$6.3 Billion in 20 Minutes: Inside the Binance Hack, and Whether Your Crypto Is Safe
The largest theft on record began with one compromised laptop. Investigators link it to North Korea, Binance says customer funds are covered, and bitcoin fell below $77,000. What happened, how it worked and what anyone holding crypto should do now.
简要回答
Binance says customer balances are covered: it has set aside about $6.34 billion of company funds and says it never uses customer money. Hackers took about $6.3 billion late on 29 October, most of it in around 20 minutes, after compromising a laptop and the exchange's transaction-approval system. TRM Labs, Chainalysis and Elliptic link the theft to North Korea. Withdrawals were suspended while Binance rebuilds the system.
It started, as so many disasters in modern finance do, with one laptop.
Late on Thursday, 29 October, someone gained control of a machine inside Binance, the world’s largest cryptocurrency exchange, and used it to reach the system that approves transactions. Malicious software designed to erase its own traces did the rest. Within roughly 20 minutes the attackers had ordered Binance’s internet-connected wallets to empty themselves into wallets they controlled, Reuters reported via The Korea Times. When it was over, about $6.3 billion was gone.
“This incident is almost certainly the single largest known theft of any kind,” the blockchain analytics firm Elliptic said. Not the largest crypto theft. The largest theft.
Is my money on Binance safe?
Binance says yes. Co-CEO Richard Teng said the company will cover all losses from its own funds and has set aside about $6.34 billion. “We NEVER use any customer funds, so they are not impacted,” he wrote. Withdrawals were suspended while the approval system is rebuilt; co-CEO Yi He said they should resume by Sunday, according to Yahoo Finance. Binance said it found no evidence that wallet passwords leaked.
Analysts at Fundstrat said the theft does not appear to threaten Binance’s solvency, which lowers the risk of a panic in which everyone tries to withdraw at once. That is the reassuring part. The less reassuring part is that a company can lose more than six billion dollars in the time it takes to drink a coffee.
How the heist worked
Crypto exchanges keep most customer coins in cold wallets, offline and slow to move, and a smaller working balance in hot wallets, online and ready for withdrawals. Moving money out of a hot wallet requires approvals, a digital version of two signatures on a cheque.
According to Teng and to investigators, the attackers did not crack the cryptography. They went around it. By compromising a laptop and the approval infrastructure, they made the system believe that legitimate transfers had been authorised. TRM Labs said the method resembled the February 2025 attack on the exchange Bybit, when about $1.5 billion was stolen and the FBI blamed North Korea.
| The Binance hack in numbers | |
|---|---|
| Amount stolen | about $6.3 billion |
| Time for most of the theft | about 20 minutes |
| Funds frozen or located | about $3 billion |
| Tether (USDT) frozen | about $1.57 billion |
| Circle (USDC) frozen | more than $800 million |
| Binance reserve to cover losses | about $6.34 billion |
| Bitcoin, Friday low | $76,368 (six-week low) |
| Previous record | Bybit, about $1.5 billion (February 2025) |
Sources: Reuters via The Korea Times; Yahoo Finance; Elliptic.
Why investigators point to North Korea
TRM Labs and Chainalysis said they were highly confident that North Korea was responsible. TRM attributed the theft to the group known as TraderTraitor, the same unit linked to the Bybit attack. Chainalysis data cited by Yahoo Finance put North Korea’s crypto thefts since 2016 at about $6.75 billion through the end of 2025. If the attribution holds, this single attack would almost double that total.
Attribution in crypto is unusual, because the evidence is public. Every transfer sits on a blockchain anyone can read. Investigators follow the coins from wallet to wallet, match patterns to earlier attacks and watch where they try to cash out. That is why so much could be frozen so quickly: stablecoin issuers such as Tether and Circle can block tokens they issued once they know which addresses hold stolen funds. About 44% of the haul was frozen, Elliptic estimated, but the attackers still control more than $3 billion in assets that cannot be frozen directly.
What happened to bitcoin
Markets did what markets do when the biggest exchange in the world locks its doors. Bitcoin fell to a six-week low of $76,368, ether to about $2,178 and Binance’s own token, BNB, by more than 6%. Shares of crypto companies such as Coinbase, Circle and Robinhood dropped. The fall came on the same day as a broad sell-off in technology stocks, which made it hard to separate fear of hackers from fear of everything else.
What you should do if you hold crypto
None of this is investment advice, and Legal Smart is not a financial adviser. But security practice is not a matter of opinion.
- Know where your coins are. On an exchange, you hold a promise from the exchange. In your own wallet, you hold the keys. The old line “not your keys, not your coins” exists for weeks like this.
- Consider a hardware wallet for long-term holdings. It keeps keys offline. Write the recovery phrase on paper, never in a photo or a cloud note.
- Turn on every security option. App-based two-factor authentication, withdrawal address whitelists and anti-phishing codes.
- Expect scams to follow the headlines. After big hacks, fake “refund” emails and support messages multiply. Binance and every serious exchange will never ask for your recovery phrase.
- Spread the risk. Do not keep everything on one platform.
Who protects you, legally
In the European Union, crypto service providers now operate under the MiCA regulation, which sets rules on custody, segregation of client assets and disclosures. Serbia adopted its own Law on Digital Assets, in force since mid-2021, which gives the National Bank of Serbia and the Securities Commission supervisory powers over licensed providers. Neither regime makes a hack impossible. What they do is decide who must keep customer assets separate and who is liable when they disappear. For anyone using a foreign exchange from Serbia, the honest answer is that protection depends on the exchange’s own promises and on the law of the country where it is licensed.
What to watch
Whether Binance withdrawals resume on schedule. How much of the remaining $3 billion investigators can trace or freeze. Any statement from US authorities on attribution. And whether regulators respond, as they did after earlier hacks, with stricter rules on how exchanges approve large transfers.
Frequently asked questions
What happened to Binance?
Hackers stole about $6.3 billion late on 29 October 2026 by compromising a laptop and Binance’s transaction-approval system, emptying hot wallets in about 20 minutes.
Is my crypto on Binance safe?
Binance says customer balances are not affected and that it has set aside about $6.34 billion of company funds to cover the losses. Withdrawals were temporarily suspended.
Who hacked Binance?
TRM Labs, Chainalysis and Elliptic link the theft to North Korean hackers; TRM names the group TraderTraitor, also linked to the 2025 Bybit hack.
Is this the biggest crypto hack ever?
Yes. It is about four times the previous record, the roughly $1.5 billion Bybit theft in February 2025, and Elliptic calls it the largest known theft of any kind.
When will Binance withdrawals resume?
Binance said within about 48 hours of the attack; co-CEO Yi He said by Sunday, 1 November.
How can I protect my crypto?
Keep long-term holdings in a wallet you control, ideally a hardware wallet, enable app-based two-factor authentication and withdrawal whitelists, and never share your recovery phrase.
Sources
- The Korea Times/Reuters, North Korea behind Binance crypto theft (30 October 2026)
- Yahoo Finance, Binance hacked for record $6.3 billion (30 October 2026)
- The Washington Post, How suspected North Korean hackers swiped billions in minutes (31 October 2026)
- NPR, Blockchain intelligence firms link North Korea to $6.3B hack (30 October 2026)
