Binance Reports a $6.3 Billion Security Incident: What Happened

On October 29, 2026, starting around 20:05 UTC (about 3:05 p.m. Central), roughly $6.3 billion in crypto left Binance hot wallets across about ten blockchains, most of it within about 20 minutes. Binance's October 30 update puts the estimated impact at around $6.3 billion. TRM Labs counts about $6.36 billion; Chainalysis says about $6.4 billion. As of those reports, it is the largest crypto theft on record.

The short version: Binance says a compromised DevOps engineer's laptop may have let an attacker reach a service that could submit withdrawals. About $3 billion is frozen on-chain as of Binance's October 30 update. Binance says it will cover all losses. Investigators at Chainalysis and TRM Labs attribute the theft to North Korea's TraderTraitor group; Binance and the FBI have not named anyone. No investigator has linked AI to the theft.

What Binance has said

In its Security Incident Update dated October 30, 2026, Binance said its initial investigation suggests the incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. Binance said it has found no evidence of any wallet private key leak, and that it will publish a detailed technical post-mortem once the investigation is complete.

As of that update, Binance reported about $3 billion frozen on-chain after working with blockchain partners. It said it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds, that user funds are safe, that deposits remain unaffected, and that it temporarily suspended withdrawals while security checks continue. It also said it has revoked the affected address authorizations and engaged law enforcement and blockchain intelligence partners.

What blockchain investigators report

TRM Labs says an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC on October 29. Chainalysis places the start around 4:20 p.m. Eastern that day and puts the total at about $6.4 billion.

Both firms attribute the theft, with high confidence, to TraderTraitor, a North Korean cybercrime group. Chainalysis says stolen Binance funds later mixed on-chain with funds from a Bitget theft already attributed to North Korea. As of November 1, 2026, Binance and the FBI have not publicly named a responsible party.

Frozen totals differ slightly by source and timing. Binance's October 30 update cites about $3 billion. Chainalysis has reported about $2.8 billion frozen; TRM Labs has reported roughly $2.7 billion from stablecoin freezes (including action by Tether and Circle) plus other freezes. Figures above are as of each organization's published report around October 29–30, 2026.

AI was not linked to this theft

Goncalo Magalhaes, head of security at Immunefi, told The National there is no sign AI was used in this incident. Separately, Chainalysis has disclosed its own intrusion involving AI agents and has said that matter is unrelated to the Binance theft.

What businesses can take from this

This was an exchange hot-wallet incident, not a flaw in the underlying blockchains. The reported path in was a compromised employee device that reached software able to authorize withdrawals. That pattern matters for any organization that lets staff devices reach systems that move money, approve payments, or hold credentials.

1. Treat admin and payment laptops as high-risk. Limit which devices can reach signing, treasury, banking, or payment systems, and require strong multi-factor sign-in.
2. Separate who can propose a payment from who can approve it. A single compromised session should not be enough to move funds.
3. Watch for unusual withdrawals or transfers. Short windows matter; Binance's transfers largely finished within about 20 minutes.
4. Keep endpoint protection and patching current on any machine that can reach financial or infrastructure controls.

Questions to ask your IT provider

1. Which employee devices can reach systems that move money, approve payments, or hold privileged credentials?
2. Do those systems require a second person or a separate device to approve transfers?
3. How quickly would we notice an unusual withdrawal or transfer, and who is on call to stop it?