Binance, the world’s largest crypto exchange by trading volume, says a security breach on Thursday, 29 October, affected an estimated $6.3bn (£4.7bn) in digital assets. Around $3bn has been frozen with help from blockchain partners. Much of the rest is still outside the exchange’s control. Binance has temporarily suspended deposits and withdrawals while it investigates.
If the estimate holds, it’s the largest crypto theft on record. The previous record was the $1.5bn taken from Bybit in February 2025.
Binance’s message to customers was clear: “Binance will cover all losses.” The exchange says it will compensate users from its Secure Asset Fund for Users (SAFU) and company funds. The breach affects Binance.com, which launched in 2017 and has more than 335 million registered users worldwide. Binance.US, the much smaller platform for American residents, says it isn’t affected.
All figures are based on Binance’s statements and market data reported on 29 and 30 October 2026, and may have changed since publication.
How the Binance security breach happened
Binance’s initial investigation points to one laptop. The exchange says a DevOps engineer’s machine may have been compromised. That may have let the attacker access a service container and submit unauthorized withdrawal transactions.
The funds were transferred from Binance’s hot wallets. These wallets stay connected to the internet so an exchange can process customer withdrawals quickly; cold wallets, by contrast, stay offline. Binance says it’s found no evidence that private keys leaked from any of its wallets.
Blockchain investigators, including Blockaid and TRM Labs, have also pointed to EIP-7702. It’s an Ethereum feature, added in May 2025, that lets an ordinary wallet hand control of its behavior to smart contract code.
According to their accounts, the attacker used it to make a Binance hot wallet run a “sweeper” contract that only the attacker could call. That contract drained the wallet and kept collecting new funds as they arrived. Binance hasn’t confirmed these details. It says it’ll publish a full postmortem once the investigation’s finished.
Who could be behind it?
The attack bears the hallmark of similar attacks attributed to groups affiliated with North Korea, but North Korean involvement has not been confirmed at this time.
Binance hasn’t named a suspect. It says it’s working with law enforcement partners to “confirm the identity of these criminals and bring them to justice.”
How bitcoin and BNB reacted
Market prices and percentage changes reflect reported levels on 29 and 30 October 2026. Figures may have changed since publication.
The news broke Thursday evening (European time), and crypto prices fell as it spread. Bitcoin dropped 4.8% to below $77,000 late on Thursday, according to CoinDesk. Reuters reported a six-week low of $76,368 in early Asian trading on Friday.
BNB, Binance’s own token, took the bigger hit. BNB fell 7.1% to $698.65 on Thursday evening, according to The Block. Ether was down 5.7%, and Solana also fell sharply.
The sharp move also hit leveraged traders. As prices fell, some leveraged positions dropped below their required margin levels and were automatically closed out (forced liquidation).
Liquidations came to about $1.5bn across the market, CoinDesk reported. That included $468m in bitcoin and $358m in ether. Most were long positions, bets that prices would rise. The crypto market’s total value fell 3.3% to around $2.73tn, according to CoinGecko data.
Still, some analysts expected worse. Rick Maeda, head of markets at Laevitas, called the reaction “fairly contained” and said BNB’s fall was “quite modest for possibly the largest exchange theft ever.”
What the industry is saying
Changpeng Zhao, Binance’s former chief, was among the first to call it a hack. “It does look like a hack on Binance,” he said. Zhao no longer runs the exchange but is still its majority shareholder.
Co-founder and co-chief executive Yi He told customers on X that “user funds are safe” and that Binance would cover all hacking losses. In a later post, she explained the withdrawal freeze: “Safety first: withdrawals are currently disabled until the environment is confirmed to be secure.”
The stablecoin freezes
Stablecoin issuers responded most strongly, blocking their tokens from moving. Tether and Circle froze about $2.4bn between them. Tether CEO Paolo Ardoino said his firm had locked about $1.6bn “related to a potential Binance exchange hack.” Circle chief executive Jeremy Allaire said Circle had frozen more than $800m. Ripple also froze funds linked to the attack.
World Liberty Financial, a crypto company linked to US President Donald Trump and his family, also took part. It froze $27m of its USD1 stablecoin and about $2m of its WLFI token, according to Yi He.
Freezing assets stops them from being moved or spent. It doesn’t necessarily mean Binance has recovered or returned the funds.
Analysts and other exchanges
Ari Redbord, global head of policy at TRM Labs, told the BBC the hack was a “watershed moment” unlike anything the industry has seen. He added that the attacker still holds an enormous sum, so efforts to trace and recover the funds are still in the early stages.
Eric Jardine, head of research at Chainalysis, urged every exchange to be on high alert. He said the sheer value of the assets they hold makes them very attractive targets.
Rival exchange Coinbase said it wasn’t affected. Its CEO, Brian Armstrong, said the company was blocking transfers to compromised wallets and had offered Binance its help. “Moments like this call for the industry to work together,” he wrote.
How it compares with earlier hacks
This isn’t the first time Binance has lost funds to attackers, though it’s by far the largest incident.
| DATE | INCIDENT | AMOUNT |
|---|---|---|
| October 2026 | Binance.com hot wallet security breach | Approx. $6.3bn |
| February 2025 | Bybit exchange hack | Approx. $1.5bn |
| October 2022 | BNB Chain cross-chain bridge exploit (separate from the Binance exchange) | Approx. $570m |
| May 2019 | Binance hot wallet breach | Approx. $40m (about 7,000 BTC) |
Binance estimated the 2026 breach’s impact at about $6.3bn, with around $3bn frozen at the time of its 30 October update. In 2019, Binance repaid customers from its SAFU fund, an emergency reserve it set up the year before.
How to keep your own accounts and wallets safer
Binance’s initial investigation points to a compromised employee laptop as the possible entry point for the attack. Most people won’t face an attack on that scale. But the same basic habits make an account much harder to break into. The tips below are general good practice for anyone holding crypto or using online financial accounts.
- Use a password manager and a different, long password for every exchange, wallet, and email account.
- Turn on two-factor authentication (2FA) with an authenticator app or a hardware security key. SMS codes are weaker because attackers can hijack a phone number through a SIM swap.
- Lock down your email first. It’s the reset route for almost every other account you own.
- Use the extra controls your exchange offers, such as withdrawal address whitelists, anti-phishing codes, and login alerts.
- If you use API keys for trading tools, disable withdrawal permissions and restrict the keys to your IP address.
- Keep long-term holdings in a hardware wallet (a cold wallet), and only trade what you use on an exchange.
- Never share your seed phrase. Write it down and store it offline; don’t photograph it or save it to cloud storage.
- Keep your computer and phone updated, and only install software from official sources.
- As always, after a big online attack, expect the usual round of fake “recovery” scams. Fraudsters pose as support staff and send fake “recovery” links. Binance itself has warned users not to trust unofficial links, messages, or requests for account information.
- Be particularly suspicious of anyone claiming they can recover stolen cryptocurrency for a fee. If you have been affected in any way, your first port of call is Binance support. Treat any offers to recover stolen funds for a fee as a scam attempt.
CFDs are complex instruments and carry a high risk of rapid losses due to margin trading. Consider whether you understand how CFDs work and whether you can afford the risk of losing your money. This article is for educational purposes and is not investment advice.
