin across several exchanges?

Splitting limits how much one failure can cost, but it accepts that part of the money can be lost, and it gives you more accounts to secure. Each exchange is still a single institution holding your bitcoin.

Is crypto on an exchange insured or FDIC protected?

No. FDIC and SIPC do not cover crypto held on an exchange. Exchange reserve funds are spent at the exchange's discretion, and private insurance varies, so ask what is covered, what is excluded, and whether you have any right to repayment.

Did the Binance hack affect Coinbase or bitcoin ETFs?

There is no evidence that Coinbase or any bitcoin ETF was compromised. Coinbase said it blocked transfers to the compromised wallets and adjusted its cold storage systems as a precaution.

Sources and further reading

• Binance, Security Incident Update and Update #2 (Oct. 30), Recovery Update #3 (Oct. 31) and Recovery Update #4 (Nov. 1)
• TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• CNBC, Binance's $6.3 billion hack: What we know and what comes next
• CNBC, Binance hack safety guide (Oct. 31), with comment from Michael Tanguma
• CNN, Binance withdrawals resume following $6 billion hack
• CryptoSlate, OneKey founder warns BlackRock's Bitcoin ETF could be a North Korean target (Coinbase statement and custody figures)
• Bankless, Keystone breach widens as attacker grabs its device authentication key