Binance Hack: $6.3 Billion Theft Tests Crypto’s Credibility

The Binance hack on October 29 drained roughly $6.3 billion from the world's largest cryptocurrency exchange, making it the biggest crypto theft on record. Attackers moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in roughly 20 minutes, according to Spiceworks.

The Binance hack matters because it forces the industry to answer a question it has long avoided: what happens to customers when something goes wrong. The exchange has pledged to absorb the loss itself rather than pass it to users, a response that PYMNTS described as the real test for institutional investors watching how the sector handles its worst days.

How the Binance hack unfolded

Binance described the operation as a sophisticated, multi-stage campaign that began in June 2026 and ran for several months, according to Shattered. The company's account, relayed by outlets including The New York Times, ABC News and The Verge, forms the backbone of the public record.

In September 2026, a person posing as a project director contacted a Binance software engineer through a job-hunting platform and instructed the engineer to download an interview assignment, Binance said. That assignment was what the company called a malicious code repository, and the approach came through a recruiting site rather than a phishing email, according to NPR's account of Binance's statement.

Binance said the code used "sophisticated obfuscation and evasion techniques" and swapped a legitimate development-tool component for a malicious version. The company's security tools did not detect the file, a detail The New York Times highlighted in quoting Binance's own description.

The attackers did not stop at one target. A second software engineer was approached for a fictitious job and took part in multiple interview interactions, including a virtual meeting with someone claiming to be the CEO of a fictitious company, Binance said.

Once inside, the attackers used Binance's internal artificial intelligence tool to gain control over wallet systems, the company said. The reporting does not identify which product that was, how it connected to wallet systems or what permissions it held, and Shattered treated any specific claim about its design as unconfirmed.

Competing explanations for the breach

Binance initially pointed to a compromised engineer's laptop as the source of the hack, then clarified that multiple factors contributed to the breach, BusinessDesk reported. The company's first statement said the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and added that it found no evidence of a wallet private-key leak, according to Spiceworks.

Binance later said its investigation had uncovered additional points of breach. Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action.

The emerging evidence points to hijacked transaction authorisation systems rather than any failure of bitcoin's underlying cryptography, BusinessDesk reported. Zelazny, quoted by Spiceworks, noted that "authentication does not equate to authorization."

The FBI attributed the attack to TraderTraitor, described as a North Korea-affiliated hacking unit, according to Shattered. Binance has given dates for only some stages of the campaign, leaving parts of the timeline undated.

Binance absorbs the loss

By Sunday, November 1, Binance said it had covered about 95% of the stolen assets by buying replacement tokens with company money. The remaining balance involved less liquid cryptocurrencies that were harder to acquire quickly, BusinessDesk reported.

The exchange drew on its corporate treasury, its customer protection reserve and part of its futures insurance fund. Binance had committed more than $6.34 billion to cover the shortfall, Crypto Reporter reported, and CoinDesk reported that Binance already held about $5 billion in the affected tokens while acquiring the rest through public markets and over-the-counter transactions.

Binance's SAFU protection fund was worth about $1 billion, and the company said it would use half of it and replenish it, BusinessDesk reported. The theft was more than six times the fund's size, so the wider balance sheet had to pick up the slack.

Binance has maintained that customer balances would not be affected and pledged to bear the financial cost of the incident. BusinessDesk argued that commitment is precisely what customers should expect, while also noting that compensating users after a security failure is different from showing assets were properly protected in the first place.

Withdrawals resume and outflows spike

Binance began reopening withdrawals for selected cryptocurrencies on Sunday after temporarily suspending them for security checks, Crypto Reporter reported. Customers initially rushed to move funds out, and the exchange recorded more than $3.5 billion in net outflows on Sunday, according to DefiLlama data cited by Reuters.

BusinessDesk put the figure at roughly $3.64 billion in net outflows, about 2.1% of Binance's assets, after withdrawals resumed. PYMNTS reported that customers had withdrawn north of $4.7 billion by November 2. Binance said withdrawal activity spiked at the beginning but was declining toward normal levels.

Most Binance users, across about 335 million accounts worldwide, apparently store their tokens offline in cold wallets, leaving smaller holdings on the exchange for liquidity, BusinessDesk reported. For Kiwi users, who may number in the hundreds of thousands, the immediate reassurance is the company's promise to absorb the loss.

Stablecoin freezes and the recovery effort

Tether and Circle, the two leading stablecoin issuers, collectively froze about $3 billion in tokens stolen from Binance, PYMNTS reported Friday. Issuer-controlled stablecoins retain an avenue for intervention after funds leave an exchange, and the frozen funds are separate from Binance's own reserves and may not all be recoverable, Crypto Reporter noted.

The Genius Act established a federal framework for payment stablecoins, which were involved in the hack but are recoverable because providers such as Tether and Circle could freeze about $3 billion worth of stolen tokens, BusinessDesk reported. Jardine, quoted by PYMNTS, observed that "a court order alone cannot make the bitcoin network transfer coins."

The Binance hack dwarfs the roughly $1.5 billion stolen from Bybit in February 2025, the previous benchmark, PYMNTS reported. Binance puts the theft at approximately $6.3 billion, while other reports cited $6.34 billion or $6.6 billion, according to Shattered.

What the Binance hack means for crypto

The industry's largest players have developed the financial muscle to survive a catastrophe, BusinessDesk argued, but they still cannot convincingly explain why ordinary people should expose their savings to one. PYMNTS reached a similar conclusion, writing that the breach reveals how crypto's financial footprint has outgrown its institutional safeguards.

Emergency reserves, asset freezes and corporate funds helped contain the damage, but crypto still lacks standardized mechanisms to absorb losses and restore liquidity, according to PYMNTS. The arrangements governing who supplies liquidity, freezes assets, compensates customers and absorbs residual losses remain far less uniform than the infrastructure for moving digital assets.

Binance carries a chequered history into this crisis. Its founder Changpeng Zhao served a four-month prison sentence in the United States in 2024 after allowing his platform to be used for money laundering, BusinessDesk reported.

For Binance, the incident is now as much a test of trust as it is a financial challenge, Crypto Reporter wrote. The obvious question is not whether Binance can survive this attack, BusinessDesk argued, but whether the episode changes what customers demand from the platforms holding their money.

Conclusion

The Binance hack is the largest cryptocurrency theft on record, and the exchange has covered about 95% of the stolen assets using its corporate treasury, customer protection reserve and futures insurance fund. Withdrawals have resumed, outflows have slowed from their initial spike, and Tether and Circle have frozen about $3 billion in stolen stablecoins.

The next concrete step is Binance's effort to acquire the remaining less liquid tokens and replenish its SAFU fund while investigators pursue recovery of the full amount stolen. Whether the episode pushes the industry toward standardized mechanisms for absorbing losses remains the open question the facts leave unresolved.

Frequently Asked Questions

How much was stolen in the Binance hack on October 29, 2026?

Binance puts the theft at approximately $6.3 billion, with other reports citing $6.34 billion or $6.6 billion. Attackers moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in roughly 20 minutes, making it the largest cryptocurrency theft on record.

How did attackers get into Binance's systems?

Binance says a person posing as a project director contacted a software engineer through a job-hunting platform in September 2026 and instructed the engineer to download an interview assignment that was a malicious code repository. The attackers later used Binance's internal AI tool to gain control over wallet systems.

Will Binance customers lose money from the hack?

Binance has pledged to bear the full financial cost and says customer balances will not be affected. By Sunday, November 1, the exchange said it had replaced about 95% of the stolen assets using company funds, drawing on its corporate treasury, customer protection reserve and futures insurance fund.

Who carried out the Binance hack?

The FBI attributed the attack to TraderTraitor, described as a North Korea-affiliated hacking unit. Binance described the operation as a sophisticated, multi-stage campaign that began in June 2026 and involved months of preparation, including fictitious job interviews targeting its engineers.

How much of the stolen crypto has been recovered or frozen?

Tether and Circle collectively froze about $3 billion in stolen tokens, an intervention possible because issuer-controlled stablecoins retain a freeze mechanism after funds leave an exchange. The frozen funds are separate from Binance's own reserves and may not all be recoverable.