Binance lost US$6.3 billion in a record cryptocurrency heist executed in roughly 20 minutes on Thursday, Oct. 30, 2026, as attackers drained transaction wallets by compromising the exchange’s signing infrastructure.
Compromised Signing Infrastructure Drains Binance Wallets
The bulk of the theft unfolded in approximately 20 minutes, beginning shortly after 2000 GMT on Thursday, according to blockchain records. Attackers targeted the systems that authorize transactions rather than the vault keys themselves. Joshua Chu, a Hong Kong lawyer who works on crypto cases, explained the mechanics of the breach:
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU
In layman’s terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money.
Subsequent investigations by the exchange uncovered additional points of breach. U.S. blockchain analytics firm TRM Labs confirmed that the attackers compromised the signing infrastructure, issuing instructions that emptied the affected wallets.
Richard Teng announced that losses would be covered by company resources and the exchange’s secure asset fund, a $1 billion bitcoin reserve maintained to protect customers during security breaches. Binance’s investigation has not yet identified the attackers.
Freezing Stablecoins and the Limits of Recovery
Following the breach, issuers moved quickly to freeze roughly half of the stolen assets. Stablecoins including Tether’s USDT, Circle’s USDC, Ripple, and World Liberty Financial—the Trump family’s crypto venture—were locked remotely by their issuers. Bernardo Brites, CEO of Trace Finance, a stablecoin infrastructure company, noted that proceeds of such hacks can typically only be laundered in the first few hours before getting blacklisted.
However, decentralised assets presented a different barrier. Patrick Tan, general counsel of ChainArgos, a blockchain intelligence firm in Singapore, explained that bitcoin and ether cannot be frozen directly because no centralized entity issues them. According to Tan, these assets can only be stopped if sent to a willing exchange or broker, or if law enforcement obtains the private keys.
TRM Labs estimated that about $2.4 billion worth of bitcoin and ether remains beyond reach, with some funds already posted as collateral to borrow ether. Chainalysis reported observing novel laundering patterns, noting that attackers used automation to repeatedly circulate thousands of transactions among addresses to obscure the trail.
Attribution and Global Sector Fallout
A number of American blockchain analytics organizations indicated that the raid shares characteristics with past intrusions linked to North Korean cybercriminals. TRM Labs stated it was highly confident the same group was behind the Binance theft, pointing to shared characteristics with last year’s attack on the crypto exchange Bybit—an incident the FBI attributed to North Korean hackers. Furthermore, Chainalysis noted that capital pilfered during last month’s Bitget incident is being combined with the funds acquired from the Binance exploit.
North Korea routinely denies involvement in such cyberattacks. The country’s mission in Geneva and embassy in China did not immediately respond to requests for comment.
The incident represents the latest large-scale breach in a turbulent sector. Attackers stole $2.9 billion across nearly 150 crypto incidents last year, according to TRM Labs data. Market confidence took an immediate hit following the announcement, with cryptocurrencies falling on Friday and the total market value of stablecoins declining as investors pulled capital from digital assets.
