⏱️ Reading time: 9 min
Binance lost $6.3 billion in cryptocurrency in just 20 minutes on the afternoon of October 29, 2026, in what crypto tracking firms are already calling the largest theft in the sector’s history. The Binance hack drained hot wallets across at least ten different blockchains before the exchange managed to react.
📑 En este artículo
Binance immediately suspended deposits and withdrawals while it investigated, and says it froze roughly half of the funds together with other companies. Three blockchain intelligence firms point to the same suspect: hackers linked to North Korea.
TL;DR
- Hackers stole $6.3 billion from Binance on October 29, 2026, in just 20 minutes.
- The attack drained hot wallets across at least ten blockchains, including Ethereum and Bitcoin.
- TRM Labs, Chainalysis, and Elliptic link the theft to the North Korean group TraderTraitor.
- Crypto firms managed to freeze about $2.8 billion, 44% of the total stolen.
- A compromised engineer’s laptop was reportedly the initial point of entry, according to Binance.
What Is Binance
Binance is the world’s largest cryptocurrency exchange by trading volume, founded in 2017 by Changpeng Zhao, and the platform hit by the October 29, 2026 Binance hack. It runs internet-connected hot wallets across more than ten blockchains, including Ethereum, Bitcoin, Tron, and Solana.
The exchange processes thousands of transactions daily across hundreds of cryptocurrencies and keeps those hot wallets running to provide instant liquidity for user withdrawals. That same permanent internet connection is what turned those wallets into the attack’s target.
What Happened in the Binance Hack
On October 29, 2026, around 4 p.m. Eastern Time, attackers began draining Binance’s hot wallets across at least ten different blockchains, including Ethereum, Bitcoin, Tron, and Solana. According to an analysis by TRM Labs, most of the $6.3 billion left in a window of just 20 minutes, spread across multiple addresses controlled by the same attacker.
Almost immediately, Binance suspended all deposits and withdrawals on the platform while it investigated the incident, and confirmed in a statement that it is working with authorities to identify those responsible. The company said that, together with other firms in the sector, it managed to freeze about half of the stolen funds before the attackers could move them or attempt to convert them into fiat currency.
In a later statement, Binance explained that its initial investigation pointed to a compromised laptop belonging to a company engineer, though it clarified that it found additional breach points as the forensic analysis progressed. “This was a complex attack, and we are doing everything we can in coordination with authorities to resolve it,” the company said in its statement.
Context: North Korea’s Escalating Crypto Thefts
The hack didn’t come out of nowhere. For years, various North Korean hacker groups have attacked exchanges and decentralized finance protocols to fund the regime, which operates under severe international sanctions. Within that ecosystem, a subgroup known as TraderTraitor has specialized in infrequent but extremely high-profile heists.
The most cited precedent is the $1.5 billion theft from the Bybit exchange in 2025, which the FBI publicly attributed to TraderTraitor. The group was also linked to the theft from the Bitget exchange last month, in September 2026, according to Chainalysis. That pattern (attack, launder the funds, then resurface months later against a bigger target) is consistent with what happened at Binance.
“We believe North Korea is probably responsible,” Tom Robinson, co-founder and chief scientist at Elliptic, told Wired. “If North Korea is behind this, this theft would nearly double everything the regime has stolen in crypto to date.”
Technical Details: How the Cyberattack on the Exchange Worked
What sets this incident apart isn’t just the amount, but the preparation. According to TRM Labs, the attacker began preparing the heist at least 36 hours before the theft. One of their wallets received three small withdrawals during a test period, before the operation scaled up.
On the morning of October 29, according to the same firm, the attacker deployed an initial version of the attack code and tested it against two wallets. Later that same day, they rehearsed the final version against a third wallet and returned those test funds to their own account. Four hours after that rehearsal, they installed the same code on a real Binance hot wallet, and the drain was underway.
sequenceDiagram
participant A as Attacker
participant W1 as Test wallet
participant W3 as Final rehearsal wallet
participant H as Binance hot wallet
A->>W1: small test withdrawals
A->>W3: rehearses the final code
W3-->>A: returns the test funds
Note over A,H: four hours after the rehearsal
A->>H: installs the code in production
H-->>A: drains funds in 20 minutesThe tactics described match TraderTraitor’s history, which, according to Sophos threat researcher Rafe Pilling, usually targets large decentralized finance organizations. “These people are, in a way, artists when it comes to getting into these distributed finance organizations,” Pilling told Wired. “In the past, they developed their own fake applications and used them to get in.”
Elliptic added a detail about the attack’s prior funding: the attacker reportedly funded their initial wallet through Tornado Cash, the cryptocurrency mixer sanctioned by the U.S. Treasury, and reportedly rehearsed the heist in advance, the same pattern seen in the Bybit case.
There is no direct way to verify from the outside the exact figures of frozen funds at any given moment: the numbers change as the investigation progresses and come from the public dashboards that each tracking firm (TRM Labs, Chainalysis, and Elliptic) updates independently.
| Firm | What It Reported | Attribution |
|---|---|---|
| TRM Labs | At least 36 hours of preparation and rehearsal across three wallets before the theft | Indicators consistent with TraderTraitor |
| Chainalysis | Funds mixing in real time with the proceeds of the September Bitget hack | Direct link to TraderTraitor |
| Elliptic | About 44% ($2.8 billion) frozen; initial wallet funded via Tornado Cash | Overlaps with TraderTraitor, no official confirmation |
Impact and Analysis After the Binance Theft
Binance publicly stated that it will cover all losses stemming from the incident, something no law requires an exchange to do, but that the company had already done in smaller previous incidents to maintain user trust.
The harshest fact, however, is how much of what was stolen is unrecoverable. Only assets issued by centralized companies, such as stablecoins, can be frozen at the request of the issuing firms. Native cryptocurrencies of a public blockchain, once they reach a wallet the attacker controls, have no reversal button: no one can reverse a confirmed transaction on Ethereum or Bitcoin without the consent of the entire network.
Chainalysis also described money laundering patterns “we hadn’t seen before,” with thousands of transactions processed within minutes, suggesting the use of automation to make tracking the remaining funds harder, a good portion of which still circulates unfrozen.
⚠️ Heads up: a tracking firm pointing to a group is not the same as an official attribution. Neither Binance nor U.S. authorities had publicly confirmed a link to North Korea at the time this article was written.
What’s Next
Binance still has deposits and withdrawals suspended while it wraps up its forensic review, and it has not yet published a timeline for fully restoring the service. The company also has not publicly responded to whether it believes North Korean hackers are behind the attack, limiting itself to referring to its official statement.
For the rest of the industry, the case once again puts the spotlight on hot wallets as the weakest point of any large exchange. Unlike cold storage, which stays disconnected from the internet, a hot wallet needs to be online to operate, and that exposes it at all times. It’s likely that other exchanges will review their own access controls for these wallets after seeing the size of this heist.
It also remains to be seen whether the United States or another country formalizes an official attribution, something that in the Bybit case took weeks after the initial theft.
Try it yourself: check Binance’s official statement before moving funds on the platform and confirm there when deposits and withdrawals are fully reactivated.
Frequently Asked Questions
What was the October 2026 Binance hack?
It was the theft of $6.3 billion in cryptocurrency from Binance’s hot wallets, carried out in a 20-minute window on October 29, 2026, with funds spread across at least ten different blockchains.
Who is behind the Binance theft?
Three tracking firms, TRM Labs, Chainalysis, and Elliptic, point with varying degrees of confidence to TraderTraitor, a hacker group linked to North Korea. Neither Binance nor authorities have officially confirmed that attribution.
How much money was recovered after the cyberattack on the exchange?
According to Elliptic, about 44% of the total, roughly $2.8 billion, was frozen, almost all of it in stablecoins. The rest is in native cryptocurrencies that, once moved, are very difficult to recover.
Will Binance cover its users’ losses?
Yes. Binance publicly stated that it will absorb all losses stemming from the incident, though it did not detail a payment timeline or the exact compensation mechanism.
What is TraderTraitor?
TraderTraitor is a subgroup within North Korea’s hacking apparatus, specialized in infrequent but extremely high-value attacks against exchanges and decentralized finance platforms, such as the $1.5 billion theft from Bybit in 2025.
Can you trust the hot wallets of an exchange like Binance?
Hot wallets are necessary for processing instant withdrawals, but their permanent internet connection makes them more vulnerable than cold storage. Most large exchanges combine both schemes to spread the risk.
References
- Wired: original report on the Binance hack and the tracking firms that analyzed it.
- TRM Labs: on-chain analysis of the theft, the 20-minute window, and the attack’s prior preparation.
- Elliptic: estimate of the percentage of frozen funds and the possible link to Tornado Cash.
- Chainalysis: money laundering patterns detected and the link to the September 2026 Bitget hack.
📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.
Featured image: Foto de Pierre Borthiry – Peiobty en Unsplash
Did it work for you? Got a different error? Say so below: questions get answered and help the next reader.
Leave a comment
0 Comments