Reports on 30 October 2026 put the Binance hack 2026 at about $6.3 billion taken from the exchange's wallets. If that figure holds, it is the largest crypto heist on record. TRM Labs counted about $6.36 billion across ten blockchains. Cyprus CASPs, EMIs and CySEC firms should treat the case as a custody and signing-control failure under MiCA.
Key takeaways
- Reports put the 30 October 2026 theft at about $6.3 billion. TRM Labs counted about $6.36 billion across ten chains. The half-hour window refers to valid signatures, not the dollar total.
- Deposits were restored. Withdrawals stayed paused for a withdrawal-service revamp Binance expected within 48 hours, with losses to be covered from SAFU and company funds.
- TRM Labs and Chainalysis link the theft to North Korean TraderTraitor, the cluster the FBI named in the $1.5 billion Bybit hack. No government has attributed this incident.
- Tether froze more than 1.567 billion USDT and Circle more than 800 million USDC. TRM said the attackers still held about $2.4 billion in ETH and BTC. Binance later said the breach went beyond one DevOps laptop.
What happened in the Binance hack 2026?
Binance’s security update, published early on 30 October, said the incident may involve a compromised DevOps engineer’s laptop that let an attacker into a service container and submit unauthorized withdrawal transactions. The exchange found no evidence of a wallet private-key leak and promised a technical post-mortem once the investigation is complete.
Binance suspended deposits and withdrawals, then restored deposits. Withdrawals stayed paused for a revamp of the withdrawal service and related addresses, expected within 48 hours.
Binance said it would cover every loss from the SAFU fund and company funds and that user funds were safe. An updated Proof of Reserves is promised after remediation. SAFU, the Secure Asset Fund for Users, is the exchange’s own reserve, not a regulated deposit-guarantee scheme.
Co-founder Changpeng Zhao thanked Tether and Circle for the quick freezes and said the signs pointed to a hack on Binance. He no longer manages the exchange and, as a shareholder, expected user losses to be covered. See why Cyprus crypto platforms need penetration testing.
Who do analysts blame, and how does this compare with Bybit?
TRM Labs attributed the theft with high confidence to TraderTraitor, the North Korean cluster the FBI named in the February 2025 Bybit hack of $1.5 billion. Chainalysis agreed. CEO Jonathan Levin put the figure at $6.4 billion and called a DPRK TraderTraitor link likely, citing links to previous hacks.
Both attributions are private-firm assessments, not a government finding on this incident. Binance said it was working with law enforcement to identify the attackers and named no agency. Co-CEO Richard Teng said the investigation had not attributed responsibility to any individual.
TRM counted about $6.36 billion leaving Binance wallets on ten blockchains, more than four times the $1.5 billion Bybit loss. The half-hour window in TRM’s note is separate: wallets using different key types and signing schemes produced valid signatures for the attackers within about half an hour.
Was it one laptop, or the hot-wallet signing path?
Binance’s first account stopped at the laptop and the container. A later update, posted on X on 30 October 2026 at 7:26 a.m. ET, said further investigation had uncovered additional breaches beyond that computer. The exchange called it a complex attack.
He stressed that the attacker did not simply use one engineer’s permissions and that this was not a single one-click action.
On Ethereum, TRM said the attackers took control of a Binance hot wallet using 50 authorizations signed in advance. Early indicators suggested the attacker had phished those authorizations. Phishing would explain Ethereum but not the other chains, which is why TRM assessed a compromise of Binance’s hot wallet signing infrastructure.
No private-key leak does not clear the withdrawal path: a session, an API credential, a pipeline secret, or a pre-signed authorization can still sign or queue a withdrawal.
If one host can still produce a valid signature, the quorum written in policy did not hold in production. An assumed breach assessment starts from the engineer’s laptop, not the internet edge.
How much was frozen, and what do the attackers still hold?
Circle CEO Jeremy Allaire said Circle, with law enforcement, froze more than 800 million USDC tied to the incident. Tether CEO Paolo Ardoino said Tether froze more than 1.567 billion USDT related to a potential Binance exchange hack.
By early 30 October, freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s Security Council reached about $2.7 billion. Binance said close to $3 billion had been frozen on-chain with partner help, and that the affected address authorization was revoked. The two totals come from different counters of the same freeze effort.
USDT and USDC can be stopped because the issuers blacklist an address on their own tokens. Bitcoin and ether have no issuer switch, so that slice of the theft stayed with the attackers. TRM said the attackers still held more than 420,000 ETH and 18,270 BTC, about $2.4 billion, and expects that balance to move through bridges, swap services and over-the-counter brokers.
What should Cyprus CASPs and EMIs test now?
MiCA, Regulation (EU) 2023/1114, has applied to crypto-asset service providers since 30 December 2024. It requires governance, ICT controls, safekeeping of client assets and recovery plans. Keeping treasury or settlement balances at an exchange puts incident handling and segregation on the EU firm that placed them there.
DORA, Regulation (EU) 2022/2554, applies from 17 January 2025 and puts ICT third-party risk and incident reporting on payment institutions and EMIs when a critical provider fails. Under NIS2, the clock starts when the firm becomes aware, not when the vendor delivers its final report. In Cyprus that notice goes to the Digital Security Authority.
- Hot-wallet signing needs independent approvers on separate hosts, and the approval screen must show destination and amount, not a hash alone.
- Engineer laptops, CI runners and vendor consoles that can reach a production container belong in an assumed breach test. Revoke live sessions, API keys, pipeline secrets and unused pre-signed authorizations.
- Alert when valid withdrawals hit several chains inside a short window.
- Screen inbound deposits against the address sets TRM Labs and Chainalysis publish for this theft, and keep the decision in the MiCA and CySEC record.
- If client assets sit at a third-party exchange, record who can pause withdrawals, who funds a shortfall, and whether that reserve is company money such as SAFU or a regulated scheme.
A MiCA and CASP penetration test should try the withdrawal service with one privileged session and with pre-signed approvals still live. Pair it with a CySEC ICT risk assessment so the file matches what supervisors ask for after an incident.
FAQ
How much was stolen in the Binance hack?
Published reports put the theft at about $6.3 billion, TRM Labs at about $6.36 billion on ten blockchains, and Chainalysis CEO Jonathan Levin at $6.4 billion. Binance has not stated the headline total in the updates quoted here.
Did Binance lose private keys?
Binance said it found no evidence of a wallet private-key leak. It later reported breaches beyond one laptop, and TRM Labs assessed a compromise of hot-wallet signing infrastructure, including 50 pre-signed Ethereum authorizations.
Who is behind the Binance theft?
TRM Labs and Chainalysis link the theft to TraderTraitor, the North Korean cluster the FBI named after Bybit. That is a blockchain-intelligence assessment. Binance has not named the attackers or assigned blame to any individual.
If one privileged session can still move client assets, put that path through a MiCA and CASP penetration test and file the result with your incident evidence.