Binance Loses $6.3Bn in Largest Crypto Theft Ever as Tether and Circle Freeze $2.6Bn: What We Know About Binance Hack

Hackers took about $6.36 billion from Binance’s hot wallets across ten blockchains on Thursday, October 29, marking the largest crypto theft on record. According to the exchange, the breach began with an engineer’s compromised laptop.
Most of the funds disappeared in roughly 20 minutes. Tether and Circle froze approximately $2.6 billion of the stolen stablecoins within an hour, and Binance now puts the verified frozen total at around $3 billion. The exchange has promised to cover every loss and temporarily paused withdrawals, which it expects to reopen by Sunday.

The market reacted swiftly: BNB dropped 8.7% within an hour, Bitcoin slid below $77,000, and roughly $1.5 billion in leveraged positions were wiped out. This report details what happened, how much was actually stolen, and what lies ahead for BNB.

Breaking: The hackers behind the $6B #Binance hack, $1.5B #Bybit hack, and $388M #Bitget hack may all be linked to North Korea's Lazarus Group.https://t.co/4IESZvOjHJ

— Lookonchain (@lookonchain) October 30, 2026

What Happened in the Binance Hack?

An attacker managed to trick Binance’s internal systems into signing withdrawals out of its hot wallets—the online storage used by exchanges to pay out customers. Binance stated on Friday that its initial findings point to a DevOps engineer’s compromised laptop, which granted the attacker access to a service container to submit unauthorized withdrawal transactions. The exchange reported “no evidence of any wallet private key leak.”

Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y

— Binance (@binance) October 30, 2026

The heist had been prepared for more than a day. Data from TRM Labs outlines the timeline (with times listed in UTC):

• October 28, morning: The attacker’s operator wallet is funded using three small withdrawals from the Tornado Cash mixer.
• October 29, earlier in the day: Attack code is tested on two wallets, rehearsed on a third, and finally installed on a Binance hot wallet about four hours later.
• 20:05–20:09: Five Binance XRP Ledger wallets send 233.46 million XRP to a single address.
• 20:20: A Binance Bitcoin hot wallet transfers 18,270 BTC, followed two minutes later by a Tron wallet sending 612.7 million USDT.
• 20:23: The main Ethereum hot wallet is emptied of 167,464 ETH and 1.615 billion USDT.
• 21:29: Binance announces it is investigating “a potential security issue.”
• 23:05: A second wave targets Binance wallets on Avalanche and Polygon.

On Ethereum, the attacker leveraged EIP-7702, a feature introduced in the May 2025 Pectra upgrade that allows a standard wallet to hand control over to a smart contract. The hot wallet authorized 50 such handovers to a “sweeper” contract, ensuring newly deposited funds were continually drained for hours. TRM tracked six additional sweeps between 20:41 and 23:56.

TRM attributes the attack “with high confidence” to TraderTraitor, the North Korean state-sponsored group blamed by the FBI for February 2025’s $1.5 billion Bybit hack. Binance has not publicly named any individual or group.

How Much Was Stolen, and How Much Did Tether and Circle Freeze?

Approximately $6.36 billion exited Binance, and roughly $2.7 billion of that amount has been frozen, according to TRM’s evaluation at 00:30 UTC on Friday, valued at prevailing market rates during each transfer. Binance’s own estimates cite “around $6.3B” stolen and about $3 billion verified as frozen, noting that figures may still change.

Ethereum suffered the largest loss at about $3.79 billion, followed by 18,270 BTC taken from the Bitcoin wallet, valued at roughly $1.47 billion.

Stablecoins proved vulnerable because their issuers possess the ability to block specific addresses. The freezes were implemented rapidly:

• Circle: At 21:04 UTC, Circle froze 823 million USDC in the primary receiving wallet. CEO Jeremy Allaire stated that the company acted “in coordination with law enforcement.”
• Tether: 971.1 million USDT was frozen at 21:01 UTC, with CEO Paolo Ardoino reporting the total exceeded 1.567 billion USDT by 21:25. TRM currently counts around 1.77 billion USDT frozen across Ethereum, Tron, Avalanche, and Polygon.
• Ripple: Froze 40.5 million RLUSD at 22:01 UTC, after the attacker managed to sell 48 million on decentralized exchanges.
• World Liberty Financial: Froze 27.8 million USD1.
• Arbitrum: Its Security Council forced 8,426 ETH and 74.6 million ARB—worth about $30 million—out of the attacker’s wallet.

The remainder of the funds continues to move. TRM indicates the attacker still retains control of about $2.4 billion, including the Bitcoin holdings, which are being split into chunks of 1,000 BTC and 100 BTC. Additionally, roughly 325 million USDT was swapped for approximately 122,300 ETH via UniswapX, paying a premium of over 10% above market price to exit before Tether could act. Native Ethereum cannot be frozen by any single issuer.

However, frozen balances do not automatically return to Binance’s possession. Releasing those funds requires coordination among issuers, law enforcement, and potentially courts, none of which have provided a timeline.

CZ Warned About Phishing for Days. What Has Binance Said Since?

Binance founder Changpeng Zhao (CZ) spent the preceding week urging traders to secure their accounts. On October 23, he argued that artificial intelligence poses a greater threat to crypto users through data leaks and sophisticated phishing than through vulnerabilities in encryption itself. On Wednesday, following four corporate data leaks in a single day—impacting Coinbase’s vendor Amplitude, South Korea’s Bithumb, and two local brokers—he published a security checklist, noting that “scammers move fast after one.”

By the next day, his own exchange found itself at the center of a major security breach. Binance has not yet detailed how the engineer’s laptop was compromised, though the incident highlights the exact vulnerability CZ had repeatedly emphasized: the security of an individual device.

Since the theft, CZ and co-CEO Yi He have maintained a unified message assuring users they will not bear the losses. “Loss might be a bit higher than that, but will cover,” CZ posted on Thursday night, adding hours later, “It hurts, but we will survive.”

Current operational updates as of Friday morning include:

• Withdrawals: Paused across all networks. In a 04:36 UTC service update, Binance stated it is rebuilding its withdrawal infrastructure and addresses, expecting to resume services “within 48 hours.”
• Deposits: Functioning normally.
• Other services: Binance Alpha trading is suspended, and Friday’s PREDICT listing has been postponed.
• Root cause: Attributed to “multiple factors,” with a comprehensive post-mortem to follow.
• Binance.US: Unaffected, as it operates as a separate platform.

Phishing risks now extend to Binance users as well. Yi He issued a warning on Friday asking users to rely solely on official Binance channels, avoid unofficial links, and refrain from sharing account details with anyone, as fake “refund” and “withdrawal verification” scams typically follow incidents of this scale.

EXPLORE: BTC USD Fell in the Month After 12 of the Fed’s 16 Rate Hikes Since 2018: What Could a December Hike Mean for Bitcoin?

How Did the Market React to the Binance Hack?

The market responded with a rapid sell-off followed by a partial rebound. BNB fell from $744.90 to $680 during the 20:00 UTC hour, marking an 8.7% drop. Bitcoin fell from $80,849 to $76,500 by early Friday, while Ether moved from $2,337 to $2,174.

Leverage amplified the market turbulence. Data from CoinGlass shows $1.55 billion in liquidations over 24 hours affecting 239,610 traders, with long positions accounting for 83.6% ($1.29 billion) of the total. Bitcoin positions represented $501.6 million of the liquidations, and Ethereum accounted for $360.6 million. Binance processed 49.4% of the total liquidations, which included the largest single order: an $11.09 million BTCUSDT long closed out at $79,254.71.

The Crypto Fear & Greed Index dropped from 51 down to 30, signaling “fear.”
Bitcoin reached a low within $30 of its 200-day exponential moving average (EMA) at $76,473, where buyers stepped in to provide support. It currently trades near $78,000.

BNB Price Analysis: Can BNB Hold $680 After the Binance Hack?

So far, it has managed to do so. BNB rebounded to $720 by 03:00 UTC as Binance reiterated commitments to cover all losses. However, selling pressure capped further gains, and the token trades around $706, down 6.2% over a 24-hour period.

• Resistance: $720 (Friday’s rebound high), followed by $745.74 (the pre-hack trading level).
• Support: $692.49 (the 200-day EMA), followed by $680 (the low recorded during the hack hour), and $674.60 (the September 1 low).

The immediate test is the 48-hour restoration window. If Binance successfully reopens withdrawals by Sunday morning without triggering a widespread exit of funds, the worst impacts of the hack may already be priced in. If the reopening experiences delays, $680 remains a critical support level to monitor.

EXPLORE: Best Meme Coin ICOs to Invest in 2026

Follow 99Bitcoins on X For the Latest Market Updates, and Subscribe on YouTube For Daily Expert Market Analysis.