Hackers have drained about $6.3 billion of cryptocurrencies from Binance, the world’s largest cryptocurrency exchange, in what analysts describe as the biggest digital asset theft in history.
The bulk of the heist unfolded in about 20 minutes, beginning shortly after 2000 GMT on Thursday, according to blockchain records analysed by US firm TRM Labs. The funds were taken from wallets Binance uses to process transactions.
Binance said in a statement on X that it initially thought the attack involved a compromised laptop, but that its subsequent investigation had uncovered additional points of breach. TRM Labs said the attackers had compromised Binance’s signing infrastructure, which authorises transactions, allowing them to issue instructions that emptied the affected wallets.
In plain terms, as one Hong Kong crypto lawyer put it, the attackers may not have stolen the vault key — they may have hijacked the system that tells the vault to release money.
About half the stolen assets have since been frozen. Binance said it had worked with partners to locate about $3 billion, much of it in stablecoins whose issuers — including Tether, Circle, Ripple and World Liberty Financial — can freeze tokens remotely. That does not mean the coins will be returned to Binance, but it sharply limits the attackers’ ability to turn them into cash.
The harder problem is the rest. TRM Labs estimated that about $2.4 billion worth of bitcoin and ether is beyond reach, because no company issues those coins and no company can freeze them. They can be stopped only if the attacker sends them to an exchange or broker willing and able to freeze them, or if law enforcement obtains the private keys.
The theft rattled crypto markets on Friday. Bitcoin hit a six-week low and was last down 3% at $76,469.82, while ether was down more than 3% at $2,185.83, according to analysts cited by Reuters. The total market value of stablecoins also fell, suggesting investors were pulling money from digital assets.
Binance has sought to reassure customers that they will not bear the loss. Co-chief executive Richard Teng said losses would be covered by the company’s Secure Asset Fund for Users, a roughly $1 billion bitcoin reserve, and company resources. Co-founder Yi He said the company would cover all hacking losses, and said on Friday that it did not need to sell its SpaceX shares to do so because its annual revenue was enough.
Who carried out the attack remains disputed, and that part of the story should be read with care. TRM Labs said it attributed the theft to TraderTraitor, North Korea’s elite hacking unit, with high confidence, citing similarities to last year’s $1.5 billion attack on the Bybit exchange, which the FBI attributed to North Korean hackers. Binance’s own investigation, however, has not yet identified the attackers, and North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts. The North Korea attribution is therefore single-sourced to TRM Labs at this stage, not a confirmed finding by Binance or law enforcement.
Separately, Reuters reported on Friday, citing a person familiar with the situation, that Binance is working with law enforcement around the world, including the FBI and the US Secret Service. That law-enforcement account is also single-sourced for now: the US Secret Service did not respond to a request for comment outside US hours, and the US embassy in London said it had no comment.
The scale dwarfs previous crypto thefts. The Bybit theft in February 2025, worth $1.5 billion, was the previous record. TRM Labs said attackers stole $2.9 billion of cryptocurrency across nearly 150 incidents last year, underscoring how quickly the Binance raid alone has eclipsed a typical year’s losses.
For an industry built on the promise that blockchain transparency makes theft harder to hide, the Binance heist is a test of the opposite claim: that the same transparency, combined with fast coordination between exchanges and stablecoin issuers, can freeze stolen money before it disappears. Roughly half was stopped. The other half will test whether that coordination can reach the coins no issuer controls.
Sources: Reuters — “Gone in 20 minutes: How the biggest heist in crypto history unfolded” (https://www.reuters.com/legal/government/gone-20-minutes-how-biggest-heist-crypto-history-unfolded-2026-10-30/); Reuters — “Blockchain analysis firm TRM says North Korea behind Binance crypto theft” (https://www.reuters.com/legal/government/blockchain-analysis-firm-trm-says-north-korea-behind-binance-crypto-theft-2026-10-30/); Reuters — “FBI and US Secret Service working with Binance after $6.3 billion hack, source says” (https://www.reuters.com/world/us/fbi-us-secret-service-working-with-binance-after-63-billion-hack-source-says-2026-10-30/); Reuters — “Binance does not need to sell SpaceX shares to cover losses, co-founder says” (https://www.reuters.com/business/media-telecom/binance-does-not-need-sell-spacex-shares-cover-losses-co-founder-says-2026-10-30/).
