The Binance Hack, Explained: How $6.3 Billion Was Stolen and What to Do Now

Updated November 3, 2026, with Binance's initial incident report. Binance's investigation is ongoing, and this post will be updated as facts are confirmed.

On October 29, 2026, attackers took about $6.3 billion from Binance's hot wallets, the largest crypto theft on record. The FBI attributes it to North Korea's TraderTraitor group. Binance says it will absorb the loss and had replenished 98% of the affected token assets by October 31. Withdrawals began resuming in phases on November 1. About 18,270 bitcoin was stolen, and no issuer can freeze bitcoin the way stablecoins were frozen. Binance has not published a final root cause and says it found no evidence that private keys leaked.

The headline facts

• Date: October 29, 2026, starting around 20:05 UTC
• Loss: about $6.34 billion, by Binance's count. TRM Labs counts $6.36 billion across ten blockchains.
• Speed: most of the funds left in about 20 minutes, according to TRM Labs
• Bitcoin taken: about 18,270 BTC, worth roughly $1.47 billion
• Attribution: North Korea's TraderTraitor group, according to the FBI
• Frozen or intercepted: about $2.85 billion, according to Binance
• Covered so far: 98% of the affected token assets as of October 31, according to Binance
• Scale: roughly four times the $1.5 billion Bybit hack of February 2025

How the attackers got in

Binance's initial report describes a campaign that began months earlier. In June, an engineer on its wallet team downloaded a tampered installer while setting up an AI coding tool. Binance replaced the device and rotated his credentials, but the attackers had learned who worked on its wallet systems. In September, another engineer was approached through a job-hunting site, put through two fake interviews, and told to download an "assignment" that installed malware Binance's security tools didn't catch.

On October 20, the attackers used an internal AI tool from that computer to take over the computers of two wallet engineers, including the one targeted in June, who had a container deployment token on his machine. On October 29, they logged onto the other engineer's computer, used the stolen token to deploy a container, and ran a script against Binance's internal wallet signing service, which sent transactions outside the normal withdrawal process.

On Ethereum, the attackers submitted 50 signing transactions that handed partial control of a hot wallet to their own smart contract. Those permissions lived on-chain, so pausing withdrawals didn't stop them. The wallet used multi-party computation (MPC), where several machines work together to produce each signature, so Binance had no single key it could use to cancel the permissions quickly. The last unauthorized transfer, broadcast earlier, finalized at 23:56 UTC, almost four hours after the first.

By Binance's account, the attackers never needed to steal a private key, because the signing system could be made to sign. Bybit lost $1.5 billion in 2025 when a compromised signing interface showed its signers the wrong transaction. Bybit used multisig, but one company controlled every key, so compromising that company reached the whole quorum. Bitget lost $387.5 million in September when attackers used stolen internal credentials to issue fraudulent withdrawal commands. Binance calls its report initial and says independent security firms will review it.

Cold storage helps, but it doesn't settle the question

Keeping coins offline protects against this kind of attack. The stolen funds came from hot wallets, not from Binance's offline reserves. But Bybit's loss came during a transfer out of cold storage, so offline keys don't help if the approval process can be fooled. What matters is who can move the bitcoin, and whether one breach reaches all of them.

Who is paying for it

Binance says customers will not bear the loss. As of October 31, Binance says, 98% of the affected token assets had been replenished, and it is buying the remaining, less liquid tokens. The money came from its SAFU emergency fund, part of its futures insurance fund, and its corporate treasury. Binance set aside more than $6.34 billion, and an analyst quoted by CNBC saw no meaningful solvency risk from the breach. By 10:30 a.m. ET on November 1, Binance had processed about $4.6 billion in withdrawals against $1 billion in deposits, according to CNN.

Binance has done what it promised so far. Its pledge is still a business decision backed by its own money. "Nothing in the law requires it to," Onramp CEO Michael Tanguma told CNBC. Crypto on an exchange has no FDIC or SIPC protection, and a smaller exchange facing a loss of this size could not make the same promise.

Why the bitcoin is the hardest part to recover

About $2.85 billion of the stolen money has been frozen or intercepted, by Binance's count, and most of that froze because a company stands behind the token. Tether and Circle can block their own stablecoins, and they moved within hours.

Bitcoin has no issuer, so no company can freeze it. TRM Labs reports that the attacker moved the 18,270 BTC through a chain of smaller transfers, in round amounts of 1,000 and 100 BTC, to make it harder to trace. Investigators can follow those coins on-chain and exchanges can refuse them, but recovery depends on the coins reaching someone who will stop them.

Once bitcoin leaves, there is no bank to call and no issuer to ask, so the protection has to work before a transaction is signed.

What to do if you hold bitcoin

If you have funds on Binance: there is no need to rush. Binance began restoring withdrawals in phases on November 1, starting with 15 networks including bitcoin, and warned that some withdrawals may be delayed or need a retry. If you move funds, send a small test amount first and confirm that it arrives before sending the rest.

Watch for scams. Large hacks are followed by fake support messages, fake refund offers and fake verification links. No legitimate company will ask for your password, your verification codes or your recovery words. Get updates from Binance's official channels only, and ignore anyone offering to recover funds for a fee.

If you hold on any exchange: use an authenticator app or a physical security key instead of text message codes, use an email address and password you use nowhere else, and turn on an allowlist of approved withdrawal addresses. Exchanges generally treat a stolen login as the customer's loss, so these settings matter even when the exchange itself is never hacked.

If your funds are stolen: act within the first hour if you can. Contact the exchange to freeze your account, change your passwords from a device you trust, save the transaction details, and file a report with the FBI at ic3.gov.

If you hold your own keys: this hack does not touch your coins, and self-custody remains a sound choice for people who want it. Your weak points are different ones: a lost device, a backup found by the wrong person, a tampered wallet, a transaction approved under pressure, or a family that can't reach the funds after a death. Moving savings off an exchange trades one kind of risk for another.

Why this is bigger than one exchange

The Binance hack capped a year of failures on both sides of the custody debate. In July, Coinkite disclosed a firmware flaw that weakened seeds generated on Coldcard hardware wallets. In September, Bitget lost $387.5 million. In October, Ledger confirmed a hardware implant in a device sold by an authorized reseller, and Keystone disclosed that an attacker may have taken 25,964 buyer records and took the key it uses to verify its devices are genuine, and it is destroying 18,835 wallets as a result. Keystone says recovery phrases and private keys were not compromised.

In each case, one company, one device or one approval system stood between the owner and a loss. Onramp's report The Third Way makes that argument in full.

The same concentration runs through US bitcoin ETFs. Funds naming Coinbase as custodian hold more than 80% of US spot bitcoin ETF assets. After the Binance hack, Coinbase's chief security officer said it was blocking transfers to the compromised wallets and had adjusted its cold storage systems as a precaution. There is no evidence that Coinbase or any ETF was compromised. The point is structural: when most of a market sits with one provider, that provider's security becomes the market's security.

Three questions to ask about any custody setup

Is your bitcoin pooled? An exchange typically holds customer coins in shared wallets, so one compromised signing system reaches many customers at once. In a segregated setup, your bitcoin sits at its own on-chain address, verifiable by you at any time.

Who can approve a transfer? If every approval runs through one organization's staff, laptops and software, one breach can reach all of them. Ask how many independent institutions must agree, and whether they share systems.

What do you own if something goes wrong? Ask whether you hold your bitcoin or a claim on a company, and whether it is ever lent out. When FTX and Celsius failed, the law treated customers as creditors, not owners of their coins, and they waited in line with everyone else the company owed. Proof of Reserves can't answer this. Binance posted a fresh reserve snapshot after the hack, and a snapshot shows balances at a moment in time. It says nothing about how those balances could leave.

How Multi-Institution Custody is built differently

Three institutions protect your bitcoin. No one of them can lose it, move it, or use it, and nothing moves without your permission.

Multi-institution custody works like a bank vault that needs two keyholders to open: it takes two of the three (Onramp, BitGo, and CoinCover) to move your bitcoin. Onramp, BitGo, and CoinCover each secure a key offline, never on a consumer device, in a 2-of-3 multisig. You never hold a key yourself.

The design answers the three questions above. Each client's bitcoin sits in a segregated vault at its own on-chain address, never pooled or lent out, and you can verify it on any block explorer at any time. Withdrawals require an independent second signature from BitGo after separate identity verification, so a breach at one organization doesn't reach the others. That is the difference from Bybit, where every key sat inside one company. Client bitcoin is legally the client's property, not part of any Onramp bankruptcy estate. Onramp holds $1B+ in bitcoin under Multi-Institution Custody.

No custody system is unbreakable, and any firm claiming otherwise this week should be ignored. The claim here is narrower: no single failure, including one at Onramp, can move client bitcoin.

Frequently asked questions

What happened in the Binance hack?

On October 29, 2026, attackers took about $6.3 billion from Binance's hot wallets across ten blockchains, most of it in about 20 minutes. It is the largest crypto theft on record. Binance paused withdrawals, pledged to cover all losses, and began restoring withdrawals in phases on November 1.

Who hacked Binance?

The FBI attributes the theft to TraderTraitor, a North Korean state-sponsored group. The FBI tied the same group to the $1.5 billion Bybit hack in 2025. TRM Labs and Chainalysis reached the same conclusion on North Korea.

How much bitcoin was stolen from Binance?

About 18,270 BTC, worth roughly $1.47 billion, according to TRM Labs. The rest of the $6.3 billion was mostly ether, stablecoins and other tokens.

Did Binance customers lose money?

Binance says customers will not bear the loss. It had replenished 98% of the affected token assets by October 31, using its SAFU fund, part of its futures insurance fund and its corporate treasury. Customers were unable to withdraw while services were paused.

Is Binance safe now?

Binance has resumed withdrawals and says its top ten assets are fully backed, but its investigation is ongoing. Its initial report says it has rebuilt the affected wallet system and replaced affected devices. Any exchange remains a single institution holding your bitcoin, so how much to keep there depends on what you can afford to have tied up or at risk.

Should I move my bitcoin off Binance?

Exchanges are built for buying and selling, and long-term savings are usually better held elsewhere. If you move funds, go slowly, send a small test amount first, and use only official channels. Moving trades exchange risk for a different risk, so choose where the bitcoin is going before you send it.

Can the stolen bitcoin be recovered?

Bitcoin can't be frozen by an issuer, so recovery depends on tracing the coins and on exchanges or law enforcement stopping them. Binance says it is working with partners and law enforcement. Frozen stablecoins are easier to pursue, though returning them can take months or years.

Is cold storage safer?

Keeping coins offline protects against attacks on hot wallets like this one, but it doesn't protect against a fooled approval process. Bybit's $1.5 billion loss came during a transfer out of cold storage.

Is it safer to split bitcoin across several exchanges?

Splitting limits how much one failure can cost, but it accepts that part of the money can be lost, and it gives you more accounts to secure. Each exchange is still a single institution holding your bitcoin.

Is crypto on an exchange insured or FDIC protected?

No. FDIC and SIPC do not cover crypto held on an exchange. Exchange reserve funds are spent at the exchange's discretion, and private insurance varies, so ask what is covered, what is excluded, and whether you have any right to repayment.

Did the Binance hack affect Coinbase or bitcoin ETFs?

There is no evidence that Coinbase or any bitcoin ETF was compromised. Coinbase said it blocked transfers to the compromised wallets and adjusted its cold storage systems as a precaution.

Sources and further reading

• Binance, 29 October Binance Security Incident: Initial Findings and Response Update (Nov. 3)
• Binance, Security Incident Update and Update #2 (Oct. 30), Recovery Update #3 (Oct. 31) and Recovery Update #4 (Nov. 1)
• TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
• CNBC, Binance's $6.3 billion hack: What we know and what comes next
• CNBC, Binance hack safety guide (Oct. 31), with comment from Michael Tanguma
• CNN, Binance withdrawals resume following $6 billion hack
• CryptoSlate, OneKey founder warns BlackRock's Bitcoin ETF could be a North Korean target (Coinbase statement and custody figures)
• Bankless, Keystone breach widens as attacker grabs its device authentication key