Binance Hack: Inside the $6.3bn Crypto Theft and What It Means for Customers

Binance suspended deposits and withdrawals, says user funds are safe and has promised to cover every loss. About $2.7 billion has been frozen by stablecoin issuers and others. The rest, including more than $2 billion in bitcoin and ether, is beyond anyone's reach for now.

This article sets out what is known about the Binance hack so far and the legal questions it raises for customers, insurers, regulators and anyone who may handle the stolen funds. Figures may change as the investigation continues.

What happened in the Binance hack

According to TRM's onchain timeline, the theft began at about 20:05 UTC on 29 October, when five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single attacker address. Within minutes, wallets on Solana and Optimism followed. At 20:20 UTC a Binance bitcoin hot wallet sent 18,270 BTC to the attacker, and at the same moment the attacker submitted the transaction that took over Binance's main Ethereum hot wallet. Roughly three and a half minutes later that wallet was swept clean: 167,464 ETH and 63 other tokens, including 1.615 billion USDT. Wallets on Tron, Avalanche and Polygon were also emptied.

Preparation started well before the theft. TRM found that the operator wallet was funded through three small withdrawals from the Tornado Cash mixer on the morning of 28 October, at least 36 hours before the attack.

Binance first confirmed only that it was investigating. A spokesperson told TechCrunch that withdrawals had been "temporarily suspended on multiple networks" as a precaution. Founder Changpeng Zhao, who no longer runs the company but is its largest shareholder, said on X that the exchange had likely been hacked and that he expected users to be fully covered.

How the attackers got in

Binance has not yet published a root cause, but its preliminary account has been widely reported. An attacker used the compromised laptop of a DevOps engineer to reach an internal service container and submit unauthorised withdrawals, CoinDesk reported. Binance says there is no evidence that any wallet's private key leaked. Every fraudulent bitcoin transfer carried a valid signature from Binance-controlled addresses, which suggests the attacker made Binance's own systems sign the withdrawals rather than stealing the keys outright.

On Ethereum the method was different. TRM says the attacker used EIP-7702, a feature added in Ethereum's Pectra upgrade in May 2025 that lets an ordinary wallet delegate its behaviour to a smart contract. With 50 pre-signed authorisations, each covering a different transaction number so that one would be valid when sent, the attacker turned a Binance hot wallet into a "sweeper" that forwarded everything it held, and everything later deposited into it, to the attacker. At least one security firm has questioned Binance's position that no keys were exposed, Insurance Business noted.

What was stolen, chain by chain

TRM's breakdown shows how broad the attack was. The figures below are TRM's estimates at the time the funds moved, as of 00:30 UTC on 30 October.

Blockchain	Main assets taken	Approximate value
Ethereum	200,630 ETH, 1.875bn USDT, 823m USDC, 88.5m RLUSD and 182 other tokens	$3.79bn
Bitcoin	18,270 BTC	$1.47bn
Tron	612.7m USDT and 46.4m TRX	$628m
XRP Ledger	233.46m XRP	$296m
Solana	970,500 SOL	$96m
Arbitrum, Optimism, Base	Including 74.6m ARB	$39m
Avalanche and Polygon	Mixed tokens	$38m

The ether loss is significant for Binance's balance sheet. Binance publishes monthly proof-of-reserves reports comparing its holdings with customer balances. Its 1 October report showed exactly enough ETH to cover customers, a 100% reserve ratio. CoinDesk estimates that the theft of about 204,500 ETH, roughly 5.6% of those reserves, leaves ETH backing at around 94% until Binance replaces it. The next snapshot is due on 1 November.

Who is behind it: North Korea's TraderTraitor

TRM attributes the Binance hack to TraderTraitor, a North Korean state hacking unit linked to the wider Lazarus Group, with high confidence. The attribution rests on patterns seen in earlier thefts: small Tornado Cash withdrawals to fund an operator wallet, long staging before the attack, and signatures obtained in advance and executed in one burst. The FBI used the same name when it publicly attributed the $1.5 billion Bybit theft to North Korea on 26 February 2025, five days after that attack, and asked exchanges, bridges, analytics firms and other service providers to block transactions linked to the attacker's addresses.

TRM's global head of policy, Ari Redbord, described the attack as a watershed and told Al Jazeera that money stolen by North Korea supports weapons proliferation, which makes it a global security issue rather than a matter for one company.

Official attribution has not yet been made. If the FBI or another government formally names North Korea, as happened within days of Bybit, the consequences reach well beyond Binance: sanctions law, insurance exclusions and the obligations of every business that touches the stolen funds all turn on who the attacker is.

The race to freeze the funds

Within 37 minutes of the main Ethereum sweep, Tether froze 971.1 million USDT in an attacker wallet, according to TRM. Circle froze 823 million USDC three minutes later, in coordination with law enforcement. Ripple froze 40.5 million RLUSD, World Liberty Financial froze 27.8 million USD1, and the Arbitrum Security Council forced about $30 million of ETH and ARB out of attacker wallets. Lending protocol Aave froze affected markets after the attacker supplied 60 million USDT and borrowed about 19,760 ETH against it.

In total TRM counts about $2.7 billion frozen, most of it in stablecoins. Binance reported $2.54 billion verified as frozen at 23:35 UTC.

The attacker moved quickly to convert what could be frozen into what cannot. TRM says about 325 million USDT was sold through UniswapX and other intent-based contracts for about 122,300 ETH, accepting a discount of more than 10% on the market price to get out of stablecoins fast.

The bitcoin is a different problem. CoinDesk reports that the 18,270 BTC was split through a "peel chain" into 19 wallets, 17 of them holding exactly 1,000 BTC. As of early Friday none had moved. Bitcoin has no issuer that can blacklist an address, so those coins can only be stopped when they reach an exchange, an over-the-counter (OTC) desk or a swap service. TRM expects the next stage to use cross-chain bridges, swap services and OTC brokers.

The freezes also raise legal questions of their own. Stablecoin issuers and protocol councils acted within minutes, without a court order, under their own terms of service and governance rules. That speed recovered billions, but owners of tokens caught up in a freeze, and any innocent third parties who received tainted funds, may test the basis for those actions. Recovery of frozen tokens to Binance will also need a legal route, whether by agreement, court order or law enforcement seizure.

What it means for Binance customers

Binance says user funds are safe and that it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds. SAFU was set up in 2018 and is held in bitcoin. Reported estimates put it at roughly $1 billion to $1.2 billion, which covers less than a fifth of the estimated loss, so most of any shortfall would have to come from Binance's own balance sheet. Binance has said it will publish a full technical post-mortem once its investigation is complete.

For customers, the practical points are:

• Balances are a contractual claim. A customer's balance on a centralised exchange is generally a claim against the operator under its terms of use, not ownership of specific coins on the blockchain. Whether assets are held on trust, and how a shortfall would be shared, depends on those terms and on the law of the entity the customer contracted with.
• Which Binance entity matters. Binance serves customers through different companies in different countries. Binance.US and Coinbase say they were not affected. Customers should check which entity holds their account and which law and dispute clause applies.
• Keep records. Account statements, screenshots of balances before and after the suspension and copies of all communications will matter if a dispute arises later.
• Beware scams. Binance has warned users to ignore unofficial links and any request for account details. Large incidents reliably attract phishing and fake "recovery" services.

Customers who need advice on their position can find a banking and finance adviser in our directory.

The insurance question: war and state-backed exclusions

The Binance hack is also a test for the insurance market. Specialist crypto theft cover exists in London, but publicly reported limits are a small fraction of a $6.3 billion loss. For cyber policies written at Lloyd's, the bigger issue is attribution. Lloyd's Market Bulletin Y5381 requires standalone cyber policies to exclude losses from war and from certain state-backed cyber attacks, and to set out a robust basis for deciding whether an attack can be attributed to a state.

The state-backed test in that bulletin is aimed at attacks that significantly impair a state's ability to function or its security. Whether a theft from a private exchange meets that test is open to argument, and policy wordings vary. Under war exclusions the insurer generally carries the burden of proving the exclusion applies, and a formal government attribution would strengthen its hand. Brokers are already reviewing war, state-backed attack and social engineering wordings for digital asset, fintech and payments clients. Businesses affected can find an insurance specialist through Corporate INTL.

Regulatory fallout in the US, UK and EU

Binance's history makes regulatory scrutiny certain. In November 2023 the company pleaded guilty in the United States to anti-money laundering, unlicensed money transmission and sanctions offences, agreed to pay more than $4 billion and accepted an independent compliance monitor, while Zhao pleaded guilty and stepped down as chief executive. A security failure on this scale will draw questions about the controls that settlement was meant to strengthen.

In the UK, the Financial Conduct Authority barred Binance's UK arm in 2021, and Binance stopped onboarding new UK customers in October 2023, although existing accounts kept trading. The FCA published its final cryptoasset rules on 30 June 2026, and the new regime applies from 25 October 2027. Trading, custody and staking firms will need authorisation, and senior managers will carry personal accountability. The Binance hack is likely to sharpen the FCA's focus on custody controls and operational resilience in applications now in the gateway. In the EU, crypto firms operating under the Markets in Crypto-Assets Regulation face similar questions about safeguarding client assets; our guide to MiCA licence requirements explains the regime.

Sanctions risk for anyone who touches the funds

If North Korea is behind the Binance hack, the stolen assets are the proceeds of a state that is subject to comprehensive sanctions in the US, UK, EU and under United Nations resolutions. Exchanges, OTC desks, payment firms, bridges and liquidity providers that process those funds, even unknowingly, risk breaching sanctions and anti-money laundering rules. Regulators have shown how seriously they treat sanctions failures; our report on the Bank of America AML and sanctions penalties shows the scale of fines involved.

Firms in the crypto supply chain should screen against the attacker addresses published by TRM and others, and against any list issued by the FBI or sanctions authorities, monitor for funds that have passed through peel chains, mixers or bridges from the affected wallets, and escalate suspicious activity reports promptly. Businesses with questions about cyber crime and asset recovery can find a cyber crime specialist in the Corporate INTL directory.

Market impact

Bitcoin fell about 5% after the theft, to below $77,000, and Binance's own BNB token fell between 5% and 8%. Macquarie University's Sean Foley warned that a loss of confidence in Binance could hurt retail investors and push traders towards decentralised alternatives.

What to watch next

• Binance's post-mortem and whether it confirms or revises the compromised laptop explanation and the claim that no private keys leaked.
• Formal attribution by the FBI or another government, which would shape sanctions duties and insurance claims.
• Movement of the 18,270 BTC and the remaining ether, and whether exchanges and OTC desks stop them.
• The 1 November proof of reserves, which will show whether Binance has restored full backing.
• Regulators' responses in the US, UK, EU and Dubai, and any action under the 2023 US settlement.

Frequently asked questions

How much was stolen in the Binance hack?

Binance estimates about $6.3 billion. TRM Labs puts it at about $6.36 billion at the prices when the coins moved, across ten blockchains. About $2.7 billion has since been frozen.

Is my money safe on Binance?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. Deposits and withdrawals were suspended while it investigates. Your rights depend on your account terms and the Binance entity you contract with.

Who hacked Binance?

TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group. No government has formally attributed it yet.

How did the Binance hack happen?

Binance's preliminary finding is that an attacker used a DevOps engineer's compromised laptop to reach an internal service and submit unauthorised withdrawals. On Ethereum the attacker used an EIP-7702 delegation to turn a hot wallet into a sweeper.

Can the stolen bitcoin be recovered?

It is harder than for stablecoins. Bitcoin has no issuer that can freeze it, so the 18,270 BTC can only be stopped when it reaches an exchange, OTC desk or swap service that blocks it.

Will insurance cover the Binance hack?

Probably only a small part. Specialist crypto theft cover has limited capacity, and Lloyd's cyber policies must exclude war and some state-backed attacks, so attribution to North Korea could affect claims.

Sources

1. TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, 29 October 2026: trmlabs.com
2. CoinDesk, Binance hack drained wallets backing customer assets, reserve data shows, 30 October 2026: coindesk.com
3. CoinDesk, Binance hacker splits bitcoin into 19 wallets that no one can freeze, 30 October 2026: coindesk.com
4. TechCrunch, Binance pauses withdrawals as hackers suspected of stealing billions in crypto, 29 October 2026: techcrunch.com
5. Al Jazeera, Binance says $6.3bn stolen in biggest crypto heist in history, 30 October 2026: aljazeera.com
6. Insurance Business, Binance hack: record loss puts Lloyd's crypto and cyber wordings in the spotlight, 30 October 2026: insurancebusinessmag.com
7. FBI, Public Service Announcement I-022625-PSA on the Bybit theft, 26 February 2025: ic3.gov
8. US Department of Justice, Binance and CEO plead guilty to federal charges, November 2023: justice.gov
9. Lloyd's, Market Bulletin Y5381, state-backed cyber-attack exclusions: lloyds.com
10. Financial Conduct Authority, Cryptoassets: fca.org.uk

About this article

Researched and written by The Corporate INTL Newsroom from blockchain analysis, official documents and contemporaneous reporting. The Binance hack is a developing story and figures may change as investigations continue. It is general information, not legal advice. Last reviewed 30 October 2026. For more analysis visit our newsroom or subscribe to our newsletter.