The largest crypto theft ever recorded
Binance, the largest cryptocurrency exchange in the world by trading volume, has suffered a theft of about 6.3 billion dollars in what security researchers describe as the biggest crypto heist in history. The exchange confirmed late on Thursday 29 October 2026 that attackers had drained funds from its wallets, and it immediately suspended deposits and withdrawals while its teams ran security checks, froze funds and worked with law enforcement.
The scale of the loss stunned even an industry used to large hacks. Blockchain intelligence firm TRM Labs estimated that about 6.36 billion dollars left Binance wallets across ten blockchains, with most of the money moved in about 20 minutes starting at 20:05 UTC on Thursday evening. Binance itself put the total impact at around 6.3 billion dollars. Before the hack, Binance held roughly 144 billion dollars in assets according to data provider DefiLlama, so the stolen sum equals about 4 per cent of that total. It is roughly four times the 1.5 billion dollars taken from the Bybit exchange in February 2025, which had been the previous record.
For readers following other major business stories, the hack lands at a moment when crypto markets were already nervous, and it has renewed hard questions about how safely even the biggest exchanges guard customer assets. Our homepage carries the latest coverage across markets and technology, and our earlier reporting on Microsoft profits days after layoffs shows how quickly sentiment can turn for large technology companies.
How the attack unfolded
Binance said its initial investigation suggested the incident involved a laptop belonging to a DevOps engineer that had been compromised. According to the exchange, that access allowed the attacker to reach a service container and submit unauthorised withdrawal transactions. Binance added that it had found no evidence that wallet private keys had leaked, and it promised a detailed technical report once the facts have been verified.
TRM Labs reconstructed a longer preparation phase. The firm said planning began at least 36 hours before the theft, with the attacker's operator wallet receiving three small withdrawals from the Tornado Cash privacy tool on the morning of 28 October. The attacker then tested code on two wallets and rehearsed the final version on a third before executing previously signed transactions in a single burst. Security firm Blockaid added a further technical detail, saying the attacker bundled 50 authorisations under a newer Ethereum standard into one transaction.
Binance later said investigators had uncovered additional points of breach, describing the incident as a complex attack, which suggests the compromised laptop is unlikely to be the whole story. That caution matters: early explanations in major hacks are often revised as investigators dig deeper, and Binance itself has said it will only publish firm conclusions once they are verified. Reporting on the breach includes CoinDesk on the exploit and TechSpot on the record theft.
The race to freeze the stolen funds
Within hours of the theft, stablecoin issuers and other blockchain partners began freezing assets they could control. Tether froze more than 1.5 billion dollars in USDT, Circle froze more than 800 million dollars in USDC, and TRM Labs reported that Tether, Circle, Ripple and World Liberty Financial had collectively frozen about 2.67 billion dollars in stablecoins by 00:30 UTC on 30 October. Binance later put the verified frozen total at around 3 billion dollars across several different assets, including more than 2.3 billion dollars in USDT and USDC combined, and said the figure could still rise.
But a large share of the haul sits beyond that kind of freeze. TRM Labs said the attacker still controlled about 2.4 billion dollars in crypto that token issuers cannot freeze, including substantial holdings of Bitcoin and Ether. Other analysts put the unfrozen share even higher, at more than 3 billion dollars. That split explains why the recovery effort now has two tracks: freezing what can be frozen quickly, and tracing the rest through exchanges, investigators and law enforcement in the hope of intercepting it later.
The Wall Street Journal reported on the suspension of transactions, while The National covered the market reaction. For context on how exchanges have handled past crises, see our Barclays job cuts coverage and Flutter job cuts coverage, both of which show how cost and confidence pressures play out at large financial firms.
A gold coloured physical Bitcoin coin
A gold coloured physical Bitcoin coin. Credit: Wikimedia Commons, Bits86, CC0.
Who investigators blame, and what is not yet proven
TRM Labs attributed the attack with high confidence to TraderTraitor, the name US authorities give to a cluster of North Korean state sponsored cyber activity aimed at the crypto industry. The label began as a US government codename in an April 2022 joint advisory by the FBI, the Cybersecurity and Infrastructure Security Agency and the Treasury Department. Japanese regulators have described the group as part of the broader Lazarus Group, and CoinDesk also characterises it as a subunit of Lazarus.
The evidence cited by investigators includes features that match earlier North Korea linked heists, including Bybit and the KelpDAO hack of April 2026: small Tornado Cash withdrawals funding an operator wallet, preparation that began well before the theft, and signatures obtained in advance and then executed in one burst. Chainalysis chief executive Jonathan Levin said his firm assessed that TraderTraitor likely carried out the attack, citing links to a previous hack, and a Chainalysis spokesperson separately told CNN the firm has high confidence that North Korea was responsible. Elliptic also said the attack was consistent with TraderTraitor methods.
Two limits on that attribution matter. First, Binance itself has not publicly named a culprit. Second, no government has formally attributed this attack yet. Private investigators can be highly confident and still be wrong, and official attribution in the Bybit case only came days after the theft. A detailed explainer on the suspects is available from Firstpost on TraderTraitor, and The Hindu BusinessLine reported the TRM attribution.
Markets fall as Bitcoin drops below 77,000 dollars
Crypto prices fell sharply on the news. Bitcoin dropped 4.8 per cent to below 77,000 dollars, falling as low as about 76,300 dollars on Friday, its first move below that level in more than a month. Ether fell 5.7 per cent, Binance's own BNB token fell about 8 per cent, and some smaller tokens fell further. About 1.5 billion dollars in leveraged positions were wiped out as prices slid, according to market reporting.
The selloff partly eased later on Friday morning, with Bitcoin recovering to around 77,984 dollars by mid morning UAE time, still down 2.2 per cent over 24 hours. But the episode has dented confidence in an industry that has spent years trying to shed its reputation for hacks, scams and exchange failures. Analysts noted that even the world's largest exchange, with vast resources, could be hit at this scale, and that the incident will likely sharpen regulatory scrutiny of how exchanges store assets and prove their reserves.
Binance has moved to reassure customers on both fronts. Co-chief executive Yi He said the exchange will cover all hacking losses through its Secure Asset Fund for Users and company funds, and founder Changpeng Zhao said user funds are safe. On Friday the exchange said it had reserved 6.34 billion dollars of company funds in the wake of the incident. Deposits were operating normally again by Friday, although withdrawals remained suspended, with Yi He expecting them to reopen within 48 hours. The exchange also plans to publish an updated proof of reserves. Business Times reported the Bitcoin slide and MoneyCheck explained what the hack means for users.
What happens next
The immediate questions are practical: when withdrawals fully reopen, how much more of the stolen funds can be frozen, and whether the attacker tries to launder the unfrozen share through mixers or smaller exchanges. The longer questions are structural. North Korea linked groups stole about 2.6 billion dollars in crypto between January 2024 and September 2025 according to a multilateral sanctions monitoring group, and the Binance hack alone pushes that figure past 5 billion dollars. If the attribution holds, the theft would be the largest single funding haul yet for a regime under heavy sanctions, with proceeds that researchers say help underwrite its weapons programmes.
For the crypto industry, the test is whether Binance can turn a record loss into a demonstration of resilience: full customer reimbursement, a credible technical report, and proof of reserves that survives independent scrutiny. For regulators, the test is whether existing rules for exchanges are enough when a single compromised laptop, or a small set of breached systems, can move billions in minutes. The answers will emerge over weeks, not days, and they will shape how much trust users and institutions place in centralised exchanges after the biggest theft the industry has ever seen.
Read more in our Business section and our Technology section, including Microsoft profits days after layoffs, data centres and local benefits, and Ofcom age checks for under 16 social media. The BBC's report is here: Binance hack. You can also visit our About page.
