The $6.3 billion Binance hack explained

On Thursday, October 29, 2026, attackers stole about $6.3 billion in crypto from Binance, the world's largest exchange by trading volume. CNBC called it the largest crypto theft on record, more than four times the size of the Bybit hack of 2025.

The story was still developing when this article was written. Some figures have changed from day to day and differ between sources, so we note who said what. Here is what is known as of November 6, 2026.

What happened

Binance estimated the impact at $6.3 billion in token assets taken from its hot wallets, the internet-connected wallets exchanges use to process withdrawals. Blockchain analytics firm TRM Labs put the figure at about $6.36 billion, moved across 10 blockchains, with most of it transferred within about 20 minutes. The CEO of Chainalysis cited $6.4 billion.

Binance temporarily suspended withdrawals. Binance later said that it would absorb the loss rather than pass it to customers: "Binance will absorb the financial impact of these stolen funds, not our users."

How the attack worked

Binance published its account on November 3. As reported by Fortune, it was not a clever break-in through the exchange's code. It began with people.

1. A fake job offer. A Binance software engineer was approached on a legitimate job-hunting platform by someone posing as a "Project Director." The process included a fake interview with an HR representative and a second one with a person claiming to be the CEO of a company that did not exist. Fortune's headline names LinkedIn as the platform.
2. A poisoned download. In a separate effort, a second engineer clicked an internet ad for a tampered version of Homebrew, a common developer tool. Binance removed it, but the attackers had already learned who managed company wallets.
3. Moving sideways. Using the first engineer's compromised computer and an internal AI tool, the attackers gained control of two more engineers' access.
4. The key to the wallets. One engineer's computer held a deployment permission token. The attackers used it to take over a series of Binance wallets and drain them.

TRM Labs said preparation began at least 36 hours before the theft, and Binance's report describes a scheme that lasted months. Although many people assumed AI was central to the attack, Binance's account says it relied mainly on conventional phishing.

Who was behind it

TRM Labs attributed the theft "with high confidence" to TraderTraitor, a North Korean state-sponsored hacking unit, and Chainalysis reached a similar view. The FBI said on October 31 that it had determined North Korea was responsible. The same group was linked to the Bybit hack of February 2025.

Where the money is now

This is where the reporting needs the most care, because three different things are easy to confuse:

As CNBC pointed out, covering 90% of assets does not mean 90% was recovered from the attacker. Binance said it drew on its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury. It said it is buying the remaining less-liquid tokens on the market.

Can customers withdraw?

Yes, for most assets. Withdrawals returned in phases, starting with the Bitcoin network and followed by Ethereum and BNB Smart Chain. Sources differ slightly on the date (Saturday or Sunday, October 31 or November 1). Later coverage citing Binance's updates described withdrawals restored across dozens of tokens. Check Binance's official announcements for the current list, since this changes quickly.

Bitcoin was under pressure the day after the hack, trading below $78,000. A Fundstrat analyst told CNBC that the attack did not appear to create a meaningful solvency risk for Binance.

What should you do if you use Binance?

• Get updates only from official channels. Type the address yourself or use the official app.
• Expect scams built around this news. Fake "compensation claim" pages and fake support agents usually follow a big hack. No real refund process asks for your password, 2FA code or recovery phrase.
• Check your own account security. Use an authenticator app or security key, plus a withdrawal address allowlist.
• Think about how much you keep there. Being unable to withdraw for two days is a small problem unless you need the money during those two days.

The bigger lesson

Binance reports that its customers are being made whole, and that is a much better outcome than Mt. Gox or FTX. But it depended on the company having enough money to pay. A smaller exchange could not absorb a loss like this. Our guide to where to keep your crypto walks through the trade-offs, and our history of exchange hacks shows how differently these stories can end.

Sources

• CNBC: Binance's $6.3 billion hack, what we know and what comes next
• CNBC: Binance resumes withdrawals, says 90% of stolen user assets are covered
• Fortune: North Korea used LinkedIn, fake job interviews to trick Binance engineer
• FinanceFeeds: Binance hack one week on, what is actually recovered