Binance hack: What we know about the $6.3 billion breach
Binance estimates that about $6.3 billion in assets were affected. Blockchain investigators suspect North Korea’s TraderTraitor group, but no official attribution has been confirmed.
On October 29, 2026, an attacker moved billions of dollars in cryptocurrency from Binance wallets. The exchange estimates the incident’s total impact at about $6.3 billion. That is a preliminary measure of affected assets, not a final figure for unrecoverable losses: some funds have been frozen, and the investigation remains open.
How did the breach happen?
Binance initially said a compromised DevOps engineer’s laptop may have given the attacker access to a service container, enabling unauthorized withdrawal transactions. The company later said its investigation had uncovered additional points of breach. It has promised a detailed technical account once the findings are verified.
The exchange says it has found no evidence that wallet private keys were leaked. After examining blockchain transactions, Elliptic suggested that the attacker may instead have induced Binance’s own systems to authorize transfers. That remains an analytical assessment, rather than a completed forensic finding.
The scale of the attack reflects the movement of assets from wallets across multiple blockchains. Elliptic valued the stolen cryptocurrency at approximately $6.43 billion at the time of the transfers. Its figure differs from Binance’s estimate because the organizations use different calculations and reference times. Bitcoin, ether and stablecoins were among the affected assets.
Who is suspected?
Blockchain intelligence company TRM Labs attributes the attack to TraderTraitor, a hacking group it associates with North Korea. Elliptic also considers a North Korean link likely. Its analysis identified an overlap between the movement of some stolen funds and an address connected to another suspected exploit.
The attackers have not, however, been officially identified. Assessments by private investigators draw on transaction patterns and other intelligence; they are not a confirmed finding by law enforcement. Binance says it is cooperating with authorities to establish who was responsible. TraderTraitor should therefore be described as a suspect, rather than a proven perpetrator.
What has Binance done?
Binance temporarily suspended deposits and withdrawals while it carried out security checks. It revoked the affected address authorization and brought in law enforcement and blockchain intelligence partners to trace the assets. Working with other blockchain participants, it says it has frozen roughly $3 billion. The amount may change as tracing and verification continue.
The exchange has pledged to cover all user losses through its SAFU protection fund and company funds. It also plans to publish an updated proof of reserves after remediation. A promise to compensate users does not mean every stolen asset has already been recovered: frozen tokens still require further action before their status is resolved.
For customers, the immediate practical step is to follow Binance’s official service updates and check the website address before signing in. Major breaches often trigger fraudulent reimbursement messages that direct users to outside wallets. The final loss, the full route of entry and the identity of those responsible remain questions for the continuing investigation.
