--- title: "The $6.3 Billion Binance Hack: Inside the Largest Crypto Heist on Record" author: "ZyVOP" published: "2026-10-30T08:04:30.741Z" updated: "2026-10-30T08:04:30.741Z" url: "https://zyvop.com/the-6-3-billion-binance-hack-inside-the-largest-crypto-heist-on-record-75fc8" canonical: "https://zyvop.com/the-6-3-billion-binance-hack-inside-the-largest-crypto-heist-on-record-75fc8" tags: ["binance","cybersecurity","Arkham","Crypto Hack","Lazarus Group"] --- # The $6.3 Billion Binance Hack: Inside the Largest Crypto Heist on Record Binance says $6.3B was impacted, about $3B is frozen, and investigators point to North Korea. What’s confirmed, what’s disputed, and what to watch next. ![Cover image]() On October 29, cryptocurrency worth about $6.3 billion left Binance-attributed wallets in unauthorized transfers across multiple blockchains. Binance says roughly $3 billion has been frozen and that it will cover customer losses through its Secure Asset Fund for Users (SAFU) and company funds. Independent investigators broadly support the scale, but their estimates use different blockchain coverage, wallet groups and observation times. The figures below should not be added together. ## The incident at a glance | Measure | Reported figure | What it means | | --- | --- | --- | | Binance’s estimate | About **$6.3 billion** | Binance’s estimate of the incident’s total impact | | TRM Labs | About **$6.36 billion** | Value traced out of Binance wallets across ten blockchains | | Bitquery | About **$6.3 billion** | Transfers traced from 17 Binance hot wallets across nine blockchains | | Frozen or rescued | About **$2.7 billion** | Bitquery and TRM estimates; Binance has said roughly $3 billion | | Remaining tracked holdings | About **$3.2 billion** | Bitquery’s attacker-wallet snapshot at **06:43 UTC on October 30** | | Bitcoin traced | **18,270 BTC** | Split among 19 wallets; still unspent in the 06:43 UTC snapshot | An outflow estimate values assets when they leave Binance. A later wallet snapshot reflects subsequent swaps, freezes, price movements and address attribution. A tracked balance is therefore not the same thing as a confirmed loss or a recoverable amount. ([Binance](), [TRM Labs](), [Bitquery]()) ## How the attack unfolded Bitquery traced the first linked outflow to the XRP Ledger at about 20:04 UTC on October 29, followed shortly by Solana and other networks. Around 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to attacker-controlled addresses and a TRON wallet sent hundreds of millions of USDT and TRX. The main Ethereum drain followed at about 20:24 UTC. Related transfers continued until Bitquery’s final Ethereum drain at 23:56 UTC; Arbitrum activity began around 20:30 UTC and Polygon transfers appeared around 23:05 UTC. TRM says most of the approximately $6.36 billion moved in about 20 minutes, beginning around 20:05 UTC. That is consistent with Bitquery’s longer timeline: the first burst accounted for most of the value, while associated transfers continued afterward. TRM counts ten affected blockchains; Bitquery’s published trace covers nine and identifies 17 Binance hot wallets. The firms’ scopes are not identical. ([TRM Labs](), [Bitquery]()) The operation was prepared in advance. TRM says preparation began at least 36 hours before the theft, with small withdrawals from Tornado Cash used to fund an operator wallet. Investigators also describe code testing and rehearsals before the main transfers. These traces support the conclusion that the operation was planned; they do not, by themselves, identify the people controlling the wallets. ([TRM Labs](), [Bitquery]()) ## Why estimates range from $5.6 billion to $6.4 billion Early reports cited figures around $5.6 billion while investigators were still identifying addresses and tracing assets across chains. Binance later put the impact at about $6.3 billion. TRM estimated $6.36 billion across ten blockchains, while Bitquery traced roughly $6.3 billion from 17 Binance hot wallets across nine. The differences reflect different chain and address coverage, prices at different observation times, and different definitions of “stolen.” Original outflows, current holdings, frozen tokens and assets acquired through swaps are separate measurements. Investigators may also revise address groupings as new evidence appears. The Arkham label `binance-hacker-1029` is a tracking cluster, not a Binance-confirmed loss figure. Its historical portfolio values describe assets held by grouped addresses at a particular moment and may include frozen or illiquid tokens. This article therefore prioritizes Binance’s statement and the transaction analyses published by TRM and Bitquery. ([Arkham entity page](), [Molly White’s analysis]()) ## How the attacker got access The public technical accounts point to an internal compromise followed by unauthorized withdrawals, but the full chain of events is not yet established. ### 1\. A suspected compromise of an engineer’s laptop Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop, which allegedly gave the attacker access to a service container used to submit unauthorized withdrawals. Binance says it has found no evidence of a wallet private-key leak. This is a preliminary account; a full technical post-mortem is still pending. ([Binance]()) ### 2\. Binance’s systems signed the transfers Bitquery says the outflows carried valid signatures from Binance-controlled wallets. On 16 of the 17 wallets it examined, Binance’s system signed transfers resembling ordinary withdrawals, although some settings differed from normal activity. A valid signature confirms wallet authorization; it does not reveal who prompted the system or how the attacker gained access. ([Bitquery]()) ### 3\. EIP-7702 was used on Ethereum On Ethereum, the attacker used EIP-7702, which lets a wallet authorize smart-contract code to act on its behalf. TRM and Bitquery say the attacker prepared 50 authorizations with consecutive transaction counts for Binance’s main Ethereum hot wallet. Each worked only at a specific count; one matched, allowing the wallet to run attacker-controlled code. Bitquery says the first major call moved about 167,000 ETH, 1.6 billion USDT and dozens of other tokens. The code was called repeatedly over the next several hours. Other affected networks were drained through separately signed transfers. ([TRM Labs](), [Bitquery]()) ## Where the money went—and what was frozen Stablecoin issuers can freeze tokens such as USDT and USDC. TRM estimates that Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. Bitquery identifies approximately 1.76 billion USDT frozen by Tether and 823 million USDC by Circle, plus about $132 million frozen by smaller issuers. Arbitrum’s Security Council separately locked about 8,426 ETH and 74.6 million ARB. Independent estimates put the combined frozen or rescued total near $2.7 billion; Binance has reported about $3 billion. ([TRM Labs](), [Bitquery](), [Binance]()) Timing was critical. Tether’s first major freeze on the main Ethereum receiving wallet came about 37 minutes after the drain; about $700 million in USDT had already moved. Tether froze 11 attacker-linked wallets on Ethereum and TRON, six of them already empty. Circle froze about 823 million USDC in the main Ethereum wallet within minutes, before those tokens moved. Bitquery also traced about $729 million in stolen USDT converted into ETH and TRX before freezes arrived, including swaps through decentralized trading services and borrowing against USDT on Aave. ([Bitquery]()) ### The Bitcoin that cannot be frozen by an issuer CoinDesk traced approximately 18,270 BTC—worth about $1.4 billion at the prices in its report—from a Binance hot wallet into 19 attacker-controlled addresses. Seventeen wallets held exactly 1,000 BTC each; the remaining balances were about 832.5 BTC and 437.7 BTC. CoinDesk reported that none had sent Bitcoin onward as of 04:23 UTC on October 30. Bitquery’s later 06:43 UTC snapshot still listed all 18,270 BTC as unspent. Bitcoin has no central issuer that can blacklist an address in the way Tether or Circle can freeze their tokens. The coins are traceable, but stopping them generally depends on exchanges, over-the-counter desks or swap services refusing to process them. ([CoinDesk](), [Bitquery]()) ### Why the attacker’s ETH balance grew The attacker initially took about 200,000 ETH from Binance, then acquired roughly 308,000 more by swapping stolen stablecoins and other tokens. Bitquery counted 508,621 ETH in tracked attacker wallets at 06:43 UTC on October 30. That balance is not the amount of ETH originally stolen. ([Bitquery](), [CoinDesk]()) At 06:43 UTC, Bitquery valued tracked attacker-wallet holdings at about $3.2 billion, mostly ETH and BTC. It had not traced funds to a known exchange, mixer or bridge, although it did record ETH consolidation and TRX moving through new addresses, including swaps back into USDT. This is a time-stamped estimate, not a final recovery figure. ([Bitquery]()) ## Who is suspected? TRM Labs attributes the attack to TraderTraitor, a North Korean hacking unit, with what it calls high confidence. TRM says its assessment draws on on-chain and off-chain intelligence and points to similarities with previous North Korea-linked thefts, including the February 2025 Bybit hack. Reuters also reported that Chainalysis attributed the Binance theft to North Korea. ([TRM Labs](), [Reuters]()) This is a serious intelligence assessment, not a final legal finding. Binance has not publicly named an attacker and says it is working with law enforcement. The public evidence reviewed for this article does not establish a formal government attribution of this specific incident. ## What it means for Binance customers Binance says user funds are safe and it will cover all customer losses through SAFU and company funds. It has not detailed how much will come from either source. Its October 30 notice said deposits and withdrawals were temporarily suspended during security checks. Customers should check Binance’s official status updates for their asset and network, and avoid unsolicited recovery offers. ([Binance]()) CoinDesk found that Binance 14, the Ethereum hot wallet central to the attack, appeared in Binance’s October 1 Proof of Reserves data. Based on that snapshot, CoinDesk estimated that the roughly 204,500 ETH drained could reduce ETH reserve coverage to around 94% until replaced. This is a point-in-time estimate, not a real-time solvency audit. Binance has promised an updated Proof of Reserves after remediation; the November 1 snapshot is the next one to watch. ([CoinDesk]()) ## What to watch next 1. **Withdrawals:** when Binance restores services across the affected networks and confirms that each is safe to use. 2. **The post-mortem:** how the engineer’s laptop was compromised and how unauthorized requests passed through the withdrawal process. 3. **Reserves:** whether the expected November 1 Proof of Reserves shows that missing assets have been replaced. 4. **Wallet movements:** whether the 18,270 BTC moves, and whether the tracked ETH and TRX reach identifiable exchanges or other services. 5. **Attribution and recovery:** whether Binance, law enforcement or additional investigators confirm or revise the TraderTraitor assessment. ## Frequently asked questions ### Is Bitcoin recoverable? The 18,270 BTC remained unspent in Bitquery’s 06:43 UTC snapshot. Bitcoin cannot be frozen by a token issuer, although services that receive it may be able to block or report suspicious funds. ### Who was behind the attack? TRM attributes it to North Korea-linked TraderTraitor with high confidence. Binance has not publicly named a suspect. ## Sources and further reading - [Binance — Security Incident Update, October 30, 2026]() - [TRM Labs — North Korea steals $6.36 billion from Binance]() - [Bitquery — Binance hack: $6.3 billion drained on nine chains, $2.7 billion frozen]() - [Reuters — TRM says North Korea was behind the Binance theft]() - [CoinDesk — Hacker splits $1.4 billion of Bitcoin into 19 wallets]() - [CoinDesk — Drained wallets backed customer assets, reserve data shows]() - [Arkham —]() `binance-hacker-1029` [entity page]() - [Molly White — Analysis of the Binance theft]() * * * _Editorial note: This article reflects information available on October 30, 2026. Binance’s investigation is preliminary, attribution is not a final legal finding, and on-chain valuations may change as addresses are reclassified, tokens are frozen, and assets move._