The Binance hack hit on October 29, 2026, when attackers drained about $6.3 billion from Binance hot wallets across several blockchains. According to Binance, the attack started with a compromised DevOps engineer’s laptop, which gave the attacker access to a service container used to submit withdrawals. About $3 billion has been frozen so far, and Binance says it will cover every loss from its SAFU fund and company funds.
This post mortem pulls together everything confirmed so far: the timeline, how the attack worked, who is likely behind it and what it means for users. Binance hasn’t published its full technical report yet. We’ll update this post mortem as soon as it does, or when more news follows.
Binance Hack Timeline
Here’s how the biggest crypto heist in history unfolded, with all times in UTC:
- October 28 to 29: The attacker’s relayer wallet receives gas money through three 0.1 ETH Tornado Cash withdrawals.
- October 29, 15:59: That wallet deploys a malicious delegate contract.
- Around 20:21: An EIP-7702 authorization installs the malicious code on Binance 14, a major Binance hot wallet on Ethereum.
- 20:24: One “sweep” call empties Binance 14. Within 24 seconds, Binance 16 sends another 28,005 ETH to the same address.
- Shortly after: The attacker pulls 780 million USDC from Binance Hot Wallet 34. Binance hot wallets on Bitcoin and Tron get drained as well.
- Around 21:00: Tether and Circle freeze close to $1.8 billion in stablecoins sitting in the main receiving wallet.
- Evening: Binance founder CZ says it “does look like a hack” and that user funds are safe.
- October 30, 02:23: Binance officially confirms the incident, estimates the impact at $6.3 billion and suspends withdrawals.
- October 30, morning: Reuters reports Binance is working with the FBI and the US Secret Service. Binance reveals it has reserved over $6.34 billion to cover the losses.
According to Reuters, the drain itself took only about 20 minutes.
How the Attackers Got In
Binance’s first explanation pointed to a single compromised laptop belonging to a DevOps engineer. From that machine, the attacker reached a service container that could submit withdrawal transactions. Importantly, Binance says it found no evidence of a wallet private key leak.
That matches what on-chain analysts saw. Analyst 0xQuit noticed the attacker used a relayer wallet on Ethereum. With Binance’s private keys, they could have moved the funds directly. Instead, they seem to have had signing access through Binance’s own systems, which is exactly what a compromised service container would provide.
However, the story didn’t stop there. In a later update, Binance said its investigation had uncovered additional points of breach and called it a complex attack. It hasn’t said where those breaches were. That also helps explain the Bitcoin and Tron drains, since the EIP-7702 trick only works on EVM chains like Ethereum.
So the full attack path is still unknown. Binance’s detailed technical post-mortem should fill that gap.
How the Funds Were Drained On-Chain
On Ethereum, the method was clever and fast. EIP-7702 lets a regular wallet temporarily run smart contract code. The attacker used it to point Binance 14 at their own contract, then called a “sweep” function. In one transaction, that function emptied the wallet of ETH and more than 60 tokens.
The biggest assets in that first sweep included about 1.6 billion USDT, 62.6 million RLUSD, nearly 30,000 wBETH and over 11,000 XAUt. Large chunks of UNI, ENA, PEPE, LINK and AAVE followed. After that, the attacker forwarded 195,460 ETH, worth around $450 million, to a fresh wallet.
Beyond Ethereum, independent tallies traced stolen funds on Bitcoin, Tron, the XRP Ledger and several Layer 2 networks. On Bitcoin alone, about 18,270 BTC left a Binance hot wallet.
How Much Was Stolen and Frozen
Binance puts the total impact at about $6.3 billion. That’s roughly four times the $1.5 billion Bybit hack from February 2025, the previous record.
The freezes came fast, and from more directions than usual:
- Tether has frozen nearly $1.57 billion in USDT linked to the hack, according to Reuters.
- Circle froze more than $800 million in USDC.
- World Liberty Financial froze the $27 million in USD1 tied to the hack. Co-founder Zach Witkoff called stopping stolen funds a shared responsibility.
- The Arbitrum Security Council executed a transaction freezing about $30.5 million held by the exploiter on Arbitrum.
- In total, Binance says about $3 billion is frozen on-chain so far.
The Arbitrum move stands out. Usually, only stablecoin issuers can freeze funds. Here, a Layer 2’s security council stepped in directly, which shows how seriously the industry is treating this one.
Even so, roughly $3.3 billion remains outside the freezes. Most of it sits in assets no issuer can freeze, like BTC and ETH.
On the bright side, Binance says the outflows stopped once it paused withdrawals. In other words, the losses aren’t growing.
How Binance Is Covering the Losses
Binance’s message has been consistent: users won’t pay for this. The exchange says it will cover all losses from its SAFU fund and company funds.
The details are more concrete than usual:
- Binance has reserved over $6.34 billion of company funds for the incident.
- Of that, $5 billion is already held in the exact tokens that were stolen.
- Binance is buying the rest through market and OTC channels, which may take longer for low-liquidity tokens.
- Frozen funds come on top of this, so any recovery reduces the final cost.
- An updated Proof of Reserves will follow once remediation is complete.
Binance co-founder Yi He summed up the confidence in a reply to Elon Musk. She said the company’s revenue for the year is enough to cover the losses.
Who Is Behind the Binance Hack?
No one has officially named the attackers yet. Binance CEO Richard Teng says the investigation hasn’t identified them.
Still, the signs point one way. Blockchain analytics firm TRM Labs says the attack shares traits with the Bybit hack, which the FBI attributed to North Korea. TRM is highly confident the same group is behind this one. 0xQuit also pointed to North Korea’s Lazarus Group early on.
The timing adds another layer. Just two days before the hack, Binance said it had blocked a week of North Korea-linked attacks that used fake job interviews. Whether those attempts connect to the breach is still unknown.
Elon Musk, CZ and the FTX Comparison
Not everyone stayed supportive. Elon Musk quoted a post about the hack with a short “Everyday is Zeroday.” Later, he replied with a grimacing emoji to a meme comparing CZ to SBF.
The meme hit a nerve for a reason. Before FTX collapsed in 2022, SBF famously tweeted that FTX had enough to cover all client holdings. So when CZ promised to cover the Binance losses, critics drew the obvious line.
CZ pushed back directly. He told Elon it was a bad time to troll. He also reminded him that Binance’s $500 million investment in his Twitter takeover is now worth over $1 billion in SPCX shares. Yi He followed up with her line about yearly revenue covering the loss.
The difference with FTX lies in the details. Binance has named a reserve amount, says most of it already sits in the exact stolen tokens, and has promised a public Proof of Reserves. If those numbers hold up, this is a costly hack, not a solvency crisis.
When news like this breaks, minutes matter. As soon as the first rumours surfaced, we tweeted a warning to our community. Once the on-chain evidence was clear, our Binance hack coverage went live within minutes. After that, we kept updating it through the night as the numbers grew from $2 billion to $6.3 billion.
For me, this isn’t new. During the Bybit hack in February 2025, I tweeted the warning while pulling my own funds off the exchange. You can read that story in our Bybit hack breakdown. On October 29, we did the same with the Polymarket hack just hours before Binance got hit.
Every time, the routine is the same. I rush to my desk, watch the chain, warn our users first and trade the volatility when there’s a setup. That’s what AirdropAlert has always been about: looking out for our users.
What Binance Users Should Do Now
For now, Binance says withdrawals should resume in roughly 45 hours, while deposits are unaffected. Here’s how to handle the next few days:
- Ignore fake links. Scammers will push “withdrawals are back” and “claim your refund” pages. Only use the official Binance app or website.
- Expect a rush. When withdrawals reopen, many users will move funds at once, so delays are possible.
- Diversify. If this hack made you rethink keeping everything on one exchange, our Binance alternatives list covers the platforms we trust.
- Brush up on safety. Our crypto safety guide covers phishing, drainers and wallet hygiene.
We’ll also refresh our Binance review next week with a full section on the hack and Binance’s response.
Keep This Content Free
Covering a $6.3 billion hack in real time takes a long night, and we keep every word of it free. One way to avoid exchange hot wallet risk altogether is to trade on-chain. On a perp DEX, your funds stay in a smart contract rather than a custodial hot wallet, although DEXs carry their own risks, as the Polymarket frontend hack showed.
If you want to try it, start with our Hyperliquid review and our Lighter review. Signing up through our Hyperliquid referral link or our Lighter referral link supports our work at no extra cost to you.
Final Words
The Binance hack started with a single compromised laptop and turned into the biggest crypto theft ever recorded. Fortunately, fast freezes from Tether, Circle, WLFI and Arbitrum, plus Binance’s $6.34 billion reserve, mean users should come out whole. The bigger questions are how the attackers moved across so many chains and how Binance will lock down its systems from here.
It’s been a rough month for security. From the Keystone data breach to Polymarket and now Binance, attackers keep hitting the weakest link, which is rarely the code itself. We’ll update this post mortem as soon as Binance publishes its full technical report or more news follows.
FAQ
What caused the Binance hack?
According to Binance, the attack started with a compromised DevOps engineer’s laptop. That gave the attacker access to a service container that could submit withdrawals. Binance later found additional points of breach, and it says no wallet private keys were leaked.
How much was stolen in the Binance hack?
Binance estimates the total impact at about $6.3 billion. Roughly $3 billion has been frozen so far, leaving about $3.3 billion outside the freezes.
Who froze the stolen funds?
Tether froze nearly $1.57 billion in USDT and Circle froze more than $800 million in USDC. World Liberty Financial froze $27 million in USD1, and the Arbitrum Security Council froze about $30.5 million on Arbitrum.
Will Binance users be reimbursed?
Yes, according to Binance. It says it will cover all losses from its SAFU fund and company funds, and it has reserved over $6.34 billion for the incident.
Who is behind the Binance hack?
There’s no official attribution yet. TRM Labs is highly confident it’s the same group behind the Bybit hack, which the FBI linked to North Korea.
When will Binance withdrawals reopen?
Binance says it’s on track to resume withdrawals in roughly 45 hours, while deposits are unaffected.
Is the Binance hack the biggest crypto hack ever?
Yes. At about $6.3 billion, it’s around four times larger than the $1.5 billion Bybit hack in February 2025.
Has Binance published an official post-mortem?
Not yet. Binance has shared initial findings and promised a detailed technical post-mortem once its investigation is complete.
Credit: Source link
