TL;DR
- Withdrawal Halt: Binance has kept customer withdrawals paused since late October 29 after a theft it estimates at $6.3 billion, and aims to restart them before Sunday, November 1.
- Loss Coverage: Binance pledges to cover all losses using its emergency reserve and company funds, and says it has set aside more than $6.34 billion.
- Frozen Assets: Roughly $3 billion has been frozen, but TRM Labs estimates the attacker still controls about $2.4 billion in ether and bitcoin beyond any issuer’s reach.
- Lending Restrictions: Crypto lending service Aave blocked new deposits and borrowing after an attacker borrowed ether against stolen tokens, then reopened its markets on October 30 with nine assets barred as collateral for new loans.
- Attribution: TRM Labs, Chainalysis and Elliptic link the theft to North Korea’s TraderTraitor group. The FBI is investigating but has not publicly named a culprit.
Cryptocurrency exchange Binance has kept withdrawals suspended after a theft it estimates at $6.3 billion, the largest crypto heist on record, leaving customers unable to move assets off the platform while it rebuilds its withdrawal service.
Co-chief executive Richard Teng said in a video update on October 30 that Binance aimed to reopen withdrawals within about 40 hours, ahead of a Sunday, November 1 deadline, and only after the rebuilt service passed rigorous testing. Binance also plans to publish a full proof-of-reserves report, a public accounting meant to show that customer balances are fully backed, by Monday, November 2, with preliminary results possibly earlier.
An update on the security incident. https://t.co/qn2804fO5z
— Richard Teng (@_RichardTeng) October 30, 2026
Deposits were operating normally as of Binance’s 04:36 UTC update on October 30, after being briefly suspended overnight. The incident concerns Binance.com; Binance.US, which serves American residents, said it was unaffected.
Binance has pledged to absorb all losses through its emergency reserve, known as SAFU, and company funds. It said roughly $3 billion in affected assets had been frozen on blockchains, that it had begun recovering affected assets, and that it was working with law enforcement and blockchain partners to trace and recover the rest.
Service Update
Deposits remain unaffected and continue to operate as normal.
Withdrawals remain paused while our team completes a security revamp of the withdrawal service and its related addresses. We expect to resume within 48 hours, and will update with further details.… pic.twitter.com/XIPgMvK7mA
— Binance (@binance) October 30, 2026
How the Theft Unfolded
Blockchain records, together with statements from Binance and the firms responding to the attack, show how quickly the theft spread. All times are UTC.
- October 28: The attacker’s operator wallet received three small withdrawals from Tornado Cash, a service that obscures where crypto comes from. TRM Labs said preparation began at least 36 hours before the theft, including test runs of the attack code on other wallets.
- October 29, 20:05–20:09: Five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single attacker address. Binance wallets on Solana and Optimism followed shortly after 20:10.
- 20:20: The attacker took control of a major Binance hot wallet on Ethereum. In the same minute, a Binance bitcoin hot wallet sent 18,270 BTC to the attacker, and a Binance Tron wallet followed within two minutes.
- About 20:24: One transaction moved 167,464 ether and 63 other tokens, including 1.615 billion USDT, out of the Ethereum hot wallet.
- 20:58–21:01: A wallet controlled by the attacker deposited 60 million USDT on the lending protocol Aave and borrowed ether against it.
- 21:01–21:04: Tether and Circle froze the first large stablecoin balances in the attacker’s main receiving wallet.
- 21:42: Aave began freezing its markets.
- About 22:15: Binance confirmed it had suspended withdrawals while it conducted security checks.
- 23:05: A second wave of outflows hit Binance wallets on Avalanche and Polygon, more than two and a half hours after the first transfers.
- 23:35: Binance said verified freezes had reached $2.54 billion.
- October 30, after midnight: Binance temporarily suspended deposits as well, and the Arbitrum Security Council moved stolen funds on its network into a frozen wallet. Binance soon raised its verified frozen total to $3 billion.
- Early morning: Binance put the total impact at about $6.3 billion and pointed to a compromised engineer’s laptop as a possible entry point. By 04:36, deposits were running normally again.
- Morning: Binance said investigators had found additional points of breach and that it had reserved more than $6.34 billion of company funds to cover losses.
- Afternoon: Teng set out the 40-hour withdrawal target, and Aave reopened its lending markets.
The Attack Reached Binance’s Withdrawal Wallets
Blockchain analytics firm TRM Labs traced about $6.36 billion in transfers from Binance wallets across ten blockchains on October 29, valuing the assets at the time of each transfer. Most of the outflow occurred in about 20 minutes. At later prices, TRM valued the same assets at about $6.23 billion. Chainalysis chief executive Jonathan Levin put the theft at about $6.4 billion. Binance’s initial estimate is roughly four times the approximately $1.5 billion stolen from Bybit in February 2025, the previous record.
Ethereum accounted for about 60% of the total, according to TRM’s breakdown:
| Blockchain | Assets taken | Approximate value |
|---|---|---|
| Ethereum | 200,630 ETH and 185 other tokens, including 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD | $3.79 billion |
| Bitcoin | 18,270 BTC | $1.47 billion |
| Tron | 612.7 million USDT and 46.4 million TRX | $628 million |
| XRP Ledger | 233.46 million XRP | $296 million |
| Solana | 970,500 SOL | $96 million |
| Arbitrum, Optimism and Base | Includes 74.6 million ARB | $39 million |
| Avalanche | AVAX and tokens | $28 million |
| Polygon | Various tokens | $10 million |
The affected systems included online “hot wallets,” which exchanges use to process customer withdrawals. Most customer assets are held in offline “cold” wallets and moved to hot wallets as withdrawals are requested. Teng stressed that the drained wallets belonged to Binance itself rather than to individual customers.
Binance’s preliminary investigation points to a possibly compromised engineer’s laptop that allowed access to an internal service capable of submitting unauthorized withdrawals. By the morning of October 30, the exchange said it had found additional points of breach. Teng said the attacker had not simply used one engineer’s permissions and that the theft was not a single “one-click” action. He added that the investigation had not attributed responsibility to any individual.
In his video update, Teng said the attacker had used a self-destruct mechanism to destroy tools and traces during the attack, complicating the investigation. Binance is conducting a company-wide security review covering employee devices, cloud systems, key management and transaction signing.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
— Binance (@binance) October 30, 2026
A Single Authorization Turned a Hot Wallet Into a Sweeper
On Ethereum, TRM found that a Binance wallet had authorized attacker-controlled software to act for it, using a feature called EIP-7702. Introduced in Ethereum’s Pectra upgrade in May 2025, EIP-7702 lets an ordinary wallet hand control of its behavior to a smart contract by signing an authorization. The arrangement stays in place until the wallet signs a new one.
The attacker submitted a transaction containing 50 authorizations, each signed by the Binance hot wallet and each pointing it to a “sweeper” contract that only the attacker could instruct. Every wallet keeps a running count of its transactions, called a nonce, and an authorization works only at the matching count. Because the busy hot wallet’s count kept rising with each customer withdrawal, the attacker prepared signatures for 50 consecutive counts so that one would still be valid. One matched.
That authorization remained active, allowing the attacker to sweep away additional funds as they arrived. TRM recorded further sweeps at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC. The wallet also controlled a separate Binance smart account, which gave the attacker access to 823 million USDC. Teng said the delegation gave the attacker on-chain execution authority over the wallet without passing through Binance’s normal approval controls.
Wallets on other blockchains also made ordinary signed transfers to the attacker. Those wallets used different chains, key types and signing schemes, yet all produced valid signatures for the attacker within about half an hour. TRM assessed that the attacker had gained access to Binance’s transaction-signing infrastructure, the systems that authorize transfers from its wallets. Blockaid chief executive Ido Ben-Natan similarly described a likely compromise of signing systems rather than a leaked key.
Binance said it had revoked the affected address authorization. It reported no evidence of leaked wallet private keys, the secret credentials used to authorize transfers, and said it would publish a detailed technical post-mortem once the investigation is complete.
I want to speak to you directly about what happened.…
— Richard Teng (@_RichardTeng) October 30, 2026
Token Issuers Blocked Some of the Stolen Funds
Much of the containment depended on stablecoins, tokens designed to track a currency such as the U.S. dollar. Tether issues USDT and Circle issues USDC. Both companies can block transfers of their tokens at particular blockchain addresses, immobilizing balances even after they have left an exchange.
TRM said Circle froze 823 million USDC in the attacker’s main receiving wallet at 21:04 UTC on October 29, before that balance moved elsewhere. Tether had frozen 971.1 million USDT in the same wallet three minutes earlier.
Tether had frozen more than 1.567 billion USDT by 21:25 UTC on October 29, chief executive Paolo Ardoino said. Later sweeps into the frozen wallet and additional freezes on Ethereum, Tron, Avalanche and Polygon raised Tether’s total to about 1.77 billion USDT by TRM’s count.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Protecting the industry and our partners is our main priority.
Stay safe everyone.
— Paolo Ardoino 🤖 (@paoloardoino) October 29, 2026
Other issuers and networks joined in during the night:
- Ripple froze 40.5 million of its RLUSD stablecoin at 22:01 UTC, after the attacker had already sold about 48 million. Binance co-CEO Yi He said Ripple helped stop about $200 million from moving.
- World Liberty Financial froze 27.8 million of its USD1 stablecoin at 22:10 UTC, working with custodian BitGo. Yi He said about $2 million in WLFI tokens was also frozen.
- First Digital said it had frozen the FDUSD stablecoin taken in the attack.
- The Arbitrum Security Council, a group with emergency powers over the Arbitrum network, forced two transfers out of the attacker’s Arbitrum wallet shortly after midnight UTC, moving 8,426 ether and 74.6 million ARB, worth about $30 million, into a frozen wallet. Those funds can be moved only by further council action or a vote of Arbitrum’s token holders.
Frozen assets also include StraitsX’s XUSD, USDT0, Wrapped Beacon ETH, Tether Gold, Pax Gold and the Pax Dollar, according to Cointelegraph. Binance has said the verified frozen total could rise as tracing continues.
Timing also allowed some assets to escape those controls. Bitquery’s separate blockchain analysis found that six of eleven Tether wallet freezes on Ethereum and Tron reached wallets that were already empty. The attacker had moved tokens onward or exchanged them for assets such as ether, which Tether’s USDT restrictions do not control.
The Attacker Raced the Freezes
In the first hours, the attacker converted stablecoins that could be frozen into assets that could not, accepting steep losses to do so. TRM found that about 325 million USDT was sold to professional market makers and order fillers through UniswapX and similar services in exchange for about 122,300 ether. The implied price was more than 10% above what ether was trading for at the time.
On Tron, 300 million USDT moved to a wallet that began supplying it to the JustLend lending protocol. Another 200 million USDT passed through a chain of intermediary wallets and was swapped on Uniswap, with 30 million frozen along the way. On Bitcoin, the attacker began splitting the 18,270 BTC into 1,000 BTC and 100 BTC pieces, a technique called a peel chain that makes funds harder to follow.
As of early October 30, TRM estimated that the attacker held more than 420,000 ether and the 18,270 BTC, about $2.4 billion in assets beyond any issuer’s reach. Chainalysis reported thousands of rapid transactions that could indicate automated laundering. On-chain investigator ZachXBT said funds from the Binance theft had been mixed in the same address with proceeds of last month’s Bitget exploit after passing through the cross-chain swap service THORChain.
Stolen Tokens Became Collateral on Aave
The attacker also used stolen stablecoins to obtain other assets without selling them. Aave’s suppliers provide tokens to its lending pools for others to borrow. Suppliers can also use their deposits as collateral for loans.
According to risk service provider LlamaRisk’s account of Aave’s response, a wallet in the attacker’s cluster supplied 60 million USDT to Aave V3’s Ethereum Core market between 20:58 and 21:01 UTC on October 29. It then borrowed 19,762 WETH, or wrapped ether, a token representing ether that can be used in lending contracts. The loan was worth about $44.6 million at the time.
That borrowing preceded Aave’s first reserve freeze at 21:42 UTC. Aave’s guardians, which can execute protective restrictions on the protocol, froze 175 reserves on Aave V3 across 16 networks and 117 on Aave V4 across four networks to prevent further deposits and borrowing. LlamaRisk said the group chose a freeze because guardians can reverse it quickly, while cutting lending limits would have required a governance vote and about five days to undo. Existing users could still withdraw and repay, and collateral could still be liquidated to settle loans.
In its report updated at 01:00 UTC on October 30, LlamaRisk valued the position’s USDT collateral at $59.9 million against $43.8 million of debt. The firm, which is funded in part by Aave’s governing organization, assessed that suppliers were protected because the collateral exceeded the debt and remained subject to normal liquidation.
The restrictions nevertheless affected existing borrowers. With new deposits blocked, withdrawals by suppliers reduced available liquidity and drove up borrowing rates. In an October 30 assessment, LlamaRisk reported borrowing rates of 10% to 36% APR (annual percentage rate) in the largest stablecoin reserves, where 92% to 100% of deposits had been lent out. Aave’s risk stewards then capped the rate at full utilization at 10% APR on those reserves as a temporary measure.
The stewards also cut borrowing caps to about 2% above pre-exploit levels on the largest borrowing routes. That removed about $3.7 billion of unused borrowing capacity on Aave V3 and $130 million on Aave V4 that would otherwise have opened up all at once.
Aave reopened all V3 and V4 markets on the afternoon of October 30. As a precaution, USDT, USDC, USDT0, POL, WAVAX, sAVAX, XAUt, PAXG and OP remain at a loan-to-value ratio of zero, meaning they cannot back new borrowing. Those are the assets held across the attacker’s wallets. Aave said its contracts were unaffected and positions remained fully collateralized.
It was the second time this year that a North Korea-linked attacker turned to Aave. After April’s KelpDAO exploit, the attacker deposited unbacked rsETH tokens on Aave and borrowed real ether against them. The latest episode revived calls on Aave’s forum for limits on how quickly newly deposited collateral can be borrowed against.
Can Binance Cover the Loss?
Binance created SAFU, short for Secure Asset Fund for Users, in 2018, initially setting aside 10% of trading fees in a separate cold wallet to protect customers in extreme cases. The fund was first tapped in May 2019, when hackers using phishing, malware and other techniques withdrew more than 7,000 bitcoin, then worth about $40 million, from Binance’s bitcoin hot wallet in a single transaction. Binance covered the loss in full and paused withdrawals for about a week.
In October 2022, an attacker exploited BNB Chain’s BSC Token Hub bridge. The bridge was suspended, and BNB Chain estimated that $100 million to $110 million in tokens were affected. Then-CEO Changpeng Zhao said Binance would likely cover any funds the hackers kept.
SAFU had been held in stablecoins until Binance converted it entirely into bitcoin in February 2026, bringing its holdings to 15,000 BTC, then worth about $1 billion. CryptoQuant valued the fund at about $1.18 billion after the hack, a fraction of the $6.3 billion impact.
Binance said it had reserved more than $6.34 billion in company funds to cover the incident, separate from the frozen assets. About $5 billion of that is already held in the same tokens that were taken, including USDC, USDT, bitcoin, ether and BNB. The exchange is buying the rest on the open market and through over the counter trades and warned that some purchases could take longer because of thin liquidity and settlement times.
Fundstrat’s head of digital assets, Sean Farrell, said the hack did not currently appear to threaten Binance’s solvency, which reduces the risk of a spiral of withdrawals and forced selling. He estimated about $3.3 billion of the affected assets remained unfrozen.
Markets Slide as Crypto Stocks Fall
The theft weighed on crypto prices overnight. Bitcoin briefly fell to about $76,300 and traded around $77,000 on Friday, down roughly 4% to 5%. Ether fell to about $2,200, and Binance’s BNB token dropped about 8% to roughly $693. Tokens the attacker was selling fell further: AAVE was down about 11% and Uniswap’s UNI about 11%. The Crypto Fear and Greed Index, which tracks market sentiment, fell to a “fear” reading of 30, its lowest since August.
Crypto-related stocks fell sharply when U.S. markets opened. Coinbase shares dropped as much as 13%, while Circle, Robinhood and bitcoin treasury company Strategy each lost between about 6% and 9% during Friday trading. A broader technology selloff tied to quarterly earnings and concerns over artificial-intelligence spending added to the pressure.
Trading firms Wintermute and GSR disclosed exposure to Binance but said they did not expect major disruption. Wintermute said its exposure was less than 20% of net equity, and GSR put its exposure below 5%. Standard Chartered’s global head of digital assets research, Geoffrey Kendrick, said the hack could push more trading toward decentralized exchanges.
In Washington, Commodity Futures Trading Commission chairman Michael Selig said the breach “proves our exact point” in proposing crypto market rules earlier this month.
Analysts Attribute the Theft to North Korea
TRM Labs attributed the attack to North Korea’s TraderTraitor group with high confidence, citing intelligence gathered on and off blockchains and similarities to earlier thefts. Those similarities included small Tornado Cash withdrawals funding the operator wallet, staging that began well before the theft, and signatures obtained in advance and executed in one burst. TRM noted that the laundering so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern that followed the Bybit theft.
Chainalysis separately expressed high confidence in a North Korean link, and Elliptic also attributed the theft to North Korean hackers. Binance said it was working with law enforcement to confirm the perpetrators’ identity and has not named an attacker.
The FBI said it was aware of the incident and working with public and private partners to understand its scope, but did not attribute the intrusion to North Korea. Yi He said Binance was working with the FBI and the U.S. Secret Service to trace and recover funds. After the Bybit theft in 2025, the FBI publicly named TraderTraitor within days.
TraderTraitor is the name the U.S. government uses for a North Korean hacking operation that has repeatedly targeted crypto companies, including by spreading trading applications modified to contain malware. In December 2024, U.S. and Japanese authorities blamed North Korean hackers for the theft of about $308 million from Japanese exchange DMM Bitcoin.
The Binance attack caps a run of large thefts linked to North Korea:
| Date | Target | Approximate loss | Attribution |
|---|---|---|---|
| February 2025 | Bybit (exchange) | $1.5 billion | FBI: TraderTraitor |
| April 2026 | Drift Protocol (DeFi) | $285 million | Linked to North Korea by analysts |
| April 2026 | KelpDAO (DeFi bridge) | $292 million | Linked to Lazarus/TraderTraitor by LayerZero and analysts |
| September 2026 | Bitget (exchange) | $351.6 million to $387.5 million | Bitget CEO: “very likely” North Korea; Elliptic: TraderTraitor |
| October 2026 | Binance (exchange) | $6.3 billion | TRM, Chainalysis, Elliptic: North Korea |
The scale dwarfs North Korea’s previous records. Chainalysis estimated that North Korean hackers stole a record $2.02 billion in 2025, about 60% of all crypto stolen that year. Before the Binance attack, Elliptic estimated that North Korea-linked thefts had already passed $1 billion in 2026. Researchers have long warned that such thefts help finance North Korea’s government and weapons programs.
What Comes Next
Binance’s near-term commitments are the withdrawal restart before Sunday, November 1, and the full proof-of-reserves report by Monday, November 2. A detailed technical post-mortem is due once the investigation is complete.
Recovering the frozen $3 billion may take longer. Stablecoin issuers and network councils can immobilize funds quickly, but returning them requires further steps, and competing claims can arise. After April’s KelpDAO exploit, a U.S. court froze about $71 million in ether held by Arbitrum, after families holding terrorism-related judgments against North Korea claimed it as North Korean property.
For the roughly $2.4 billion still under the attacker’s control, TRM expects the next stage to involve cross-chain bridges, swap services and over-the-counter brokers. It urged exchanges, market makers and compliance teams to screen deposits and counterparties against addresses linked to the attack, and recommended that crypto treasury teams monitor wallets for unexpected EIP-7702 delegations.
