Binance $6.3 Billion Hack: Hot Wallets Drained in 20 Minutes

Attackers moved about $6.3 billion out of Binance hot wallets on October 29, 2026, most of it in roughly 20 minutes, according to TRM Labs. The Binance $6.3 billion hack is, above all, a failure of signing and withdrawal controls. The 36-hour rehearsal before the drain was the window to catch it.

What happened in the $6.3 billion Binance hack?

Starting around 4pm ET on Thursday, October 29, 2026, attackers drained roughly $6.3 billion from Binance hot wallets, the internet-connected wallets an exchange uses to pay out withdrawals. Most of it left in about 20 minutes. Wallets on at least ten blockchains, including Ethereum, Bitcoin, Tron and Solana, were emptied into addresses controlled by a single attacker.

The $6.3 billion figure is a tracing-firm estimate reported by WIRED, not an audited Binance number. Even so, it would be the largest crypto heist on record, roughly four times the $1.5 billion taken from Bybit, a theft the FBI attributed to TraderTraitor in 2025.

Ten chains failing at once does not mean ten blockchains have bugs. Every network accepts a correctly signed transaction, so whoever controls an exchange’s signing infrastructure produces only valid transfers. The question is who controls the keys, the signers and the approval policies.

How did the attackers rehearse the drain?

The attackers staged and tested the theft over at least 36 hours, according to a TRM Labs reconstruction:

• At least 36 hours before: preparation begins. One attacker wallet receives three small test withdrawals.
• Early October 29: an initial version of the attack code is deployed and tested on two wallets.
• Later that day: the final version is rehearsed on a third wallet, and the test funds are routed back to the attacker.
• Four hours later: the same code is installed on a Binance hot wallet.
• From around 4pm ET: the drain runs, and most funds are gone within about 20 minutes.

Elliptic’s chief scientist Tom Robinson says the attacker funded the wallet through the Tornado Cash mixer and rehearsed in advance, the same pattern seen in the Bybit theft.

Practitioner’s note. No human team stops a 20-minute, multi-chain burst. The three small withdrawals and the code tested hours earlier were the real window.

In wallet-infrastructure engagements, we often find monitoring tuned to large outflows that ignores tiny first-time withdrawals to new destinations, or approval-policy edits made outside change windows. Those alerts are cheap to build and cover the phase where a human can still act.

What has Binance confirmed, and what is still unknown?

Binance has confirmed three things. It suspended all deposits and withdrawals almost immediately. It will cover all losses. And its account of the intrusion has changed. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach,” the company said, adding that it is working with law enforcement.

Binance has not published a CVE, an affected product or a full access path. Robinson describes the starting point as a compromised engineer’s laptop, but nobody has explained how access moved from that endpoint to hot-wallet signing authority. That hop is the part other exchanges need to understand. Binance also declined to answer WIRED’s questions about North Korean attribution.

Why was only about half the stolen Binance crypto frozen?

Only stablecoins have an off switch. Early reports put the amount frozen by Binance and other crypto firms at roughly $3 billion. Elliptic’s later count is about $2.8 billion, or 44 percent of the total, nearly all of it stablecoins.

Issuers freeze tokens by denylisting addresses in the token contract. That blocks further transfers but does not return the assets, so frozen is not the same as recovered.

“The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson said. “It can only be stopped when it reaches an exchange or other service.” He does not expect the frozen share to rise much further.

Chainalysis reports “laundering patterns we have not seen before,” with thousands of rapid transactions that suggest automation built to obscure the trail. Any service that might receive this money needs fast screening.

A freeze request that gets acted on quickly names the chain, asset contract, transaction hash, destination address, amount and UTC time. Have that template ready.

Is TraderTraitor behind the Binance hack?

TRM Labs and Chainalysis both name TraderTraitor, a North Korea-linked subgroup, as their leading hypothesis, based on on-chain and off-chain activity. Neither Binance nor any law enforcement agency has publicly said so.

Chainalysis says its strongest evidence came from watching stolen Binance funds commingle in real time with proceeds of the previous month’s Bitget exploit, already attributed to North Korean actors.

Elliptic stops at the country level. “We think North Korea is likely responsible. If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date,” Robinson said. He adds that targeting crypto company staff is a TraderTraitor hallmark.

Sophos’s Rafe Pilling says the group goes after larger operations: “These folks in particular are somewhat artists in terms of getting into these distributed finance organizations.”

The group has historically built fake applications to get inside targets, and US government advisories describe trojanized crypto apps and fake recruiter approaches aimed at developers and operations staff. None of this is confirmed as the Binance entry point, but it is the pattern worth testing against.

What should Cyprus CASPs and EMIs review after this?

Start with who, and what, can move hot-wallet funds. Cyprus hosts a dense cluster of CySEC-supervised crypto firms, which is why Cyprus crypto platforms need penetration testing as much as banks do. Those licensed as CASPs under MiCA count as financial entities under DORA, in force since January 17, 2025.

Covering customer losses does not stop the reporting clock. DORA requires firms to classify ICT incidents and report major ones to the competent authority. Entities in scope of NIS2 face a 24-hour early warning, a 72-hour notification and a final report within a month; check the deadlines in Cyprus’s national transposition.

Five questions for the next risk committee:

• Withdrawal authority: What is the signer quorum? Do large moves require out-of-band approval? Is the hot-wallet balance capped to a day of real withdrawals?
• Test-transaction detection: Do you alert on tiny or first-time withdrawals, new destinations, allowlist or approver changes, and off-window signing, on every chain you support?
• Signer endpoints: Are EDR, MDM, browser extensions, remote-access tools, hardware-backed admin MFA, and withdrawal API permissions and IP restrictions under review?
• Developer targeting: Would your engineers complete a fake recruiter’s “coding test” or install a trading tool shared in a chat app? A social engineering assessment aimed at developers answers that with evidence.
• Evidence and freezes: Will you preserve laptops, IdP sessions, HSM or KMS logs, wallet-policy logs and CI/CD artifacts before rebuilding? Are stablecoin issuer contacts ready?

Perimeter scans do not exercise the controls that separate a legitimate withdrawal from an authorized-looking theft. A MiCA and CASP penetration test should cover withdrawal-policy bypass, transaction substitution, signer session theft and approval-workflow weaknesses. Red team operations that start from a compromised developer laptop test the exact chain Binance is still reconstructing.

FAQ

How much was stolen in the Binance hack?

About $6.3 billion from hot wallets on at least ten blockchains on October 29, 2026, according to tracing-firm estimates reported by WIRED. Binance has not published an audited figure.

Who is behind the Binance $6.3 billion theft?

TRM Labs and Chainalysis name North Korea's TraderTraitor as their leading hypothesis, and Elliptic says North Korea is likely responsible. Neither Binance nor law enforcement has publicly attributed the attack.

How much of the stolen Binance crypto was frozen?

About $2.8 billion, or 44 percent, almost all stablecoins, per Elliptic. A freeze blocks transfers but does not return funds to the victim.

Can bitcoin stolen from Binance be frozen?

No. Bitcoin, ether and XRP cannot be frozen at the protocol level; they can only be stopped when they reach an exchange or another service that screens deposits.

If your firm holds client crypto in hot wallets, we can start from a compromised laptop and measure whether it reaches your signing path before someone else tries. See our assumed breach assessment.