Binance’s $6.3B Vault Takes the Hit—and Crypto’s Biggest Freezer Comes Knocking

Binance said it suffered a security incident affecting approximately $6.3 billion, while the FBI attributed the October 29, 2026 theft to North Korea’s TraderTraitor group, making it the largest cryptocurrency theft on record. Binance initially said the incident may have begun with a compromised DevOps engineer’s laptop but later reported “additional points of breach.” Co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” while Binance maintained that it had found “no evidence of any wallet private key leak.”

Blockchain analytics firms TRM Labs and Chainalysis estimated the theft at approximately $6.36 billion and $6.4 billion, respectively, across 10 blockchains. TRM attributed the attack with “high confidence,” citing onchain and offchain intelligence. Chainalysis said the strongest evidence emerged when funds stolen from Binance commingled with assets from the Bitget exploit, which had also been attributed to North Korean actors. On Ethereum, attackers used EIP-7702 account delegation and 50 pre-signed authorizations to turn a Binance hot wallet into a “sweeper,” while transfers on the other nine blockchains used ordinary signed transactions.

Stablecoin issuers moved quickly to immobilize part of the haul. Tether said it froze more than 1.567B USDT related to the incident, and Circle CEO Jeremy Allaire said the company had frozen more than $800 million in USDC. Binance later said about $3 billion of affected assets had been frozen with help from blockchain partners. The FBI said TraderTraitor was mainly converting the stolen assets into Ether and could use DeFi and instant swap services for further laundering. The bureau advised THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other digital asset service providers to block transactions involving linked addresses.

Binance committed to covering the losses through company funds, its Secure Asset Fund for Users and its futures insurance fund. The exchange reserved more than $6.34 billion, including $5 billion already held in the same tokens taken during the attack, and said it was purchasing the remaining assets through market and over-the-counter channels. Teng said, “We are committed to covering all hacked losses through our company funds. Your assets are safe.” Binance also stated that the compromised wallets belonged to the exchange and that customer funds were not impacted, although a separate CoinDesk examination found that the wallets had previously appeared in Binance’s reserve data.

Withdrawal services began reopening in phases, initially including $BTC, $ETH, $BNB, $XRP and Solana across 15 networks. Binance reported $4.649 billion in withdrawals and $1.01 billion in deposits during the first nine and a half hours, producing a net outflow of about $3.64 billion, or 2.1% of the approximately $171 billion in assets included in its October 28 proof of reserves. The exchange said replenishment reached 90% of affected assets, up from 80%, and later increased to approximately 95%. A reserve verification showed customer holdings in 10 cryptocurrencies, including $BTC, $ETH and $USDT, backed at least 1:1.