Hackers drained approximately $6.3 billion from Binance hot wallets, marking the largest cryptocurrency heist on history. Blockchain analysis firms attribute the breach to North Korea’s TraderTraitor unit. Binance suspended withdrawals while freezing about $3 billion in assets and pledging corporate reserves to cover user losses.
How Hackers Drained Binance Hot Wallets in Minutes
The massive security breach struck the world’s largest digital asset platform late Thursday, October 29, 2026. Unauthorized transactions systematically targeted hot wallets connected directly to the internet to facilitate routine customer withdrawals.
Early technical findings point toward a breached laptop belonging to a DevOps engineer, which granted a malicious actor entry into a service container to execute unauthorized withdrawals. Blockchain data infrastructure companies report that Binance’s own automated withdrawal system signed away the staggering sum from 17 hot wallets in under four hours, moving millions in digital tokens.
Funds began leaving Binance’s hot wallets at about 12:24am UAE time on October 30. Blockchain records indicate that an address established recently and financed via Tornado Cash received a single transfer of cryptocurrency alongside additional tokens. The heist unfolded in just 20 minutes. ET Thursday. This surpassed the previous record held by the February 2025 attack on the Bybit exchange, where $1.5 billion was stolen. Figures published by blockchain analytics firm Crystal Intelligence indicate that between 2011 and March 2025, the sector suffered roughly $22.7 billion in losses from scams, hacks, and fraudulent schemes. Chainalysis figures show that thefts reached $3.4 billion across all of 2025, and security firm CertiK alongside Lightning.news estimated that 2026 hacks contributed an additional $2.35 billion to $2.68 billion prior to the Binance incident, bringing cumulative losses to an estimated $26 billion to $27 billion ahead of the event.
Attribution Points to North Korean State-Sponsored Hackers
Cybersecurity investigators quickly connected the digital fingerprints of the multi-billion-dollar breach to familiar state-backed actors. TRM Labs assessed that the attack was carried out by TraderTraitor, an elite North Korean hacking unit that has also been known as the Lazarus Group. Intelligence agencies and security analysts note that the group has targeted cryptocurrency infrastructure globally for years to generate foreign currency.
The stolen assets traversed multiple blockchain networks, including Bitcoin, Ethereum, Tron, and Ripple, with portions routed through privacy-enhancing mixing services like Tornado Cash. Elliptic’s tracking data indicates that the attackers actively swapped stolen assets.
Analytics provider Elliptic noted that prior to Bybit, the benchmark belonged to Saddam Hussein, who extracted $1 billion from Baghdad’s Central Bank of Iraq right before the 2003 Iraq War commenced. North Korean leader Kim Jong Un attended the Unmanned Aeronautical Technology Development-2026
exhibition in Kangwon Province on Oct. 29, 2026. Federal charges related to inadequate anti-money laundering controls on his exchange resulted in a 2023 guilty plea from Changpeng Zhao, who subsequently received a 2025 pardon from US President Donald Trump. Binance announced on Friday that it was collaborating with law enforcement and remained on schedule to restore withdrawal capabilities within a 45-hour window.
Binance Freezes Billions and Pledges Reserves to Protect Users
In response to the unprecedented drain, platform executives rushed to reassure anxious account holders while coordinating emergency containment measures with major digital asset issuers. Stablecoin operators Tether and Circle joined forces with exchange security teams to intercept and lock down compromised funds.
Binance co-CEO Richard Teng released a statement addressing platform participants directly, emphasizing that corporate balance sheets would absorb the financial shock.
Binance will absorb the financial impact of these stolen funds, not our users.
Richard Teng, Co-CEO of Binance, via NBC News
Company leadership confirmed that Binance will cover all losses from the SAFU fund and internal company reserves, maintaining that customer holdings remain secure despite the temporary suspension of deposits and withdrawals.
Reuters reported via CoinGecko statistics that Ether fell about 2% to touch a two-month bottom of $2,238.76, whereas BNB—originally introduced as Binance Coin—lost upwards of 8% within a day to settle at $694. Changpeng Zhao, co-founder of Binance Holdings Ltd., addressed the market during a period of intense scrutiny, while other entities such as the US Department of the Treasury previously sanctioned the Lazarus Group in 2019, stating it was controlled by North Korea’s primary intelligence bureau.
Market Fallout and Public Clashes Sparked by the Heist
The sheer scale of the incident sent immediate shockwaves across the broader digital asset economy. Bitcoin tumbled to a six-week low of $76,368, while Ether dropped more than 3 percent and exchange-linked tokens experienced sharp sell-offs as market participants reassessed sector-wide vulnerabilities.
Amid the tense aftermath, high-profile public exchanges added a layer of friction. After SpaceX and Tesla CEO Elon Musk posted lighthearted emojis on X following news of the breach, Binance co-founder Changpeng Zhao pushed back against the commentary, asking the billionaire to show support rather than trolling an embattled platform holding major equity ties.
The Secure Asset Fund for Users—an emergency reserve established in 2018 and backed entirely by Bitcoin—holds roughly one-sixth of the stolen amount, as the heist total exceeds that $1bn fund by more than sixfold. Data compiled in TRM’s 2026 Crypto Crime Report indicates that nearly 150 separate attacks throughout 2025 resulted in hackers making off with $2.87bn in digital assets. Binance itself has faced legal trouble, with founder Changpeng Zhao pleading guilty in 2023 to a felony linked to failing to prevent money laundering on the platform before receiving a US presidential pardon.
