Binance says about $6.3B was stolen and roughly $3B is frozen. TRM Labs and Chainalysis blame North Korea's TraderTraitor; Binance has not named a culprit.
Binance now says the hack it disclosed Thursday cost an estimated $6.3 billion, which would make it the largest crypto theft on record. The exchange says about $3 billion has been frozen on-chain and that it will cover all losses. Two blockchain analytics firms say North Korea's TraderTraitor hacking unit is responsible, though Binance has not named anyone. Details were still changing early Friday, Oct. 30, 2026, as of 7 a.m. ET.
What we know
This follows our earlier report on Binance pausing withdrawals, when loss estimates ranged widely. Engadget, citing The New York Times, reports the $6.3 billion figure comes from Binance itself. Binance says it will pay users back from its SAFU emergency fund and company money, and will publish an updated Proof of Reserves once repairs are finished, according to BleepingComputer. Deposits and withdrawals stay suspended during security checks.
The numbers and the suspects
TRM Labs says an attacker moved about $6.36 billion out of Binance wallets on 10 blockchains on Oct. 29, most of it in roughly 20 minutes starting at 20:05 UTC (4:05 p.m. ET). That is about four times the $1.5 billion Bybit theft in February 2025, the previous record. Chainalysis puts its own estimate lower, at about $5.91 billion, according to CNBC.
TRM attributes the attack to TraderTraitor with "high confidence," and Chainalysis says it reached a similar conclusion, according to BleepingComputer. These are private firms' assessments. Binance Co-CEO Richard Teng said the investigation "has not attributed responsibility to any individual."
On freezes, TRM says Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion in stablecoins. But the attacker reportedly sold and borrowed against some assets quickly and now holds more than 420,000 ETH and 18,270 BTC, roughly $2.4 billion that no issuer can freeze.
How it may have started, and what is unconfirmed
Binance says early findings suggest a compromised laptop belonging to a DevOps engineer let an attacker reach a service container and submit unauthorized withdrawals. Teng said it was a more complex attack than one click. Binance says it has found additional points of breach and has not yet seen evidence of a leaked wallet private key.
Still open: when withdrawals return, the final loss figure, and what this means for U.S. customers. The reports we read do not address Binance's U.S. affiliate. Freezing is not recovery, either. Chainalysis's Eric Jardine told CNBC returning frozen assets can take months or years.
Why it matters for U.S. readers
If you hold crypto on any exchange, this is a loud reminder that one company's promise to cover losses is only as good as its reserves. Fundstrat's Sean Farrell told CNBC he sees no meaningful solvency risk for Binance. That is one analyst's view, not a guarantee.
Our take: The laptop detail is the story to watch. A billion-dollar system that can be reached through one engineer's machine points to a process failure, not just a clever exploit. Until Binance publishes a full account, treat attribution and totals as working figures.
Related reading
Picture credit: Logo: Binance (public domain). Design: Savvy VibeZ
