6.3 billion stolen in 20 minutes: what we know about the hacker attack on Binance

Binance, the world’s leading cryptocurrency exchange platform by volume, was the victim of a major hacker attack which led to the record theft of approximately 6.3 billion dollars. A “lightning” blitz: according to the international media, which are already talking about the “coup of the century”, most of the transfers took place within just 20 minutes. According to what was reported by CNBC, the US blockchain analysis company Trm Labs attributed the cyber offensive with “high reliability” to TraderTraitor, an elite group of cybercriminals sponsored by North Korea.

The dynamics of the blitz

The platform temporarily suspended deposits and withdrawals, confirming that it had suffered a “complex attack” which affected funds for approximately 6.3 billion dollars (equal to 5.63 billion euros) and which involved several “violation points”.
“Our initial investigations suggested that the security incident may have involved a compromised laptop – we read in a post on

Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach. This was a complex attack, and we are doing everything we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them. Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected. The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far. We will continue to provide further updates through official Binance channels as more verified information becomes available.

— Binance (@binance) October 30, 2026

The group reassured users, explaining that “the funds are completely safe”, but also declaring itself ready to “cover all losses”.

Binance has begun recovering affected assets for users and continues to work with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds. The company has already publicly committed to cover losses through company funds in the prior announcement. Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can. These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3bn has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets. We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress. Ultimately, all user funds will be verified publicly through our Proof of Reserves. We will weather this storm. Thank you for the support.

— Binance (@binance) October 30, 2026

Frozen funds

Timely intervention made it possible to limit the damage: approximately 3 billion dollars were frozen directly on the blockchain thanks to collaboration with industry partners. Specifically, the manager of Tether (issuer of the USDT cryptocurrency) announced the freezing of approximately 1.6 billion dollars, while Circle (issuer of USDC) froze approximately 800 million dollars. Circle’s CEO, Jeremy Allaire, specified that the intervention had been agreed with the authorities. Both currencies are “stablecoins”, i.e. pegged to the dollar.

Actual losses

Binance explained that the amount of blocked funds could increase as the checks continue. Meanwhile, the exchange’s former number one Changpeng Zhao, still a majority shareholder but without operational roles, estimated that the actual losses for the company could be “exceeding” $1 billion.

The previous one

However, this would be an amount four times higher than that stolen in the largest cyber attack of this type ever recorded so far: the theft of 1.5 billion dollars against the Bybit platform, which occurred in February 2025. At the time, the attack was attributed to TraderTraitor, a group of hackers linked to North Korea and part of the Lazarus Group (which made headlines in 2014 for the attack on Sony Pictures).

The North Korean trail

Blockchain analytics firm Trm Labs said it believes “with a high degree of certainty” that the attack on Binance was also orchestrated by TraderTraitor, citing solid evidence gathered both on-chain and off-chain: “Several features of this attack correspond to previous thefts traced back to North Korea.”

Market reaction

News of the cyber attack caused a sharp initial drop in major cryptocurrencies, followed by a partial recovery. After losing almost 5% at the end of the American session, bitcoin limited its decline to 0.83% around 6 am Italian time, while ether lost 0.81%. Bnb, the cryptocurrency issued directly by Binance, rebounded 2.67% after initially sinking nearly 10%.