The $6.3B Binance Hack: Inside World's Largest Digital Asset Theft

Binance, the world's largest digital asset exchange, is dealing with the aftermath of what could be the biggest theft of digital assets in history. Hackers stole an estimated $6.3 billion from the exchange on October 29, 2026.

The US Federal Bureau of Investigation (FBI) has officially blamed North Korea for the attack, identifying a hacking group known as TraderTraitor.

Binance says it has already replaced approximately 95% of the stolen assets using its own money and emergency reserves. The exchange has also started reopening withdrawals after temporarily stopping customers from taking their assets off the platform.

The good news for customers is that Binance says their funds are safe and that the company will cover the losses.

However, the incident has raised serious questions about how hackers managed to access Binance's systems, how they moved billions of dollars in digital assets and whether other exchanges could face similar attacks.

Here is what we know so far.

A list of funds and assets stolen was published shortly after the incident by different analysts and blockchain monitoring companies. Global Ledger, the Swiss-registered blockchain analytics and compliance company, published the following numbers:

The attack began on Thursday, October 29, when hackers started moving digital assets out of Binance's wallets.

The first suspicious transfers were detected at around 4:20 PM Eastern Time. The attackers moved funds across several blockchains, including Ethereum, Bitcoin and Tron.

They targeted Binance's hot wallets. These are wallets connected to the internet and used by exchanges to process customer withdrawals and other transactions faster.

Hot wallets are necessary for exchanges to operate, but they also create security risks because they are connected to online systems.

According to Binance's initial investigation, the hackers may have gained access through a compromised laptop belonging to a DevOps engineer. DevOps engineers work with the systems and software that help a company run its online services.

Binance believes the compromised laptop may have allowed the attackers to access an internal service and submit unauthorized withdrawal transactions.

However, the investigation later uncovered additional security weaknesses. Binance co-CEO Richard Teng said the attack was more complicated than initially believed and did not simply involve one employee's permissions.

The attackers also reportedly used software designed to delete their tools and leave fewer traces behind.

Binance has said it found no evidence that its wallet private keys were stolen.

This is an important detail because private keys are what give someone control over digital assets. The investigation instead points toward a possible compromise of the systems Binance uses to approve transactions.

One of the most interesting parts of the attack involves a feature called EIP-7702. This is an Ethereum feature introduced in 2025 that allows a regular wallet to give certain permissions to smart-contract software.

In simple terms, it allows a wallet to let another piece of software carry out certain actions on its behalf. The feature is useful, but it can become dangerous if hackers gain access to the system that approves these permissions.

According to blockchain security company Blockaid, the attackers used 50 pre-signed authorizations in a transaction targeting a Binance wallet known as Binance 14.

One of those authorizations matched the wallet's requirements and allowed the attackers to activate malicious software. That software reportedly gave the attackers the ability to move the wallet's funds into addresses they controlled.

The attack appeared to involve compromised transaction-signing systems rather than stolen private keys. This means hackers may have found a way to make Binance's own systems approve transactions without actually stealing the keys themselves.

The incident does not mean Ethereum itself was hacked. Instead, it highlights how weaknesses in the systems used by exchanges can put large amounts of assets at risk.

Binance says it will publish a detailed technical report once its investigation is complete.

North Korea's involvement was initially suspected by blockchain investigators. Both Chainalysis and TRM Labs linked the attack to TraderTraitor, a hacking group associated with North Korea.

On October 31, the FBI officially confirmed that North Korea was responsible. In its statement, the FBI said:

The FBI also said the attackers had started converting stolen digital assets, mainly into Ethereum. The agency expects them to continue moving the funds through decentralized exchanges and other digital asset services to make tracking more difficult.

The FBI has asked exchanges, blockchain companies and other industry participants to help identify and block transactions connected to the attackers.

The North Korean connection is particularly important because the country has been linked to several major digital asset thefts.

TraderTraitor was also blamed for the February 2025 Bybit hack, which resulted in approximately $1.5 billion in stolen digital assets. There are similarities between the two attacks, particularly the way hackers appear to have manipulated systems responsible for approving transactions.

US President Donald Trump also commented on the Binance incident before the FBI announced its findings. When asked whether North Korea was responsible, Trump said: "We're looking at that."

He also referred to Binance's promises to protect customers and cover the losses.

Stealing digital assets is only part of the challenge for hackers. They also need to move the stolen funds without being identified or having the assets frozen.

In the Binance case, investigators say the attackers used thousands of transactions to make the money harder to follow.

Blockchain analytics company Chainalysis described the activity as a previously unseen laundering method. The company noticed that the stolen funds repeatedly moved between different wallets. Some transactions even sent money back to wallets that had already been used.

Investigators also noticed that many receiving wallets were first sent exactly 1 TRX, which is used to pay transaction fees on the Tron network. The wallets then received larger amounts and moved the funds elsewhere.

According to Chainalysis, this repeated activity suggests that the attackers used automated software to move the stolen funds.

Another important part of the operation involved converting stablecoins into Ethereum.

Stablecoins such as USDT and USDC are designed to maintain a value close to the US dollar. However, unlike Bitcoin, they are controlled by companies that can freeze specific wallet addresses.

This means the issuers, Tether and Circle, can stop certain wallets from transferring their tokens. Bitcoin and Ethereum do not have the same type of company-controlled freezing system.

Chainalysis said the attackers tried to take advantage of this difference. Over approximately 20 minutes, they exchanged around $325 million in stablecoins for approximately $285 million in Ethereum. They then moved another $175 million into intermediary wallets.

The goal was to move the funds into digital assets that would be harder for companies to freeze before the issuers could respond.

Chainalysis said the attackers were trying to move faster than the companies attempting to stop them.

Investigators also found connections between the stolen Binance assets and funds linked to September's Bitget hack, which had previously been attributed to North Korean hackers.

This discovery strengthened Chainalysis's belief that TraderTraitor was behind the Binance attack.

After the attack became public, several digital asset companies moved quickly to stop the stolen assets from being transferred. Tether, the company behind USDT, froze more than $1.567 billion in tokens. Circle, which issues USDC, froze more than $800 million.

Other companies also joined the effort.

Ripple reportedly froze approximately $200 million in affected assets, while World Liberty Financial reported freezing around $27 million in USD1. The Arbitrum Security Council also froze approximately $30.5 million connected to the incident.

Binance initially reported that approximately $3 billion in affected digital assets had been frozen or located. However, it is important to understand that frozen funds are not necessarily recovered funds.

When a stablecoin issuer freezes an address, the money cannot normally be transferred from that address. But the assets still need to be returned through the appropriate recovery process.

One of the biggest developments since the hack is Binance's progress in replacing the stolen funds.

The exchange initially said it had set aside more than $6.34 billion to cover the losses.

Around $5 billion of that amount was already available in the same digital assets affected by the attack. Binance planned to buy the remaining assets through regular markets and private deals known as over-the-counter transactions.

In its latest update, Binance announced that it had covered approximately $6 billion, representing around 90% of the estimated losses. The remaining 5% consists of less liquid digital assets. These are tokens that are harder to buy in large quantities without affecting their market prices.

Binance says it is continuing to purchase the remaining assets. The exchange is using three main sources of money:

Binance said it would restore SAFU to approximately $1 billion after using part of the fund to help replace the stolen assets. Binance has repeatedly stressed that customers will not pay for the hack.

"Binance will absorb the financial impact of these stolen funds, not our users," the company said.

The exchange also announced that customer holdings of 10 digital assets were fully backed. These include Bitcoin, Ethereum, USDT, BNB, Solana, USDC, XRP, USD1, RLUSD and ZEC.

Binance published a new proof-of-reserves snapshot based on its assets at midnight UTC on October 31. It reported coverage ratios of at least 100% for the listed digital assets.

The full cryptographic proof is expected by November 3. This should allow customers to independently check that the exchange holds enough assets to cover their reported balances.

Based on its estimated dollar value, the Binance incident has surpassed previous major digital asset thefts.

Before Binance, the February 2025 Bybit hack was considered the biggest theft, with approximately $1.5 billion stolen. However, measuring digital asset thefts in dollars does not tell the whole story.

Binance founder Changpeng Zhao pointed out that the Binance hack was not the biggest when measured by the amount of bitcoin involved. He compared it with the collapse of Mt. Gox in 2014.

Mt. Gox reported approximately 850,000 missing BTC. The exchange later found around 200,000 BTC in an old wallet, leaving an estimated shortfall of approximately 650,000 BTC.

At a hypothetical bitcoin price of $78,000, the original 850,000 BTC would be worth approximately $66.3 billion. The remaining 650,000 BTC would be worth around $50.7 billion.

The 2016 Bitfinex hack is another example. Hackers stole approximately 119,756 BTC, worth around $9.34 billion at the same reference price.

By comparison, approximately 18,270 BTC were identified among the assets involved in the Binance attack. At $78,000 per BTC, that amount would be worth approximately $1.43 billion.

CZ argued that the size of a hack should not be judged by its dollar value alone. The number of customers affected, the amount of bitcoin stolen and the percentage of customer funds lost are also important.

He also highlighted a major difference between Binance and some previous exchange failures: Binance has promised to cover all customer losses itself.