A cyberattack on Binance on 29 October 2026 may become the largest cryptocurrency theft ever recorded, exposing serious vulnerabilities in the security infrastructure of the world's biggest digital-asset exchange.
In an official statement issued on 30 October, Binance estimated the total impact at approximately $6.3 billion, equivalent to about €5.4 billion at an indicative exchange rate. The company reported that around $3 billion in affected assets had already been frozen through cooperation with blockchain networks and token issuers. The final unrecovered loss remains uncertain.
How did the hackers get inside?
Binance's preliminary investigation points to a compromised laptop belonging to a DevOps engineer—an employee responsible for maintaining software infrastructure and deployment systems.
According to the company, the attacker apparently used this access to enter a service container and submit unauthorized withdrawal transactions.
Crucially, Binance says it has found no evidence that cryptocurrency wallet private keys were leaked. This suggests a possible compromise of operational permissions rather than conventional theft of wallet credentials.
The exact technique used to compromise the laptop remains unknown. Malware, phishing and stolen employee credentials are possible attack methods, but none has been officially established in this case.
Billions transferred within minutes
Blockchain investigators have identified suspicious transfers involving Binance's internet-connected hot wallets.
According to CoinDesk's analysis, approximately 167,464 ether were transferred from a wallet identified as Binance 14, followed by another 28,006 ether from Binance 16. Investigators also identified the use of Ethereum's EIP-7702 authorization mechanism, which can delegate control of an account to smart-contract software.
This mechanism may have enabled attackers to redirect funds automatically. However, Binance has not yet confirmed the complete technical sequence.
The attack extended beyond ether to stablecoins, bitcoin and other digital assets across several blockchain networks.
Stablecoin issuers have played a critical role in containing the damage. Tether froze approximately $1.57 billion, Circle more than $800 million, and other issuers reportedly blocked additional suspicious assets.
Freezing prevents transfers of the affected tokens but does not itself return the money to Binance.
Could North Korea be responsible?
Security researchers at TRM Labs and Pangolin Intelligence have reportedly linked the attack to TraderTraitor, a hacking operation associated with North Korea.
The allegation is significant. North Korean groups have previously been accused of stealing cryptocurrency to finance state activities and evade international sanctions. However, Binance has not confirmed who carried out this attack, and the attribution remains preliminary.
What is Binance saying?
Binance has temporarily suspended deposits and withdrawals while investigating the breach, revoked the compromised authorization and contacted law enforcement.
The company has promised to compensate all affected customers through its Secure Asset Fund for Users (SAFU) and corporate resources.
Its official position is clear: customer funds are safe, and Binance will cover the losses.
Nevertheless, questions remain about whether its emergency reserves and corporate liquidity will be sufficient without additional measures. Binance has promised a technical investigation report and updated proof-of-reserves figures.
Markets react: Bitcoin falls below $78,000
The breach sent shockwaves through cryptocurrency markets.
Reuters reported that bitcoin fell to a six-week low of $77,646, ether declined to $2,238.76, and Binance-associated BNB dropped more than 8% within 24 hours.
The incident also raises broader questions about centralized cryptocurrency exchanges. Even when blockchain networks themselves remain operational, a compromised employee device or administrative system may create access to enormous pools of customer assets.
A defining test for the crypto industry
The Binance incident illustrates two opposing characteristics of digital finance: attackers can move billions across blockchains within minutes, yet stablecoin issuers can also freeze substantial amounts when suspicious transfers are detected.
Three questions now determine the consequences: how much money can ultimately be recovered, whether Binance can fully restore its reserves, and how such extensive withdrawal permissions became accessible through a compromised operational environment.
Until the full technical report is published, the precise failure remains unresolved.
For Binance, the immediate challenge is recovering the assets. For the cryptocurrency industry, the larger challenge is restoring confidence that institutional-scale exchanges can protect billions in customer funds.
