Binance Hack: What We Know About the Largest Crypto Theft in History

On October 29, 2026, Binance, the world’s largest cryptocurrency exchange, confirmed that about $6.3 billion in digital assets were affected by a cyberattack. That makes it the biggest crypto heist on record, well above the $1.5 billion taken from the Bybit exchange in February 2025.

The company says it will cover all losses and that customer funds were not used. Even so, the incident left withdrawals suspended and raised new questions about the security of centralized exchanges, a topic that matters to millions of users in Latin America.

The Binance hack in 30 seconds

•       Amount affected: about $6.3 billion, according to Binance. Blockchain analytics firm TRM Labs estimates the attacker moved roughly $6.36 billion across ten blockchains, most of it in about 20 minutes.

•       Funds frozen: around $3 billion, with help from stablecoin issuers and law enforcement. That figure may change as tracing continues.

•       Compensation: Binance says it will cover all losses and has set aside more than $6.34 billion of company funds to do so.

•       Likely culprit: several analytics firms attribute the attack to TraderTraitor, a North Korean hacking unit linked to the Lazarus Group.

•       Service status: deposits are working normally. Withdrawals remain paused, and Binance expects to restart them gradually starting Sunday, November 1.

How the attack happened

According to the company’s initial account, the breach appears to have started with a compromised engineer’s laptop. That access gave the attacker a foothold in a service container, from which unauthorized withdrawals were made.

Later findings uncovered additional weak points, which suggests a more elaborate operation than a single human error. Richard Teng, Binance’s co-CEO, said the attacker did not rely on one engineer’s permissions alone and that, so far, there is no evidence a wallet private key was leaked.

Jayant Dave, chief information security officer at cybersecurity firm Check Point, points to a worrying trend: attackers no longer need to steal the keys to the vault. They target the systems and the people authorized to use those keys. The case resembles the September hack of the Bitget exchange, which cost $388 million.

Hot wallets vs. cold wallets

To understand the scale of the damage, it helps to know the two main ways exchanges store crypto:

•       Hot wallet: stays connected to the internet and is used to process withdrawals. It is convenient, but more exposed.

•       Cold wallet: is kept offline and holds most of the assets. It is safer, though slower to use.

Binance says the attack hit one of its hot wallets. User funds are mostly held in cold storage and are only moved to a hot wallet when someone requests a withdrawal.

Who is behind it: the North Korea connection

Two analytics firms, TRM Labs and Chainalysis, attribute the attack with a high level of confidence to TraderTraitor. Check Point links the group to Lazarus, and investigators previously tied it to the 2025 Bybit hack. Shared hallmarks include small Tornado Cash transactions used to fund the attacker’s wallet, long staging periods, and transactions executed in a single burst.

Western security agencies have said for years that funds stolen by these groups help finance North Korea’s nuclear and missile programs. The regime has denied involvement in cyberattacks in the past. Binance has not publicly confirmed who is responsible and says it is working with law enforcement to identify the perpetrators.

What happens to users’ money

Teng says Binance never uses customer funds and that, for that reason, they were not affected. The company committed to publishing a full proof-of-reserves report, with a preview ahead of a Monday, November 2 deadline.

In the meantime:

1.     Binance is rebuilding its withdrawal service and will only reactivate it after it passes rigorous security testing.

2.     A comprehensive security review of all of the platform’s systems is underway.

3.     Tether and Circle, the stablecoin issuers, froze a combined total of about $2.4 billion.

4.     World Liberty Financial said it coordinated with partners to freeze stolen funds.

5.     Binance.US, the separate platform for U.S. residents, said it was not compromised. Coinbase also said it was not affected.

Bitcoin fell more than 4% after the first market warnings and then stabilized. Analysts caution that it remains to be seen how prices will react once users can trade normally again.

The biggest crypto hacks in perspective

Incident	Date	Approximate amount
Binance	October 2026	$6.3 billion
Bybit	February 2025	$1.5 billion
Bitget	September 2026	$388 million

With more than 300 million registered users and over $160 billion in assets under custody as of 2024, Binance holds an enormous share of the market. That is why an incident in its infrastructure is felt across the whole industry.

Why the Binance hack matters in Latin America

Latin America is one of the regions where Binance is used most, largely because of economic instability.

Argentina. In 2024, nearly 7.2% of Binance’s global traffic came from Argentina, the highest share in the world. Many Argentines use crypto to protect their savings from inflation and the devaluation of the peso. The pause in withdrawals brought back memories of the “corralito” restrictions of the early 2000s.

Venezuela. There is no data yet on the impact, but several experts believe it could be even larger. For many Venezuelans, Binance is a way to receive remittances, preserve purchasing power, and access digital dollars outside the traditional banking system.

In both countries, the episode shows the risk of relying on a single platform for essential financial functions.

What users can do now

This information is general and is not financial advice.

•       Review your authentication: turn on two-factor authentication with an authenticator app or a hardware key instead of text messages.

•       Beware of opportunistic messages: scams impersonating customer support tend to spike after incidents like this. Binance does not ask for passwords or seed phrases.

•       Stick to official channels: check withdrawal status only through the platform’s verified accounts and website.

•       Know how your funds are held: understand how much of your money sits on a centralized platform and how much you keep in wallets you control.

•       Follow the proof-of-reserves report: the report Binance promised is a useful reference for judging its financial position.

Frequently asked questions

How much money was lost in the Binance hack?

Binance estimates that about $6.3 billion in digital assets were affected, and roughly half has been frozen. The final figure may change as the investigation continues.

Did Binance users lose money?

According to the company, user funds were not affected because it never uses customer money, and it has pledged to cover all losses.

Who hacked Binance?

Analytics firms such as TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking unit. Binance has not publicly confirmed the identity of those responsible.

Was Binance.US affected?

No. Binance.US said its platform was not compromised. The incident affected Binance.com.

Sources: BBC News Mundo (October 30, 2026); NPR; Bloomberg; Forbes; Cointelegraph; SecureWorld (analysis by TRM Labs).