The night Binance lost over $6 billion
On 29 October 2026 Binance suffered the largest crypto theft on record: about $6.3 billion by Binance's own estimate. What happened, what Binance, CZ, Tether and Circle said, and what remains unconfirmed.
On Thursday 29 October 2026, in the early afternoon, reports of large outflows from Binance-linked wallets began to appear on X. Binance is the world's largest exchange. Over the following hours it became clear this was not an anomaly: by Binance's own estimate the loss is about $6.3 billion. It is the largest crypto theft on record. This article sets out what is confirmed, what is estimated and what remains to be proven. Figures come from different sources and do not match.
The numbers, and why they differ
Binance puts the stolen assets at about $6.3 billion. Arkham saw the attacker's wallets hold, at one point, over $5.7 billion, including nearly $1.5 billion in bitcoin, $900 million in ether, roughly $1.5 billion in USDT and over $800 million in USDC. Chainalysis revised its estimate to about $5.9 billion at the time of the theft. In the first hours, estimates on X ranged from $2 billion to $8 billion. According to DefiLlama, cited by CoinDesk, Binance held about $144 billion in assets, so the stolen amount is roughly 4%. Its SAFU emergency fund, in place since 2018, holds about $1 billion in bitcoin.
What Binance says
In a post on X, Binance wrote that its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to access a service container and submit unauthorized withdrawal transactions. In the same message: "We have found no evidence of any wallet private key leak." Binance suspended deposits and withdrawals while teams run security checks, freeze funds and work with law enforcement, and promised to cover all losses. Changpeng Zhao, the founder, wrote: "User funds are safe," and "I don't manage Binance anymore, but as a shareholder, I expect all user funds will be fully covered." Co-CEO Yi He said the platform would cover all hacking losses; CZ thanked her for working through the night. According to CoinDesk, every transfer carried a valid signature from Binance-controlled addresses, which is consistent with access to the signing path rather than a leaked key. Binance has not yet published a full technical analysis.
Where the funds went
According to CoinDesk's on-chain tracing, at 20:20 UTC on Thursday Binance's hot wallet sent over 18,270 BTC, about $1.4 billion, to a single address in 11 transactions, all in block 973,732. The coins were split across 19 wallets: seventeen holding exactly 1,000 BTC, one holding 832.5 and one holding 437.7. As of 04:23 UTC on Friday, none of them had moved a single coin. Bitcoin has no issuer that can freeze it: it can only be stopped when it reaches an exchange, an over-the-counter desk or a swap service. Stablecoins are different. Tether's Paolo Ardoino said the company froze over $1.57 billion in USDT, and Circle's Jeremy Allaire said over $800 million in USDC. Binance spoke of about $3 billion frozen; other sources report $2.54 billion, and tracing is ongoing. The attacker also borrowed at least 20,000 WETH, about $44 million, on Aave using stolen USDT as collateral.
Who is behind it: attributions, not confirmations
Nobody has claimed the attack and Binance has not named a culprit. TRM Labs attributed it, with "high confidence," to TraderTraitor, a North Korean unit already linked to the $1.5 billion Bybit theft in February 2025. ZachXBT pointed to Lazarus as the likely attacker. Ido Ben-Natan, CEO of Blockaid, said the tactics and level of sophistication are consistent with operations attributed to North Korea. Fortune notes that there is no definitive proof yet. These are authoritative hypotheses, not a finding.
The market
On Thursday evening bitcoin fell 4.8% to below $77,000, ether 5.7%, BNB 8% and AAVE 11%. On Friday morning Fortune reports declines of around 3%, in the context of a wider sell-off in financial markets.
What follows from it, in my view
This is my own analysis, not a reported fact. If Binance's account holds, the attack did not break cryptography or steal a key: it reached the path that uses it. For anyone designing systems that hold assets, the point is there: who can start a withdrawal, from which workstation, under which limits and with which independent second approval. An administration workstation that reaches all the way to withdrawals is a single point of failure, however well the key itself is protected.
If one laptop can reach your withdrawals, what stands in between?