Binance suffered the largest cryptocurrency theft on record on October 29, 2026, after attackers spent months1 targeting employees and compromising the systems behind its wallet infrastructure. This attack allowed hackers to move approximately $6.34 billion in digital assets without using the exchange’s normal withdrawal procedures.
The breach involved malicious software, fake recruitment interviews, stolen employee credentials and an internal AI tool. Attackers eventually reached the systems used to authorize transactions and exploited a weakness in how Binance’s hot wallets handled transaction permissions.
The FBI blamed North Korea’s TraderTraitor hacking group2. Pyongyang denied responsibility, calling the accusation a political provocation. Binance has not independently named the group as the culprit, but its investigation described an operation consistent with the FBI’s findings.
The incident also raised uncomfortable questions about exchange security. If the world’s largest cryptocurrency exchange can suffer a breach of this scale, how safe are customer assets at any centralized trading platform?
How the Binance Hack Started
Binance’s initial investigation traced the attack to June 2026, several months before the stolen funds moved3.
The attackers first gained a foothold through a compromised software download. An engineer, identified by Binance as Engineer A, downloaded a tampered Homebrew installation while searching for an AI coding tool.
Homebrew is a package manager that developers use to install software. Binance detected the suspicious activity, replaced the affected computer and rotated credentials. However, the attackers had already collected information about the employee and other members of the wallet development team.
The campaign continued in September, when another engineer became a target.
Engineer B received a job offer through a legitimate recruitment platform. The supposed employer arranged video interviews with people posing as company representatives. They used convincing social media profiles and personal photographs to build trust.
During a later interview, the engineer received a coding assignment. The project contained malicious code that infected the employee’s work computer.
The malware replaced a legitimate component of a development tool. It also used obfuscation and other evasion techniques to avoid detection by endpoint security software.
The attackers could now monitor the engineer’s system and gather information about Binance’s internal operations.
How Hackers Reached Binance’s Wallet Systems
The attackers did not immediately attempt to steal funds. Instead, they used their access to study Binance’s internal systems and identify employees with access to critical wallet infrastructure.
On October 20, they used a compromised computer and an internal AI tool to gain control of additional engineer devices. Binance said the attackers reached the systems of multiple wallet software engineers.
The internal AI tool became part of the attack chain. The breach was therefore not simply a case of someone stealing a password and logging into an exchange account. The attackers used compromised employee devices and credentials to move deeper into the company’s internal environment.
On October 29, they used stolen deployment credentials to launch a container and execute a malicious script. That script reached Binance’s internal wallet signing service and initiated transactions outside the exchange’s normal withdrawal procedures.
This distinction made all the difference. The attackers did not need to convince Binance’s ordinary withdrawal system to approve a series of customer withdrawals. Instead, they compromised the infrastructure that authorized transactions in the first place.
How the Attackers Moved Billions in Crypto
The final stage involved Binance’s hot wallets, which hold cryptocurrency in internet-connected systems for transactions and withdrawals.
The attackers exploited Ethereum’s EIP-7702 account authorization feature. The mechanism allows an externally owned account to delegate certain execution functions to a smart contract.
In this case, the attackers used malicious delegations to gain control over transaction execution. They prepared dozens of signing transactions that manipulated account nonces and established permissions for attacker-controlled contracts.
Binance’s multiparty computation, or MPC, security system added another complication. MPC divides control over cryptographic signing across multiple participants or components. It is designed to prevent one compromised key from giving an attacker complete control.
However, the attackers had compromised the systems involved in the signing process. Binance said this made revoking the malicious authorizations more complicated than simply disabling a stolen password or replacing a key.
The exchange had to develop a specialized procedure to revoke the permissions. Suspending withdrawals alone did not invalidate authorizations already recorded on the blockchain.
The attack affected hot wallets holding assets across several networks. Binance’s investigation described unauthorized transfers involving approximately 970,500 SOL and 44.2 million OP, followed by the movement of 18,270 BTC from a Binance hot wallet.
The reported total reached approximately $6.34 billion in affected assets. The attackers moved funds across multiple networks and used the compromised signing infrastructure to bypass normal withdrawal controls.
The incident shows why the distinction between account security and infrastructure security matters. Even strong customer login protections cannot fully protect funds if attackers gain access to the systems that approve transactions.
Binance Freezes Billions and Restarts Withdrawals
Binance detected the unusual transfers and began working to contain the breach. The exchange said it froze or intercepted approximately $2.85 billion in assets, with other cryptocurrency firms and issuers helping block funds.
Tether froze nearly $1.57 billion, while Circle froze more than $800 million, according to reporting on the response. The FBI also published wallet addresses associated with the attackers and urged cryptocurrency firms to block related transactions.
Binance suspended withdrawals while it investigated the breach and worked to secure its systems. The exchange later restarted withdrawal services in stages after carrying out security checks4.
The disruption triggered a wave of withdrawals. Between 06:00 and 15:30 UTC on November 1, Binance recorded approximately $4.65 billion in withdrawals and $1.01 billion in deposits. That left a net outflow of about $3.64 billion, equivalent to roughly 2.1% of the exchange’s assets under management.
Binance said it had set aside enough company funds to cover customer losses5. It also reported replenishing most affected assets, with its later update putting the figure at 98% of affected tokens. That figure refers to assets replenished by the company, not stolen funds recovered from the attackers.
The exchange apologized to customers and said it had rebuilt or replaced affected internal systems. Binance also said it would publish a fuller account after its investigation.
FBI Blames North Korea, but Pyongyang Denies Involvement
The FBI attributed the attack to TraderTraitor, a North Korean-linked hacking group6. The group has been associated with several major cryptocurrency thefts, including the $1.5 billion Bybit hack in 2025.
Bybit suffered a $1.5 billion hack on earlier today, when attackers exploited a vulnerability in an Ethereum cold wallet transfer. Despite the breach, Bybit reassured users that all funds remain backed 1:1, withdrawals are open, and security measures are being enhanced.Read Now
North Korea expectedly rejected the accusation7. Kim Yo Jong, the sister of North Korean leader Kim Jong Un, called the FBI’s statement absurd rhetoric and accused Washington of trying to damage the country’s reputation.
North Korean-linked hackers have repeatedly targeted cryptocurrency companies. US and international investigators have long accused these operations of helping the country generate revenue despite international sanctions.
Blockchain analysis firms have also tracked efforts to move the stolen Binance funds. Elliptic identified thousands of wallets across multiple blockchains and reported tens of thousands of transactions during the first days after the theft. Such activity can make tracing and freezing the funds increasingly difficult.
Why Was So Much Crypto Exposed to a Hot-Wallet Attack?
The breach raises another question that deserves scrutiny: how much cryptocurrency should an exchange keep in hot wallets?
Hot wallets remain connected to the internet, which makes them useful for processing customer withdrawals and other routine transactions. However, that connectivity also exposes them to online attacks. Cold wallets, by contrast, keep private keys offline and are generally used for longer-term storage.
Large exchanges need enough accessible liquidity to process withdrawals. But that does not automatically explain why an exchange would have billions of dollars exposed through hot-wallet infrastructure.
The reported $6.34 billion in affected assets makes the question unavoidable. It is important to distinguish the amount moved during the attack from the total balance of any single wallet. Binance’s reporting describes several affected hot wallets and transfers across multiple networks. It does not establish that one wallet held the entire $6.34 billion.
Even so, the scale of the loss raises questions about the amount of customer crypto accessible through connected systems. How much liquidity did Binance actually need in hot wallets to handle normal operations? Could it have kept a smaller amount online and relied more heavily on cold storage or additional approval controls?
Those questions should be asked because hot-wallet security is only one part of exchange protection. A company can use sophisticated cryptography and still face serious risks if compromised employee devices can reach systems with authority over customer funds.
If Binance Can Be Hacked, Is Any Crypto Exchange Safe?
Binance is the world’s largest cryptocurrency exchange by trading activity and has extensive security operations. Yet attackers reportedly spent months working around its defenses before reaching the systems responsible for authorizing transactions.
The technical details are sophisticated. The campaign involved malware, social engineering, compromised developer tools, internal systems and an exploit involving blockchain account permissions. But the initial route into the company was familiar: a malicious download and a fake job interview.
That contrast is one of the most troubling parts of the incident. The attackers needed access to only a limited number of employee devices and credentials to begin moving through a much larger system. Once they reached the wallet signing infrastructure, the consequences were measured in billions.
It’s also fair to ask why a handful of compromised employee credentials could help trigger withdrawals on such a scale. A security system should assume that individual accounts and devices can be compromised. Critical financial operations should still require independent checks that prevent one compromised route from authorizing enormous transfers.
The breach does not prove that every exchange is unsafe or that Binance’s entire security operation failed. It does show that size, reputation and sophisticated security tools cannot eliminate the risk of a coordinated attack.
For customers, the question is bigger than whether an exchange can stop phishing attempts or protect login credentials. It is whether the company can contain a breach after an attacker reaches its internal systems, and whether its wallet architecture limits the amount that can be stolen.
Find exchanges with decentralized wallets
If Binance, with its resources and security infrastructure, could lose control of billions in customer assets, smaller exchanges face an even harder test. The industry may need to answer a basic question: how much trust should customers place in platforms that hold large amounts of crypto online?
- https://arstechnica.com/information-technology/2026/11/binance-says-hackers-who-stole-billions-in-crypto-spent-months-planning-heist/ ↩︎
- https://www.fbi.gov/investigate/cyber/alerts/2026/north-korea-responsible-for-6-billion-binance-attack ↩︎
- https://www.binance.com/en/blog/community/3229153443759566763 ↩︎
- https://techcrunch.com/2026/11/01/binance-resumes-withdrawals-following-6-3-billion-breach/ ↩︎
- https://www.reuters.com/legal/transactional/tether-circle-freeze-238-billion-after-binance-reports-security-incident-2026-10-29/ ↩︎
- https://www.bbc.com/news/articles/ck9dz3v7z7v3o ↩︎
- https://www.usnews.com/news/world/articles/2026-11-02/north-korea-denies-involvement-in-binance-hack-and-criticizes-fbi-probe-as-a-trite-provocation ↩︎
