Not financial advice. This guide explains how cryptocurrencies work. It is for information only and is not a recommendation to buy or sell any asset.
Short answer: a cryptocurrency is digital money recorded on a shared, public ledger called a blockchain. Thousands of independent computers keep copies of that ledger and agree on which transactions are valid, so no single bank or company has to run it. Ownership is controlled by cryptographic keys: whoever holds the private key for an address can move the coins at that address.
What is a blockchain?
A blockchain is a list of transactions grouped into blocks. Each block contains a reference (a cryptographic hash) to the block before it, so the blocks form a chain. Changing an old transaction would change its block’s hash and break every link after it, which is why recorded history is very hard to rewrite. Copies of the chain are kept by many independent computers called nodes.
How does a crypto transaction work?
You sign it. Your wallet uses your private key to create a digital signature that proves you control the coins being sent.
It is broadcast. The signed transaction is sent to the network, where nodes check that the signature is valid and that the coins have not already been spent.
It is added to a block. Valid transactions are collected into a new block by a miner or validator.
It is confirmed. Once the block is accepted by the network, the transaction is recorded. Each additional block built on top makes it harder to reverse.
Who decides which transactions are valid?
Blockchains use a consensus mechanism so that independent computers agree on one version of the ledger:
Proof of work (used by Bitcoin): miners compete to solve a computational puzzle. The winner adds the next block and earns newly created coins plus fees. Attacking the network would require controlling a very large share of that computing power.
Proof of stake (used by Ethereum since 2022): validators lock up, or “stake”, the network’s coins. They are chosen to propose and confirm blocks and can lose part of their stake if they break the rules.
Wallets, public keys and private keys
A crypto wallet does not store coins; the coins live on the blockchain. The wallet stores your keys. Your public address is like an account number you can share. Your private key, often backed up as a 12- or 24-word recovery phrase, is what authorises spending. Anyone who obtains it can take your funds, and if you lose it and have no backup, the funds are usually unrecoverable. Read our guide to crypto wallet security.
Coins, tokens and smart contracts
Coins are native to their own blockchain, such as bitcoin (BTC) on Bitcoin or ether (ETH) on Ethereum.
Tokens are created on top of an existing blockchain by software, for example stablecoins or governance tokens.
Smart contracts are programs stored on a blockchain that run automatically when their conditions are met. They power decentralised finance (DeFi), NFTs and many other applications.
What gives a cryptocurrency value?
Crypto prices are set by supply and demand on exchanges. Factors that can matter include the asset’s supply rules, how widely it is used, network security, liquidity, regulation and overall market sentiment. Prices can change very quickly, in both directions.
Key risks to understand
Volatility: prices can fall sharply in a short time.
Loss of keys and scams: there is usually no bank to reverse a mistaken or fraudulent transfer.
Platform risk: exchanges and lending platforms can fail or be hacked.
Regulation: rules differ by country and change over time. See our crypto regulation news.
Frequently asked questions
Is crypto the same as blockchain?
No. A blockchain is the ledger technology; a cryptocurrency is one use of it. Blockchains can also record other kinds of data.
Who controls a cryptocurrency?
On open networks such as Bitcoin, no single party does. The software rules are enforced by the nodes that run it, and changes need broad agreement among users, developers, miners or validators.
Can a crypto transaction be reversed?
Generally no. Once a transaction is confirmed it is final, which is why checking the address before sending matters.
Hardware wallet maker Trezor has raised the Trezor passphrase limit for optional wallet passphrases to 128 characters, up from a previous ceiling of 50, announcing the change on November 1. The expanded limit is available through updated Trezor Suite software paired with compatible device firmware.
The update gives users a longer secret to combine with a wallet backup, adding another option for securing cryptocurrency holdings after a series of wallet security incidents this year. Trezor linked the expansion to user requests and to lessons drawn from July's seed-generation incident involving rival device maker Coldcard, according to TOKENPOST.
Which devices support the Trezor passphrase limit increase
Owners of the Model T, Safe 3, Safe 5 and Safe 7 can use passphrases of up to 128 characters once they update their device firmware, according to TOKENPOST. The change appears in Trezor Suite desktop releases 26.10.2 and 26.10.3, which rolled out in October.
The Model One remains capped at 50 characters, and the same restriction applies to any device still running older firmware, TOKENPOST reported. Cointelegraph also noted that outdated firmware keeps the 50-character limit in place, while Trezor said Sunday the longer passphrases are available in Trezor Suite with updated firmware.
Trezor's guidance specifies that passphrases use standard ASCII characters, with uppercase and lowercase letters treated as distinct and spaces counting toward the total. Length by itself does not guarantee strength, since unpredictability also matters, according to the company's documentation as reported by TOKENPOST.
How a passphrase protects a wallet
A passphrase is an optional secret entered alongside a wallet's recovery backup, and the combination derives a separate wallet. According to Trezor, it functions like an additional password layered on top of the recovery phrase, so an attacker who obtains the recovery phrase would still need the exact passphrase to reach the funds in that wallet.
Each distinct passphrase produces an entirely different wallet, which means a small typing error opens a different wallet rather than the one holding the user's funds. Trezor cannot recover lost or forgotten passphrases, so a user who loses the exact string may be permanently locked out of the cryptocurrency, Bitcoinist reported.
Trezor cautions that passphrases remain an advanced security feature even with the added flexibility of the higher character limit. Extended secrets can deliver real defensive value, though holders need to keep them in a safe place and reproduce them character for character, according to Bitcoinist.
Coldcard incident behind the longer Trezor passphrase limit
Trezor tied the change to July's Coldcard attacks, in which a firmware flaw led some devices to produce recovery phrases without enough randomness, letting attackers rebuild them. Coldcard maker Coinkite disclosed that the bug weakened seed generation on certain devices, and attackers reconstructed private keys offline and stole funds from affected wallets without remotely accessing or taking over the devices, the company said.
Coinkite's advisory lists Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9 among the affected cases, plus recovery seeds generated on Mk4, Mk5 and Q units prior to designated fixes. Seeds generated on the latter models before the fixes carried about 72 bits of entropy, compared with the 128 bits expected, according to TOKENPOST.
Estimated losses tied to the Coldcard vulnerability topped $100 million, sharpening examination of wallet makers and how they handle security, according to Bitcoinist. Trezor said strong, unique passphrases protected some users during the initial attacks, keeping funds safe even where recovery information was compromised.
Trezor has stressed that wallets first created on its own hardware were untouched by the Coldcard firmware flaw. By contrast, anyone who generated a recovery phrase on a vulnerable Coldcard unit and later restored it on Trezor hardware stays exposed until funds move to a wallet built on a new seed, because restoring a compromised phrase elsewhere does not remove the underlying weakness.
While a passphrase raises an extra hurdle for attackers, it cannot fix a seed that is already compromised, according to TOKENPOST. The remedy for anyone holding a vulnerable seed is to transfer funds to a wallet generated from a fresh seed.
Separate warning over reseller devices
The passphrase update follows a separate warning involving Trezor's own hardware. The company told customers on Friday that anyone who purchased a wallet from CryptoBilis, a former authorized reseller, at any point since March should shift their funds into new wallets, Cointelegraph reported.
A customer in Indonesia flagged what appeared to be an implant concealed in a Trezor Safe 5, one capable of reading on-screen data such as recovery phrases and sending it out via a cellular connection. The company said Friday that it had yet to inspect the unit and that no losses connected to the case had been reported to it, according to Cointelegraph.
Conclusion
Trezor's Trezor passphrase limit now stands at 128 characters for users of the Model T, Safe 3, Safe 5 and Safe 7 who update their device firmware, while the Model One and older firmware remain at 50 characters. The company announced the change on November 1 and tied it to lessons from July's Coldcard seed-generation incident, in which strong passphrases shielded some users whose recovery information was compromised.
The next concrete step for affected users is clear from the facts: anyone who created a recovery phrase on a vulnerable Coldcard device must move funds to a wallet built from a newly generated seed, since a passphrase alone does not fix a weakened seed. Trezor has also directed customers who bought from former reseller CryptoBilis since March to transfer their funds to new wallets.
Frequently Asked Questions
What is the new Trezor passphrase limit and which models support it?
Trezor raised its maximum optional passphrase length from 50 to 128 characters, announced on November 1. Users of the Model T, Safe 3, Safe 5 and Safe 7 can use the longer passphrases after updating device firmware. The Model One and devices on older firmware stay limited to 50 characters.
Why did Trezor raise the passphrase limit to 128 characters?
Trezor connected the expansion to user requests and lessons from July's Coldcard seed-generation incident, in which a firmware bug let attackers reconstruct recovery phrases and steal funds. Trezor said strong, unique passphrases protected some users during the initial attacks, keeping funds safe despite compromised recovery information.
Does a longer passphrase fix a seed affected by the Coldcard flaw?
No. A passphrase adds a barrier to access but does not repair an affected seed. Users who created recovery phrases on vulnerable Coldcard devices remain exposed even after restoring them on Trezor hardware. The fix is to shift funds into a wallet built on a newly generated seed.
What happens if a Trezor passphrase is typed incorrectly?
Every different passphrase generates a separate wallet, so even a minor typing error opens an entirely different wallet rather than the one containing the funds. Trezor cannot recover lost or forgotten passphrases, which means users who lose the exact string may be permanently unable to access their cryptocurrency.
What did Trezor warn about wallets bought from reseller CryptoBilis?
On Friday, Trezor advised customers who bought wallets from former authorized reseller CryptoBilis since March to move funds to new wallets. A customer in Indonesia reported what looked like an implant hidden in a Trezor Safe 5, one able to read on-screen data such as recovery phrases and send it out over a cellular connection. Trezor said it had not examined the device and had no reports of related losses.
Taurus has added live support for Stellar smart-contract assets to its institutional custody and tokenization platforms, the company announced on October 29. The Geneva-based firm said the capability is available through Taurus-PROTECT and Taurus-CAPITAL, extending its existing integration with the network.
The move allows banks and financial institutions to custody, issue, and manage smart contract-based assets through Taurus user interfaces and APIs, matching capabilities already available for Ethereum-based assets. The release broadens the range of token structures institutions can support on Stellar, from standardized models to custom contracts built around specific regulatory or operational needs.
Stellar smart-contract assets gain institutional tooling
Taurus-PROTECT now lets clients custody and manage smart contract-based tokens on Stellar, with wallet support and governance and operational controls that span the Taurus platform. Taurus-CAPITAL allows clients to issue and manage these assets throughout their lifecycle.
The platform handles token issuance, smart contract function calls, and parameter handling across several Stellar token models and standards. These include SEP-41 contract tokens, Stellar Asset Contracts, OpenZeppelin contracts, and ERC-3643-based assets designed for regulated use cases, also known as SEP-57.
Taurus-CAPITAL also accommodates issuer-specific ERC-3643-derived contracts and other custom real-world asset structures. The company said this gives institutions flexibility in how they structure tokenized securities, funds, and other financial instruments on the network.
Custody controls extend to contract interactions
For regulated firms, custody involves more than protecting private keys. It requires governing what those keys can authorize, who may request an action, and which approvals must be in place before a transaction proceeds, according to NewsBTC and The Currency Analytics.
Taurus noted that a simple token transfer and a smart-contract interaction do not carry the same consequences. An instruction may change an allowance, invoke a contract function, or alter how an asset can be handled, and personnel approving such instructions need enough information to understand those consequences before a signature is produced, the outlets reported.
Taurus aims to keep approval workflows, audits and governance controls intact by building smart-contract support into the custody and issuance platforms institutions already use. The approach avoids the risk that an experimental or external interface could carry out contract interactions outside a firm's usual controls, according to KuCoin.
Token standards align with regulated structures
Taurus said the update covers several Stellar token models, including structures intended for regulated assets. This allows issuers to align technical design with the economic and legal features they intend to offer, according to KuCoin, NewsBTC and The Currency Analytics.
Creating a tokenized instrument requires decisions about the rights it represents and the actions permitted after issuance, such as transfers, subscriptions, or redemptions. Depending on the instrument, those may include changes governed by the issuer's rules, NewsBTC and The Currency Analytics reported.
Reusing an established custody and issuance interface may reduce the number of new systems finance, operations, compliance and security teams must learn. It can also make oversight more consistent across networks, provided the interface still exposes network-specific requirements, contract permissions and servicing obligations where they affect decisions, according to the outlets.
Executives cite infrastructure continuity
"Financial institutions want to choose the blockchain and asset structure that best fits their use case without changing the infrastructure and controls around it," said Lamine Brahimi, Co-Founder and Managing Partner at Taurus.
"Institutions want to use the custody and issuance tools they already rely on when they move to a new network," said Raja Chakravorti, Chief Business Officer at the Stellar Development Foundation. "Taurus adding Stellar smart contract support gives its clients more ways to issue and manage securities, funds, and real-world assets on the Stellar network, including through standards like SEP-57."
Adoption test lies in full asset lifecycle
The release establishes that clients have more infrastructure options on Stellar. For Taurus clients, it is the ability to consider another network without rebuilding every surrounding control, according to NewsBTC.
Taurus indicated that the next evidence of adoption will be institutions using these capabilities for named instruments with clearly explained ownership and transfer arrangements. The more revealing test is whether an issuer can take an asset from creation through ongoing management and eventual redemption using a coherent set of records, NewsBTC and The Currency Analytics reported.
The Stellar network has been servicing payments and financial use cases since 2014. Franklin Templeton runs a tokenized money market fund on Stellar, and MoneyGram moves money across it daily.
In 2024, Taurus made Taurus-PROTECT and Taurus-CAPITAL available on the Stellar network, bringing institutional custody and asset issuance capabilities to the network. In 2025, Taurus, the Stellar Development Foundation, and Turbo Energy announced an initiative to tokenize financing for renewable energy projects on Stellar using Taurus-CAPITAL.
Conclusion
Taurus's support for Stellar smart-contract assets is now live through Taurus-PROTECT and Taurus-CAPITAL, giving institutional clients broader options for issuing and managing tokenized assets on the network. The company has said the next evidence of adoption will be institutions using these capabilities for named instruments with clearly explained ownership and transfer arrangements.
Frequently Asked Questions
What did Taurus announce on October 29, 2026?
Taurus announced live support for smart contract-based assets on the Stellar network through Taurus-PROTECT, its institutional custody platform, and Taurus-CAPITAL, its tokenization platform. Banks and financial institutions can now custody, issue, and manage these assets through Taurus user interfaces and APIs.
Which Stellar token standards does Taurus-CAPITAL support?
Taurus-CAPITAL supports SEP-41 contract tokens, Stellar Asset Contracts, OpenZeppelin contracts, and ERC-3643-based assets designed for regulated use cases, also known as SEP-57. It can also support issuer-specific ERC-3643-derived contracts and other custom real-world asset structures.
How does Taurus-PROTECT handle Stellar smart-contract assets?
Taurus-PROTECT lets clients custody and manage smart contract-based tokens on the Stellar network, including wallet support and the governance and operational controls available across the Taurus platform. This extends the same controls used for other assets to contract interactions.
What did Lamine Brahimi say about the Stellar integration?
Lamine Brahimi, Co-Founder and Managing Partner at Taurus, said financial institutions want to choose the blockchain and asset structure that best fits their use case without changing the infrastructure and controls around it.
When did Taurus first launch on the Stellar network?
In 2024, Taurus made Taurus-PROTECT and Taurus-CAPITAL available on the Stellar network, bringing institutional custody and asset issuance capabilities to the network. In 2025, Taurus, the Stellar Development Foundation, and Turbo Energy announced an initiative to tokenize financing for renewable energy projects on Stellar using Taurus-CAPITAL.
The Binance hack, a $6.3 billion theft from the world's largest cryptocurrency exchange, unfolded late last week when attackers drained internet-connected hot wallets in roughly 20 minutes. The FBI has accused North Korea's state-backed TraderTraitor unit, and Binance said it had restored about 95% of user assets within four days of the breach.
The incident matters beyond Binance because crypto users in countries such as the US, UK and Australia have no formal deposit protection, leaving them dependent on an exchange's own resources when a platform is breached. The Binance hack has also pushed financial advisors to re-examine where crypto risk sits in client portfolios, according to InvestmentNews.
How the Binance hack unfolded
Binance estimated that about $6.36 billion in digital assets moved out of its wallets across 10 blockchains, most of it within roughly 20 minutes. More than $2.5 billion of the total was taken in a single transaction, The Guardian reported.
The exchange said the intrusion began with a compromised laptop belonging to a DevOps engineer, which let the attacker reach a service container and submit unauthorized withdrawal transactions. Binance later said its investigation uncovered additional points of breach, and co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action, according to Spiceworks.
Binance has not confirmed the initial attack method, though early reports may indicate social engineering was involved, according to Nandakumara, who cautioned that "nobody stops every social engineering lure, and the post-mortem isn't out yet." The company said there was no evidence customer wallet private keys leaked and that it expects to publish a detailed post-mortem once investigations conclude.
The theft of at least $6.3 billion shows that however sophisticated the fortifications, high-tech criminals are still finding a way in, Bloomberg reported. Aneirin Flynn, chief executive of cybersecurity firm FailSafe, called it "the largest cyber theft on record, not just the largest in crypto," according to Yahoo Finance.
North Korea blamed for the theft
The FBI formally accused the Democratic People's Republic of Korea of carrying out the Binance hack. "North Korea was responsible for the theft of more than $US6 billion in virtual assets from cryptocurrency exchange Binance," the bureau said in a statement, naming TraderTraitor, a state-backed threat actor also allegedly behind last year's $1.5 billion Bybit hack, which had previously been the largest crypto theft recorded.
The FBI said it observed the actor converting stolen Binance assets primarily into Ethereum and called on private sector entities to block transactions tied to known TraderTraitor addresses. NPR reported that researchers and law enforcement traced transactions on public blockchain ledgers to accounts they said were linked to North Korea, and that crypto firms were able to freeze more than 40% of the stolen assets.
Binance taps emergency fund to cover losses
Binance's response leaned on the Secure Asset Fund for Users, an emergency reserve it established in 2018 and financed through trading fees collected from users, designed for exactly this kind of security breach. Because the $6.3 billion in stolen assets exceeded the fund's resources, the exchange dipped into its own money to restore about 95% of user assets within four days, The Hindu reported.
The company said it had set aside more than $6.3 billion in company funds, held about $5 billion in impacted assets such as Bitcoin and Ether, and was repurchasing the remaining 5% of assets until the stolen amount is fully covered, according to Information Age. It also worked with industry partners to freeze about $3 billion of affected assets. "Bottom line – your money is safe, and we're covering every loss," co-chief executive Richard Teng said Friday.
Alongside a proof of its reserves, the company tweeted: "Our commitment is unchanged: Binance will absorb the financial impact of the stolen funds, not our users." Yi He, co-founder of Binance and longtime partner of former CEO Changpeng Zhao, said the top priority was to "ensure the environment is secure, after which users can withdraw their funds and Binance can resume operations," The Guardian reported.
Binance initially froze withdrawals, then began restoring access at approximately 5pm Sunday and started a phased resumption of withdrawals on Nov. 1. The company announced Sunday afternoon that it had processed $4.6 billion in withdrawals and $1 billion in deposits, a net outflow of about $3.6 billion, or 2.1% of its $171 billion in total assets under management.
Scams and market fallout
As Binance contained the technical damage, it faced fallout from angry and frightened users, The Guardian reported. Former CEO Changpeng Zhao warned that crypto scammers are now in "overdrive," circulating screenshots of fake recompense schemes promising $150 in free compensation for withdrawal suspensions; Binance confirmed the screenshots are digitally altered and the information false.
The Binance hack also shook traditional markets, with investors pulling funds from US Bitcoin exchange-traded funds, and shares of Coinbase, Circle and Strategy fell sharply on Oct. 30, a day after the exchange disclosed the theft. Sid Yenamandra, founder and CEO of SurgeONE.ai, noted Coinbase fell more than 13%, Circle more than 9% and Strategy about 8%, though Coinbase and Strategy had reported third-quarter earnings on Oct. 29, so some of the decline reflected company-specific results.
The name Binance was already associated with crime before the hack: Zhao pleaded guilty to violating US anti-money laundering laws in 2023 and stepped down as CEO. The Guardian described the company as facing an uphill battle to save its brand, though it's no FTX.
What the Binance hack means for policy and portfolios
The Hindu argued the Binance hack holds lessons for India, and that being a crypto exchange did not make Binance more vulnerable than a bank would have been. The lesson, the paper said, lies in how Binance prepared for and reacted to the attack, and the Indian government could mandate an industry-maintained emergency fund modeled on the exchange's reserve.
For US financial advisors, the episode is forcing a harder look at where crypto risk hides in client portfolios. "For advisors, the question is how much risk the exposure adds to the overall portfolio and whether clients are being adequately compensated for taking that risk," said Scott Dooley, chief investment officer at Sowell Management.
Dooley added a note of caution about the exchange's assurances: Binance says customer funds are safe and it will cover losses, but those are company statements, not outcomes. Unlike traditional Wall Street exchanges, platforms such as Binance serve as both trading venues and custodians of investor funds, Yahoo Finance reported.
Conclusion
The Binance hack is established as the largest cryptocurrency theft on record, with the FBI attributing the $6.3 billion breach to North Korea's TraderTraitor unit and the exchange covering about 95% of losses through its emergency fund and company resources. Binance began a phased resumption of withdrawals on Nov. 1 after processing billions in outflows. The next concrete step is the detailed post-mortem report Binance has said it will release once investigations are complete, alongside continued efforts with law enforcement and industry partners to trace, freeze and recover the remaining assets.
Frequently Asked Questions
How much was stolen in the Binance hack?
Binance estimated about $6.36 billion in digital assets was moved from its wallets across 10 blockchains, most within roughly 20 minutes. More than $2.5 billion was taken in a single transaction, making it the largest cryptocurrency theft on record, surpassing the $1.5 billion Bybit hack.
Who did the FBI blame for the $6.3 billion Binance theft?
The FBI formally accused North Korea, naming TraderTraitor, a state-backed threat actor also allegedly behind last year's $1.5 billion Bybit hack. The bureau said it observed the group converting stolen Binance assets primarily into Ethereum and urged private firms to block transactions linked to known TraderTraitor addresses.
Will Binance users get their money back after the hack?
Binance said it restored about 95% of user assets within four days, using its Secure Asset Fund for Users and company funds after the theft exceeded the fund's resources. The company said it is repurchasing the remaining 5% until the stolen amount is fully covered, and co-CEO Richard Teng pledged to cover every loss.
How did hackers break into Binance?
Binance said the attack began with a compromised laptop belonging to a DevOps engineer, which let the intruder access a service container and submit unauthorized withdrawal transactions. The exchange later said it found additional points of breach, and co-CEO Richard Teng said it was not a single one-click action. A detailed post-mortem is expected.
When did Binance resume withdrawals after the hack?
Binance initially froze withdrawals, began restoring access at approximately 5pm Sunday, and started a phased resumption on Nov. 1. It processed $4.6 billion in withdrawals and $1 billion in deposits, a net outflow of about $3.6 billion, or 2.1% of its $171 billion in assets under management.
The Binance hack on October 29 drained roughly $6.3 billion from the world's largest cryptocurrency exchange, making it the biggest crypto theft on record. Attackers moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in roughly 20 minutes, according to Spiceworks.
The Binance hack matters because it forces the industry to answer a question it has long avoided: what happens to customers when something goes wrong. The exchange has pledged to absorb the loss itself rather than pass it to users, a response that PYMNTS described as the real test for institutional investors watching how the sector handles its worst days.
How the Binance hack unfolded
Binance described the operation as a sophisticated, multi-stage campaign that began in June 2026 and ran for several months, according to Shattered. The company's account, relayed by outlets including The New York Times, ABC News and The Verge, forms the backbone of the public record.
In September 2026, a person posing as a project director contacted a Binance software engineer through a job-hunting platform and instructed the engineer to download an interview assignment, Binance said. That assignment was what the company called a malicious code repository, and the approach came through a recruiting site rather than a phishing email, according to NPR's account of Binance's statement.
Binance said the code used "sophisticated obfuscation and evasion techniques" and swapped a legitimate development-tool component for a malicious version. The company's security tools did not detect the file, a detail The New York Times highlighted in quoting Binance's own description.
The attackers did not stop at one target. A second software engineer was approached for a fictitious job and took part in multiple interview interactions, including a virtual meeting with someone claiming to be the CEO of a fictitious company, Binance said.
Once inside, the attackers used Binance's internal artificial intelligence tool to gain control over wallet systems, the company said. The reporting does not identify which product that was, how it connected to wallet systems or what permissions it held, and Shattered treated any specific claim about its design as unconfirmed.
Competing explanations for the breach
Binance initially pointed to a compromised engineer's laptop as the source of the hack, then clarified that multiple factors contributed to the breach, BusinessDesk reported. The company's first statement said the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and added that it found no evidence of a wallet private-key leak, according to Spiceworks.
Binance later said its investigation had uncovered additional points of breach. Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action.
The emerging evidence points to hijacked transaction authorisation systems rather than any failure of bitcoin's underlying cryptography, BusinessDesk reported. Zelazny, quoted by Spiceworks, noted that "authentication does not equate to authorization."
The FBI attributed the attack to TraderTraitor, described as a North Korea-affiliated hacking unit, according to Shattered. Binance has given dates for only some stages of the campaign, leaving parts of the timeline undated.
Binance absorbs the loss
By Sunday, November 1, Binance said it had covered about 95% of the stolen assets by buying replacement tokens with company money. The remaining balance involved less liquid cryptocurrencies that were harder to acquire quickly, BusinessDesk reported.
The exchange drew on its corporate treasury, its customer protection reserve and part of its futures insurance fund. Binance had committed more than $6.34 billion to cover the shortfall, Crypto Reporter reported, and CoinDesk reported that Binance already held about $5 billion in the affected tokens while acquiring the rest through public markets and over-the-counter transactions.
Binance's SAFU protection fund was worth about $1 billion, and the company said it would use half of it and replenish it, BusinessDesk reported. The theft was more than six times the fund's size, so the wider balance sheet had to pick up the slack.
Binance has maintained that customer balances would not be affected and pledged to bear the financial cost of the incident. BusinessDesk argued that commitment is precisely what customers should expect, while also noting that compensating users after a security failure is different from showing assets were properly protected in the first place.
Withdrawals resume and outflows spike
Binance began reopening withdrawals for selected cryptocurrencies on Sunday after temporarily suspending them for security checks, Crypto Reporter reported. Customers initially rushed to move funds out, and the exchange recorded more than $3.5 billion in net outflows on Sunday, according to DefiLlama data cited by Reuters.
BusinessDesk put the figure at roughly $3.64 billion in net outflows, about 2.1% of Binance's assets, after withdrawals resumed. PYMNTS reported that customers had withdrawn north of $4.7 billion by November 2. Binance said withdrawal activity spiked at the beginning but was declining toward normal levels.
Most Binance users, across about 335 million accounts worldwide, apparently store their tokens offline in cold wallets, leaving smaller holdings on the exchange for liquidity, BusinessDesk reported. For Kiwi users, who may number in the hundreds of thousands, the immediate reassurance is the company's promise to absorb the loss.
Stablecoin freezes and the recovery effort
Tether and Circle, the two leading stablecoin issuers, collectively froze about $3 billion in tokens stolen from Binance, PYMNTS reported Friday. Issuer-controlled stablecoins retain an avenue for intervention after funds leave an exchange, and the frozen funds are separate from Binance's own reserves and may not all be recoverable, Crypto Reporter noted.
The Genius Act established a federal framework for payment stablecoins, which were involved in the hack but are recoverable because providers such as Tether and Circle could freeze about $3 billion worth of stolen tokens, BusinessDesk reported. Jardine, quoted by PYMNTS, observed that "a court order alone cannot make the bitcoin network transfer coins."
The Binance hack dwarfs the roughly $1.5 billion stolen from Bybit in February 2025, the previous benchmark, PYMNTS reported. Binance puts the theft at approximately $6.3 billion, while other reports cited $6.34 billion or $6.6 billion, according to Shattered.
What the Binance hack means for crypto
The industry's largest players have developed the financial muscle to survive a catastrophe, BusinessDesk argued, but they still cannot convincingly explain why ordinary people should expose their savings to one. PYMNTS reached a similar conclusion, writing that the breach reveals how crypto's financial footprint has outgrown its institutional safeguards.
Emergency reserves, asset freezes and corporate funds helped contain the damage, but crypto still lacks standardized mechanisms to absorb losses and restore liquidity, according to PYMNTS. The arrangements governing who supplies liquidity, freezes assets, compensates customers and absorbs residual losses remain far less uniform than the infrastructure for moving digital assets.
Binance carries a chequered history into this crisis. Its founder Changpeng Zhao served a four-month prison sentence in the United States in 2024 after allowing his platform to be used for money laundering, BusinessDesk reported.
For Binance, the incident is now as much a test of trust as it is a financial challenge, Crypto Reporter wrote. The obvious question is not whether Binance can survive this attack, BusinessDesk argued, but whether the episode changes what customers demand from the platforms holding their money.
Conclusion
The Binance hack is the largest cryptocurrency theft on record, and the exchange has covered about 95% of the stolen assets using its corporate treasury, customer protection reserve and futures insurance fund. Withdrawals have resumed, outflows have slowed from their initial spike, and Tether and Circle have frozen about $3 billion in stolen stablecoins.
The next concrete step is Binance's effort to acquire the remaining less liquid tokens and replenish its SAFU fund while investigators pursue recovery of the full amount stolen. Whether the episode pushes the industry toward standardized mechanisms for absorbing losses remains the open question the facts leave unresolved.
Frequently Asked Questions
How much was stolen in the Binance hack on October 29, 2026?
Binance puts the theft at approximately $6.3 billion, with other reports citing $6.34 billion or $6.6 billion. Attackers moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in roughly 20 minutes, making it the largest cryptocurrency theft on record.
How did attackers get into Binance's systems?
Binance says a person posing as a project director contacted a software engineer through a job-hunting platform in September 2026 and instructed the engineer to download an interview assignment that was a malicious code repository. The attackers later used Binance's internal AI tool to gain control over wallet systems.
Will Binance customers lose money from the hack?
Binance has pledged to bear the full financial cost and says customer balances will not be affected. By Sunday, November 1, the exchange said it had replaced about 95% of the stolen assets using company funds, drawing on its corporate treasury, customer protection reserve and futures insurance fund.
Who carried out the Binance hack?
The FBI attributed the attack to TraderTraitor, described as a North Korea-affiliated hacking unit. Binance described the operation as a sophisticated, multi-stage campaign that began in June 2026 and involved months of preparation, including fictitious job interviews targeting its engineers.
How much of the stolen crypto has been recovered or frozen?
Tether and Circle collectively froze about $3 billion in stolen tokens, an intervention possible because issuer-controlled stablecoins retain a freeze mechanism after funds leave an exchange. The frozen funds are separate from Binance's own reserves and may not all be recoverable.
