Hackers drained about $6.3 billion in crypto assets from Binance wallets on Oct. 29, the exchange said. Binance and its partners froze about $3 billion. The exchange suspended withdrawals and pledged to cover all losses using its SAFU fund and company funds.
TRM Labs analysts traced outflows from Binance wallets across 10 blockchains. According to the firm, the attackers stole most of the assets in about 20 minutes, with further outflows continuing for several hours.
The largest outflows occurred on Ethereum, totaling about $3.79 billion. The attackers also took about $1.47 billion in Bitcoin and $628 million in assets on Tron. The attack also affected XRP Ledger, Solana, Arbitrum, and other networks.
Breakdown of crypto assets stolen from Binance. Source: trmlabs.com
Measured by asset values at the time of the theft, it was the largest hack in crypto history. For comparison, Arkham estimated that the LuBian mining pool lost about $3.5 billion in a 2020 attack. Bybit lost about $1.5 billion in February 2025.
After the attack was detected, Binance suspended deposits and withdrawals and began security checks. The company later said outflows stopped when it paused its withdrawal service.
Deposits are operating normally, and withdrawals remain suspended. In its latest update, Binance confirmed that the recovery was on schedule. At the time of the update, the exchange expected to resume withdrawals in 45 hours.
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination… pic.twitter.com/FQQ3vKT6GU— Binance (@binance) October 30, 2026
The exchange pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and its own funds. It did not specify how much each source would cover. Binance and its partners continue to trace the stolen assets, with about $3 billion now frozen.
In February 2026, Binance converted its SAFU reserves from stablecoins into Bitcoin. After the conversion, the fund held 15,000 BTC, worth about $1 billion at the time.
The investigation is ongoing. Binance said it had uncovered additional entry points after initially pointing to a compromised laptop. The company is working with law enforcement to reconstruct the full attack sequence.
The exchange plans to publish a technical post-mortem after completing the investigation and an updated proof-of-reserves report after resolving the incident. The reserves report compares customer balances with the assets Binance holds to back them.
TRM Labs linked the attack to the North Korean hacking group TraderTraitor. The firm said it had high confidence in its assessment, citing blockchain analysis and additional intelligence.
According to the researchers, preparations began at least 36 hours before the theft. The operator’s wallet received small amounts of crypto from the Tornado Cash mixer. The attacker then tested malicious code on addresses under their control. TRM had observed similar funding patterns and signatures obtained in advance in previous attacks linked to North Korea.
On Ethereum, the attacker used EIP-7702, which allows a standard wallet to execute smart contract code. They submitted a transaction containing 50 pre-signed authorizations covering consecutive values of the Binance wallet’s transaction counter, or nonce. One authorization matched the wallet’s current nonce, delegating execution to a contract controlled by the attacker. The attacker used it to drain the balance and repeatedly sweep incoming funds.
On other blockchains, the funds moved through standard transfers with valid signatures from Binance wallets. Those networks use different key types and signing schemes. That led TRM to suspect the attacker had accessed shared infrastructure used to sign transactions on the exchange’s behalf.
TraderTraitor had previously been linked to the Bybit hack. In February 2025, the FBI attributed the theft of about $1.5 billion to the group. The agency said the attackers converted the stolen funds into Bitcoin and other assets and spread them across thousands of addresses.
The Multilateral Sanctions Monitoring Team (MSMT) reported that North Korea turned to cryptocurrency theft as a revenue source as its economy deteriorated and international sanctions tightened.
The U.S. intelligence community estimated that North Korean hackers likely stole about $2 billion in cryptocurrency in 2025. According to the assessment, those proceeds help fund the North Korean government, including the continued development of strategic weapons.
Tether, Circle, Ripple, and World Liberty Financial joined the effort to freeze stolen assets. TRM Labs published the following breakdown of frozen stablecoins as of 00:30 UTC on Oct. 30.
Issuer | Frozen assets |
Tether | About 1.77 billion USDT |
Circle | About 825 million USDC |
Ripple | 40.5 million RLUSD |
World Liberty Financial | 27.8 million USD1 |
Issuers can restrict transfers of their tokens by blacklisting addresses. The attacker managed to move some funds before the freezes. According to Bitquery, Tether blacklisted the main receiving Ethereum address 37 minutes after the large outflow. By then, the attacker had moved 700 million USDT from that address to two other wallets.
Arbitrum’s Security Council reported freezing 8,425 ETH and 74.56 million ARB held on Arbitrum One at an address linked to the attack. The council used its emergency powers to move the assets to a designated address.
To do this, the council temporarily upgraded the Inbox contract, executed transfers using the attacker’s address as the sender, then restored the contract’s original implementation. This allowed the council to freeze native ETH on Arbitrum. It said other users’ funds and applications were unaffected.
Any further movement of the ETH and ARB will require an ArbitrumDAO governance vote. The assets remain frozen under the network’s governance controls; the council’s statement does not confirm their return to Binance.
The attacker swapped stolen stablecoins for ETH to avoid freezes. TRM Labs documented the exchange of about 325 million USDT for 122,300 ETH through UniswapX and other order execution services.
According to the researchers, the average price for these trades was about $2,650 per ETH, versus market quotes of 2,300–2,350. The attacker paid a premium of more than 10% to move the funds into an asset that stablecoin issuers could not freeze.
In an onchain analysis, 0xNaiXi described how other traders used the gap. The author reported some Uniswap trades at 2,560–2,750 per ETH, compared with about 2,250–2,290 quoted by Aave’s Chainlink price oracle. The gap lasted nearly an hour.
ETH price at the time of the hack. Source: tradingview.com
Traders deposited stablecoins as collateral on Aave, borrowed ETH, and sold it on decentralized exchanges at higher prices. After the gap narrowed, they bought ETH back at lower prices and repaid their loans. Aave used the oracle to value collateral and debt; the borrowed ETH came from its lending pool.
According to 0xNaiXi’s calculations, address 0x0cdd…61D8 sold 12,289 ETH at an average price of about $2,580, then bought 12,314 ETH at about $2,297. The author estimated the profit from these trades at about $3.47 million.
The ten most profitable addresses in the sample made about $6.36 million combined, excluding gas fees.
Aave’s team froze new deposits and borrowing across most V3 and V4 markets. The team acted after a wallet linked to the attacker deposited 60 million USDT into Aave V3 on Ethereum and borrowed 19,762 WETH, worth about $44.6 million.
Aave version | Frozen reserves | Number of networks |
V3 | 175 | 16 |
V4 | 117 | 4 |
Risk service provider LlamaRisk said the position remained overcollateralized. Aave imposed the restrictions to prevent the attacker from using other assets to take out new loans. The freeze covered the following reserves.
The team plans to lift the freeze in stages once significant movements of the attacker’s funds stop and Binance provides more information on containing the attack. No specific timeline has been given for restoring normal operations across all markets.
Before the first public reports of the hack, BNB traded at about $739. Between 20:24 and 20:47 UTC on Oct. 29, the token lost 8.17%. Bitcoin fell just 2.47% over the same period.
BNB’s informal ties to Binance may explain its sharper decline. Token holders receive trading fee discounts and access to Launchpool and HODLer Airdrops. Most traders have long viewed BNB as part of Binance. The withdrawal suspension may have raised concerns about the exchange’s operations and demand for its products.
Another factor that might have influenced the price of $BNB is the $PREDICT token sale, though price fluctuations from such events usually don’t exceed a few percent, far short of the full 8% drop. So the major factor is clearly the Binance hack.
BNB recovered some ground after the initial sell-off. At 13:27 UTC on Oct. 30, the token traded at $699.14, down 5.72% over 24 hours.
BNB price before, during, and after the $6.3 billion Binance hack. Source: binance.com
Shorting BNB was one of the most obvious ways to profit from the negative news surrounding Binance. Most of the drop occurred before any official statements. By the time CZ posted at 21:15 UTC, the decline from the 20:24 UTC price had narrowed from 8.17% to 3.23%. Most traders entered after the rebound. Only those watching most closely, or the hackers themselves, could have captured the full move.
As news of the Binance hack spread, WatcherGuru reported more than $600 million in long liquidations in 30 minutes. At the time of the post, Bitcoin had fallen below $78,500, ETH below $2,250, SOL below $96, and XRP below $1.25.
The sell-off continued overnight into Oct. 30. At 02:00 UTC, BNB was down 7.1% over 24 hours at $698.65, according to The Block. Bitcoin traded at about $76,664 at the same time, down 4.5% over 24 hours.
Liquidations over the preceding 24 hours totaled about $1.53 billion, including about $1.29 billion in bets on rising prices.
The hack intensified selling, and liquidations, mostly of long positions, added pressure on BTC and ETH. The market later recovered some ground. Bitcoin rebounded to $78,500 after falling to about $76,460. ETH traded around $2,240 after dropping below $2,200.
In an Oct. 30 update, Binance confirmed that it expected to resume withdrawals in 45 hours. The company also pledged to publish a technical post-mortem and an updated proof-of-reserves report after resolving the incident.
Standard Chartered’s head of digital assets research, Geoffrey Kendrick, said the market could fall further before assets are unfrozen and more details of the hack emerge. In the longer term, he said, the incident could accelerate a shift in trading to decentralized exchanges, including Uniswap.
