Binance hit by a hack estimated to have cost $6.3 billion

An attack that has rocked the world’s largest cryptocurrency exchange

29 October 2026 will go down as a particularly significant date for the cryptocurrency sector. Binance, one of the world’s largest digital asset exchanges, has confirmed that it suffered a security incident involving unauthorised withdrawals. According to initial analyses by the specialist firm TRM Labs, approximately $6.36 billion is believed to have been withdrawn from wallets attributed to Binance. The transactions were observed across ten blockchains, with a large proportion of the funds transferred within around 20 minutes from 20:05 UTC. The scale of the operation far exceeds that of the Bybit hack in February 2025, which was estimated at around 1.5 billion dollars. If TRM Labs’ estimate is confirmed in full, the incident could become the largest cryptocurrency theft ever recorded. Binance has acknowledged that its operational wallets, known as ‘hot wallets’, have been compromised. These wallets remain connected to the infrastructure required for day-to-day operations, enabling deposits and withdrawals to be processed quickly. This availability also makes them particularly vulnerable when an internal security mechanism is compromised.

How did the hackers go about it?

Initial technical analyses suggest that the attackers did not simply steal a wallet key to transfer the funds. The attack appears to have affected internal mechanisms used to authorise transactions. On Ethereum, TRM Labs describes, in particular, the use of an EIP-7702 delegation. This feature allows an account to delegate certain operations to another piece of code. Attackers are believed to have exploited this mechanism to turn a functional wallet into a tool for automatically transferring funds to addresses they controlled. The analysis also highlights the preparation of 50 authorisations signed in advance. In the case of the nine other networks concerned, the funds are said to have been transferred via transactions signed in the usual way. These findings are leading investigators to suspect that the wallets’ signature infrastructure may have been compromised. However, a distinction must be made between the specialists’ analyses and the official conclusion: Binance states that its investigation has identified several points of compromise and that the full sequence of the attack has yet to be established. The company also states that it has found no evidence of a leak of private keys from the wallets. This clarification is important, but it does not mean that its entire infrastructure is out of danger.

The North Korean lead raised by the investigators

TRM Labs attributes the operation – with a high degree of confidence, according to its analysis – to the TraderTraitor group, which is linked to North Korea. This group is known in the cybersecurity sector for its operations targeting businesses and infrastructure linked to cryptocurrencies. The authorities and blockchain analysis firms have been monitoring the activities of North Korean groups involved in the theft of digital assets for several years. However, this attribution remains the conclusion of an independent investigation. Binance has not publicly presented any conclusive evidence establishing the identity of those responsible. In particular, the full scenario will need to explain how the attackers obtained the necessary authorisations to initiate fund transfers across several networks.

Binance promises to reimburse users

In light of the scale of the incident, Binance announced that it would cover the losses using its own resources and its SAFU (Secure Asset Fund for Users) emergency fund. In its official update of 30 October, the company states that it has set aside more than $6.34 billion to cover the assets in question. It states that $5 billion is already held in the relevant assets and that it is seeking to acquire the remaining amounts. Binance also states that it is working with law enforcement agencies, blockchain analytics firms, token issuers and other trading platforms. Approximately $3 billion in assets are reported to have been frozen on the blockchain as at the date of this announcement. Withdrawals were temporarily suspended whilst security checks were carried out. Binance planned a phased resumption, subject to the validation of its systems. Deposits and other services not affected were to remain operational. The company also announced the publication of a new reserves report and the preparation of a detailed technical report on the incident.

A new security alert regarding centralised platforms

This attack serves as a reminder of a reality that is often overlooked in the world of cryptocurrencies: holding digital assets on a platform does not mean having direct control over their private keys. Centralised platforms handle the safekeeping and execution of numerous transactions on behalf of their clients. They therefore centralise sensitive infrastructure, authorisation mechanisms and considerable volumes of assets. Even when users are not directly responsible for a security breach, they remain dependent on the organisation’s ability to secure its systems and honour its commitments. For those in the sector, the incident raises several questions: how can operational wallets be further isolated? How can internal authorisations be restricted? And how can we prevent the compromise of a technical component from triggering transfers across multiple blockchains? Binance will need to provide precise technical answers. The promise of a refund is important, but trust will be rebuilt primarily through the findings of the investigation, the transparency of the audits and the security measures actually put in place.