Binance’s $6.3B Vault Break: Biggest Heist Yet, but the Backup Plan Is Still Crypto 🧊

Binance said it suffered a record $6.3 billion security incident after attackers moved assets from the exchange’s hot wallets across 10 blockchains on October 29, 2026, with most of the outflow occurring within about 20 minutes. The exchange initially estimated the impact at $5.57 billion, with $3.51 billion on Ethereum, $1.44 billion in 18,270 Bitcoin and $630 million on Tron. Later estimates ranged from $6.01 billion to $6.4 billion as investigators traced additional movements. Binance CEO Richard Teng said the attack “was not carried out by one person” and described it as “a more complex attack process.”

The investigation initially pointed to a compromised DevOps engineer’s laptop that may have provided access to a service container, allowing an attacker to submit unauthorized withdrawal transactions. Binance later announced that it had found “additional points of breach” and found “no evidence of any wallet private key leak.” The attacker used Ethereum’s EIP-7702 delegation feature to gain execution authority over a hot wallet without passing Binance’s normal approval controls, while also employing a self-destruct mechanism to erase tools and traces. Blockaid co-founder and CEO Ido Ben-Natan said compromised signing systems likely enabled the theft and that EIP-7702 may have amplified losses by allowing assets to be drained in one sweep.

Stablecoin issuers Tether and Circle froze assets connected to the incident. Tether CEO Paolo Ardoino said the company froze more than 1.567B USDT, while Circle CEO Jeremy Allaire said more than 800M USDC had been frozen. Binance later said about $3 billion of affected assets had been frozen with help from blockchain partners. Frozen assets included Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB).

Binance said it had reserved more than $6.34 billion in company funds to cover losses, including $5 billion already held in the same tokens affected by the attack, and was purchasing the remaining assets through market and over-the-counter transactions. Teng said, “We are committed to covering all hacked losses through our company funds. Your assets are safe.” The exchange also said losses would be covered through its SAFU emergency reserve and company funds. By Saturday, Binance said it had replenished 90% of the stolen assets, up from about 80%, while deposits were operating normally and withdrawals remained suspended. The exchange targeted a Sunday restart within approximately 40 hours and planned to publish a full proof-of-reserves report by Monday.

TRM Labs, Chainalysis and Pangolin Intelligence attributed the attack to North Korea’s TraderTraitor group, citing links between funds from the Binance incident and the Bitget exploit. Chainalysis co-founder and CEO Jonathan Levin assessed the theft at about $6.4 billion, while TRM Labs estimated about $6.36 billion. On-chain investigator ZachXBT said the commingled funds indicated the same actor was likely responsible for both incidents. Binance is working with law enforcement, including the FBI and U.S. Secret Service, as well as blockchain intelligence firms and token issuers to recover assets. Chainalysis also observed “never-seen-before laundering patterns” and said thousands of transactions in a short period suggested the attackers were using automation to obscure the trail of funds.