How a $6 billion hack became the world's biggest crypto theft

Binance Holdings, the world's largest cryptocurrency exchange, lost an estimated $6.3 billion to hackers early on Friday, in what has been described as the single biggest theft of crypto on record, exceeding the $1.5 billion stolen from Bybit in February 2025.

What happened?

Funds began leaving Binance's hot wallets, which are connected to the internet to process customer withdrawals, at about 12.24am UAE time on October 30. A single transaction moved roughly 167,464 Ether, worth about $388 million, along with 63 other tokens, to an address created hours earlier and funded through the Tornado Cash mixing service, according to Etherscan data.

The stolen assets then spread across the Bitcoin, Ethereum, Tron and Ripple networks. Blockchain analytics firm Chainalysis estimated the haul at $5.912 billion at the time of the theft. Binance put the total impact at about $6.3 billion and said roughly $3 billion had been frozen with the help of partners including stablecoin issuers Tether and Circle.

Binance's preliminary investigation suggests the attacker compromised a DevOps engineer's laptop and used it to reach a service container and submit unauthorised withdrawals, the exchange said in an update on its website. It found no evidence that wallet private keys were leaked and has revoked the affected access.

Blockchain analytics firm TRM Labs linked the attack "with high confidence" to TraderTraitor, a North Korean hacking group. Binance has suspended deposits and withdrawals and pledged to cover all losses from its SAFU insurance fund and company funds.

How much has crypto lost overall?

The industry lost about $22.7 billion to hacks, scams and fraud between 2011 and March 2025, according to a report by blockchain analytics firm Crystal Intelligence. Thefts totalled $3.4 billion across all of 2025, Chainalysis data shows, and hacks in 2026 had added a further $2.35 billion to $2.68 billion before the Binance attack, according to estimates from Lightning.news and security firm CertiK.

That puts cumulative losses at roughly $26 billion to $27 billion before the attack. No tracker has yet published an updated all-time figure, and methodologies differ: some count only hacks, while others include Ponzi schemes and fraud. Depending on how much of the Binance haul is recovered, the total could approach $30 billion.

How does it compare?

In dollar terms, the Binance theft is almost four times the size of the Bybit hack, which the FBI attributed to North Korea. It is equivalent to about a quarter of everything Crystal Intelligence tracked as lost since 2011, and more than double all other hacks recorded so far this year. Even after the freezes, the roughly $3 billion still unaccounted for would be twice the previous record.

Why does it matter?

Binance is the largest crypto exchange by trading volume, so the breach reverberated across the market. Bitcoin fell below $77,000, Ether dropped to about $2,200, and BNB, the token closely tied to Binance, dropped below $700. About $1.5 billion of leveraged positions were liquidated, according to TradingKey.

The attack adds to evidence that crypto's weakest link has shifted from software code to people and private keys. The largest breaches of 2026 stemmed from compromised credentials and devices rather than smart-contract bugs, security firm CertiK has said. Binance's own account of a compromised employee laptop fits that pattern.

Is customer money safe?

Binance says it is. The theft came from the exchange's own operational wallets rather than individual accounts, and the company has pledged to make customers whole. There is no indication so far that user logins were compromised.

Until withdrawals reopen, though, customers' balances are a claim on Binance rather than coins they control. Chainalysis's estimate implies a gap of about $3.4 billion after freezes, well above the SAFU fund, according to investingLive. Founder Changpeng Zhao, who no longer runs the exchange, has said he expects all user funds to be covered.

What happens next?

Investigators are tracing the remaining funds with law enforcement and blockchain intelligence firms, and Binance says further freezes are possible. The exchange has promised an updated proof of reserves once remediation is complete and a technical post-mortem when the investigation ends. It has not said when withdrawals will resume.

Large thefts are typically followed by a wave of opportunistic scams, and Binance has warned users not to trust unofficial links, messages or requests for account details.