On 29 October 2026, thieves stole about $6.34 billion of crypto from Binance, one of the world's largest crypto exchanges. An exchange is a company where people buy, sell, and store crypto. Binance said it would cover the loss itself, so its customers would not pay.
We wrote this on 8 November 2026 from Binance's own statements, a Tether release, and reports from TRM Labs, a firm that traces stolen crypto on blockchains. Several figures changed during the week, so each one carries its date.
What was the Binance hack? On 29 October 2026, thieves moved about $6.34 billion of crypto out of Binance, the largest crypto theft on record, according to TRM Labs. Binance said it would repay the loss from its own funds.
Most of the money left in about 20 minutes. Smaller transfers continued until almost midnight UTC, Coordinated Universal Time, the standard world clock.
Some of the stolen coins were dollar-linked tokens. The company that issues such a token can lock it, so the token cannot be moved. Binance counted about $2.85 billion as frozen or intercepted. Bitcoin and ether, the coin of the Ethereum network, have no company behind them. TRM counted about $2.4 billion of them as still held by the thieves.
A customer who leaves coins on an exchange relies on the exchange's security and its promise to repay.
What does it mean to keep crypto on an exchange?
An exchange is a company where customers trade crypto for dollars or for other coins. It also stores the coins for them. Storing assets for someone else is called custody.
Control of a coin comes from a key, a long secret code that authorises moving it. A wallet is software that holds keys and signs transactions. The exchange holds the keys, while the customer holds a balance in the exchange's records. Self-custody means the owner keeps the key, so the risk moves from the exchange to the owner.
Exchanges use two kinds of wallet. A hot wallet is connected to the internet, so it can pay out withdrawals quickly. A cold wallet keeps its keys offline. Think of a shop's till and its safe. Binance said the thieves reached hot wallets.
Each coin lives on a blockchain, a shared public record of transactions that computers around the world copy and check. Ethereum is one such network. Its coin is called ether. Bitcoin and XRP have their own networks.
What happened to Binance on 29 October?
The first theft began at 20:05 UTC, which is 8:05 p.m. in London that evening. Between 20:05 and 20:09, five Binance wallets sent 233.46 million XRP to the thieves, according to Binance's report. XRP is the coin of the XRP Ledger network.
At 20:20, a Binance wallet sent 18,270 Bitcoin. In all, assets left wallets on ten blockchains. TRM said most of the theft took about 20 minutes.
Binance suspended withdrawals, but the theft went on. The thieves had written a standing instruction onto the Ethereum network. It let their code keep moving money out of one Binance wallet, whatever Binance did on its own systems.
Binance said its wallet needed several parties to approve any change, so no single person could cancel the instruction quickly. Its team built a procedure to cancel it, which took extra time. The last transfer, 2,961.9 ether, completed at 23:56 UTC. At 00:10 UTC on 30 October, Binance cancelled the instruction.
How did the attackers get in?
On 30 October, Binance said an initial investigation pointed to a compromised laptop, one an attacker had taken over. It belonged to a DevOps engineer, who runs the servers behind the exchange. Binance said that let the attacker send unauthorised withdrawals.
The 3 November report described a longer campaign. In June, an engineer downloaded a tampered installer, a fake version of a program that sets up software.
In September, another engineer took part in two fake job interviews. The second ended with a download of malicious code, software built to do harm. Binance said its security software did not detect it.
On 20 October, Binance said, the attacker used that engineer's computer and an internal AI tool to take control of two more engineers' accounts. The attacker then found a digital pass on another engineer's computer that let its holder launch software on Binance's servers.
On 29 October, between 17:15 and 19:56 that day by Binance's timeline, the attacker used login details stolen from the engineer who held the pass to launch the attack.
What does a frozen stablecoin mean? How much was frozen?
A token is a coin issued by a company. A stablecoin is a token designed to be worth one dollar. Tether's USDT and Circle's USDC are two. Tether and Circle are the issuers.
An issuer controls its token's software, so it can block an address, which is an account's identifier on a blockchain. A frozen token stays where it is, but its holder cannot send it.
Tether said on 2 November that it froze more than $1.5 billion of USDT within 30 minutes of the attack. TRM reported that Circle, Ripple, and World Liberty Financial froze tokens too. Binance counted $2.85 billion as frozen or intercepted on 3 November. Frozen tokens are locked, not returned.
The thieves sold about 325 million USDT for ether and accepted more than 10% less than its market value, according to TRM. Ether has no issuer, so it cannot be frozen.
The money figures each count something different. The table gives each one's amount, date, and meaning.
Amount | Counted by, and date | What it means |
|---|---|---|
$6.34 billion | Binance, report of 3 November | Value of the assets stolen |
$6.36 billion | TRM Labs, as of 00:30 UTC on 30 October | The same theft, with each transfer valued at the price when it happened |
$2.85 billion | Binance, report of 3 November | Frozen or intercepted. Frozen tokens are locked, not returned |
About $2.7 billion | TRM Labs, as of 00:30 UTC on 30 October | Frozen on the blockchains within hours of the attack |
About $2.4 billion | TRM Labs, as of 00:30 UTC on 30 October, still held on 3 November | Bitcoin and ether the thieves hold, beyond any issuer's reach |
$3.64 billion | Binance, 06:00 to 15:30 UTC on 1 November | Customers' withdrawals minus deposits after withdrawals reopened. Not stolen money |
Money figures from the Binance theft, by who counted and when. Source: Binance; TRM Labs
The table shows two counts of the theft, two counts of the frozen share, and one count of what the thieves still held. The $3.64 billion counts customers' withdrawals, not stolen money.
Subtracting Binance's two figures leaves about $3.49 billion that was neither frozen nor intercepted. TRM's count of $2.4 billion in Bitcoin and ether falls inside that gap. None of the documents we opened gives a figure for the rest. TRM's 3 November update said funds were moving through TRON and Solana, two other blockchains.
Who covers the losses?
Binance said it would. Its 3 November report states that Binance will absorb the financial impact, not its users. On 30 October, it said the money would come from a dedicated reserve fund and from the company's own funds.
Binance said that as of 31 October, 98% of the affected tokens had been replaced. It was still buying the rest, which trade in small amounts.
Binance restarted withdrawals on 1 November. Between 06:00 and 15:30 UTC that day, customers withdrew $4.649 billion and deposited $1.01 billion. That left customers having taken out $3.64 billion more than they put in. Binance said this is 2.1% of the $171 billion of assets it reports holding.
Who was behind the Binance hack?
Binance's 3 November report says the latest information from the US Federal Bureau of Investigation (FBI) indicates North Korea is responsible. Tether's 2 November release says the same. On 29 October, TRM Labs attributed the theft to TraderTraitor, a North Korean hacking group, with high confidence.
North Korea denied involvement, according to Al Jazeera and Reuters. Binance said its investigation was continuing and that independent security firms would review it.
What does the Binance hack show about exchange risk?
Coins on an exchange are only as safe as the exchange's security and its promise to repay.
The previous record was the $1.5 billion theft from Bybit, another exchange, in February 2025, according to TRM. Our comparison of Bitcoin, Ethereum, and Solana covers the networks involved.
Binance said the loss stays with Binance, not its customers. As of 3 November, TRM counted about $2.4 billion of Bitcoin and ether still held by the thieves.
Get the next explainer
The Academy is free to read, here on the web. The Long Trend, our free weekly letter, comes by email.
Learn more with YX Insights
This explainer is part of the YX Insights Academy. Each one takes a single idea and checks it against real data.
The same approach runs through everything else we publish:
Systematic Portfolio: ready-made portfolios for Macro & Megacaps and for Commodities. We publish the holdings and every change.
Multi-model Signals: a daily long-or-flat call on every name we cover. Each call shows how strongly our four models agree.
Research: company deep dives, macro commentary and essays on how we test.
Good places to start on the website:
Academy: more explainers like this one.
Start here: get our free weekly letter by email.
Macro & Megacaps Systematic Portfolio and Commodities: the two portfolios in detail.
Track record: live results since 3 August 2026, plus the ten-year backtest.
Upgrade: get the Systematic Portfolio, Multi-model Signals and research in full.
Common questions about the Binance hack
How much did Binance lose in the hack?
About $6.34 billion, according to Binance's 3 November report. TRM Labs counted $6.36 billion, valuing each transfer at the price when it happened. Binance counted about $2.85 billion as frozen or intercepted. Frozen tokens are locked, not returned. Binance said it would cover the full loss itself.
Did Binance customers lose money?
Binance said no. Its 3 November report states that the exchange will absorb the financial impact of the stolen funds, not its users. It said 98% of the affected tokens had been replaced as of 31 October. These are Binance's own statements. We found no report from that review by 8 November.
Who hacked Binance?
Binance and Tether both cite the FBI as saying North Korea was responsible. TRM Labs attributed the theft to a North Korean hacking group called TraderTraitor on 29 October. North Korea denied involvement, according to Al Jazeera on 4 November. Binance said its own investigation is continuing.
Why could the Bitcoin and ether not be frozen?
Bitcoin and ether have no issuer, a company that controls the software, so they cannot be locked. TRM counted about $2.4 billion of them with the thieves on 3 November. The thieves also sold stablecoins for ether, which put that money beyond any issuer's reach too.
DISCLAIMER: This article is intended for educational purposes only. Any information or analysis in this note does not constitute an offer to sell or a solicitation of an offer to buy any securities. Nothing in this note is intended to be investment advice, nor should it be relied upon to make investment decisions. Any opinions, analyses, or probabilities expressed in this note are those of the author as of the note's date of publication and are subject to change without notice.
