Binance, the world’s largest cryptocurrency exchange, reported a massive security breach on Thursday involving an estimated $6.3 billion in digital assets.
The attack, which analysts and blockchain intelligence firms describe as the largest crypto theft on record, sent shockwaves across digital asset markets, sending Bitcoin to six-week lows and triggering over $1.5 billion in market-wide derivative liquidations.
Binance executives said the exchange had already frozen or recovered nearly half of the compromised funds with industry partners, maintained that all customer balances remain safe, and pledged to fully absorb losses through its Secure Asset Fund for Users (SAFU) and corporate reserves.
How the Binance Security Breach Happened
According to on-chain security investigators and preliminary disclosures by Binance, the unauthorized transactions occurred between approximately 20:04 and 23:56 UTC on October 29, involving multiple Binance hot wallets across at least nine blockchain networks.
Binance estimated the total value of affected assets at approximately $6.3 billion. Chainalysis initially put the figure closer to $5.9 billion based on its analysis of the transactions. The stolen assets included substantial amounts of Ethereum, USDT, USDC, Bitcoin, and other tokens.
In a statement on X, Binance attributed the entry point to a compromised device belonging to a DevOps engineer. The attacker reportedly used the device to gain elevated access to internal service containers and authorize illicit withdrawal commands. Binance stressed that its investigation has found no evidence that hot or cold wallet private keys were directly leaked.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.As an immediate precaution, Binance has:
– temporarily suspended deposits and withdrawals while security checks are completed;
– revoked the affected address authorisation;
– engaged law enforcement and blockchain intelligence partners to trace and recover funds.Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
https://t.co/ywB2mKFy0p
— Binance (@binance) October 30, 2026
On the Ethereum network, the attacker reportedly exploited a sophisticated technical mechanism involving EIP-7702—a protocol standard introduced in May 2025 during Ethereum’s Pectra upgrade, effectively turning at least one Binance hot wallet into an instrument for automatically sweeping funds into attacker-controlled addresses.
The attacker also turned to DeFi protocols, using Aave to borrow nearly $45 million in wrapped Ether (WETH) against stolen USDT. According to Aave’s risk-management team, LlamaRisk, the attacker deposited approximately $60 million in USDT as collateral on Aave V3’s Ethereum Core market and borrowed 19,762 WETH, worth around $44.6 million at the time. The strategy allowed the attacker to gain exposure to ETH, which cannot be frozen by a centralized issuer, without having to sell the entire amount of USDT on the open market.
Aave subsequently coordinated an emergency response with Aave Labs, TokenLogic, and Certora, freezing lending reserves across its V3 and V4 markets to prevent further deposits and borrowing. Existing users could still withdraw collateral and repay loans. Aave said the attacker’s position remained overcollateralized and did not expose liquidity providers to losses.
Binance co-founder Yi He said customer funds remained safe and that the exchange would absorb all losses, with compensation covered by its Secure Asset Fund for Users (SAFU) and corporate funds. Withdrawals are expected to resume within approximately 48 hours.
Unprecedented Industry Freeze Limits Attacker Yield
The breach provoked a rapid, coordinated response from the broader crypto ecosystem.
Stablecoin issuers Tether and Circle quickly blacklisted addresses linked to the exploit, locking hundreds of millions of dollars in USDT and USDC. Other asset managers and protocols—including those overseeing RLUSD, First Digital (FDUSD), World Liberty Financial USD (USD1), and Arbitrum assets—followed suit.
Binance reported that approximately $3 billion had been frozen on-chain, with further recovery efforts underway.
The remaining funds, estimated at roughly $3 billion or more, were primarily held in Bitcoin and Ether. Unlike centrally issued stablecoins, these assets cannot simply be frozen by an issuer, leaving investigators with fewer options to prevent their movement.
Blockchain analytics firms TRM Labs and Chainalysis both attributed the attack with high confidence to TraderTraitor, a hacking outfit associated with North Korea’s Lazarus Group. In a blog post, TRM noted operational similarities to the February 2025 Bybit breach, which netted $1.5 billion, calling the Binance attack a “watershed moment for institutional cybersecurity.”
Our investigators observed funds stolen by DPRK in last month’s Bitget exploit commingling with funds stolen from Binance.
We have a high degree of confidence that DPRK is responsible for the $6.4 billion hack of Binance.
— Chainalysis (@chainalysis) October 30, 2026
Crypto Markets React to Record-Breaking Theft
News of the breach caused immediate turmoil across spot and derivatives markets.
Bitcoin fell approximately 3–4.5% to around 76,300–76,500, its lowest level in six weeks, before recovering to about $78.800 at press time. Ether declined more than 3%, trading in the low $2,180s, while BNB, Binance’s native ecosystem token, suffered a steeper decline of approximately 7–8%.
XRP, Solana, and several major DeFi tokens also moved lower, with liquidity conditions deteriorated on Binance during the initial market reaction, with bid-ask spreads widening across spot markets.
The sell-off was particularly severe in derivatives markets. According to CoinGlass data, approximately $1.55 billion in leveraged positions were liquidated over a 24-hour period, with long positions accounting for the overwhelming majority.
More than $600 million was liquidated within a single hour as Bitcoin’s decline triggered cascading margin calls. The largest individual liquidation identified was an approximately $11 million Bitcoin long position on Binance.
Crypto-related equities also came under pressure. Coinbase ($COIN) shares fell approximately 4.8%, while Strategy ($STRC) declined nearly 6% in extended U.S. trading. Neither company was directly affected by the Binance incident, but the declines reflected the close relationship between crypto market sentiment and publicly traded digital-asset businesses.
A New Record for Crypto Theft
The Binance incident represents a dramatic escalation in a series of increasingly sophisticated attacks against centralized cryptocurrency platforms.
The previous record was set in February 2025, when Bybit lost approximately $1.5 billion in an attack attributed to North Korean hackers. At an estimated $6.3 billion, the Binance incident would be more than four times larger.
According to TRM Labs, approximately $2.9 billion was stolen across roughly 150 cryptocurrency-related incidents in 2025 alone. Hot wallets remain an especially attractive target. Exchanges must maintain sufficient liquid assets to process customer withdrawals, meaning some funds need to remain accessible through operational systems even when the bulk of customer reserves is held in cold storage.
The apparent compromise of an employee’s laptop also highlights a less obvious vulnerability: attackers do not necessarily need to extract private keys directly if they can compromise the systems and personnel responsible for authorizing transactions.
The incident raises questions about internal access controls, employee device security, withdrawal authorization procedures, and the separation of operational infrastructure from wallet management systems.
It also illustrates the contrasting properties of public blockchains. Transparent transaction records allowed investigators to trace the stolen assets and coordinate a large-scale freezing operation. At the same time, Bitcoin and Ether holdings remained beyond the direct control of centralized issuers, complicating recovery efforts.
Binance’s proof-of-reserves disclosures may also face renewed scrutiny. The exchange’s early-October snapshot reportedly showed sufficient Ether reserves to cover customer balances. The removal of more than 200,000 ETH in the incident would temporarily affect that coverage ratio, although Binance has indicated that it will replenish reserves and address the situation in an updated snapshot.