Binance’s $6.3B breach gets a $6.34B safety net—because the wallet drain needed one

Binance said it had replenished 90% of the assets affected by its $6.3 billion security incident and begun reopening withdrawals in phases, starting with the $BTC network. The announcement came after attackers moved funds from Binance hot wallets across 10 blockchains, primarily within about 20 minutes on October 29, 2026, turning the exchange’s withdrawal infrastructure into the crypto industry’s largest known theft. Binance estimated the incident’s total impact at around $6.3 billion, while TRM Labs and Chainalysis separately valued the stolen assets at approximately $6.36 billion and $6.4 billion, respectively.

Binance initially identified a potentially compromised DevOps engineer’s laptop as a possible entry point, but later reported “additional points of breach.” Co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” describing “a more complex attack process.” The exchange found “no evidence of any wallet private key leak.” On Ethereum, the attacker used EIP-7702 account delegation and 50 pre-signed authorizations to gain execution authority over a hot wallet without passing Binance’s normal approval controls. Binance also said the attacker employed a self-destruct mechanism to destroy tools and traces, while Chainalysis observed thousands of transactions indicating automated laundering.

About $3 billion of affected assets had been frozen with assistance from blockchain partners. Tether froze more than $1.567 billion in USDT, while Circle froze $823 million in USDC and said it was coordinating with law enforcement. Binance also worked with the FBI, the U.S. Secret Service and other law-enforcement agencies as investigators traced the remaining funds, which continued moving across Bitcoin, Ethereum, Tron, Solana and other networks.

TRM Labs attributed the attack to North Korea’s TraderTraitor group with “high confidence,” citing on-chain and off-chain intelligence. Chainalysis and TRM Labs identified the operational wallet’s funding through Tornado Cash and links to earlier North Korean operations, including the Bybit hack in February 2025 and the KelpDAO exploit. Chainalysis’ strongest evidence came from funds stolen from Binance being commingled with assets linked to the Bitget exploit, while on-chain investigator ZachXBT also identified the connection and said it indicated “the same actor is likely behind both incidents.”

Binance reserved more than $6.34 billion in company funds to cover the losses, including $5 billion already held in the same tokens affected by the attack, and said it would cover all hacked losses through its SAFU emergency fund and corporate resources. “We are committed to covering all hacked losses through our company funds. Your assets are safe,” Teng said. The exchange planned to purchase remaining assets through market and over-the-counter channels, publish an updated proof-of-reserves report by Monday and provide a detailed technical post-mortem after every fact had been verified. Binance resumed withdrawals progressively as it rebuilt and tested its withdrawal infrastructure, with users directed to check its official website and network-status page for availability.