Binance hack explained: what the $6.3bn theft shows about custody

Key takeaways

• On 29 October 2026 attackers drained about $6.3bn (TRM Labs estimate; Elliptic puts it at $6.43bn) from Binance hot wallets across ten blockchains in roughly 20 minutes. The FBI attributes the theft to North Korea's TraderTraitor group. It is the largest crypto theft by dollar value on record.
• Preliminary findings point to a compromised engineer's laptop and signing processes, not broken cryptography. Binance has not yet published a final post-mortem.
• Binance says it is absorbing the loss from its SAFU emergency fund and company resources; it reported about 95% of affected assets replenished by 1 November, when withdrawals began resuming in phases.
• Tether and Circle began freezing stolen stablecoins within about an hour, by their own accounts. Elliptic counted roughly $2.85bn frozen or seized as of 2 November.
• The incident is a reminder that an exchange balance is a claim on a company that holds everyone's funds in one shared pool. Non-custodial designs, where you keep your own keys, remove that pool.

What happened in the Binance hack?

On the afternoon of 29 October 2026 (US Eastern time), assets began leaving Binance's hot wallets, starting on the XRP Ledger and then Ethereum and Bitcoin. According to TRM Labs, about $6.36bn left across ten blockchains, most of it within roughly 20 minutes.

The largest share was on Ethereum (about $3.8bn), followed by 18,270 BTC (about $1.5bn), $628m on TRON, $296m on the XRP Ledger and $96m on Solana. Estimates differ slightly by firm: TRM gives about $6.3bn, Elliptic $6.43bn.

That is roughly four times the $1.5bn taken from Bybit in February 2025, the previous record. Binance founder Changpeng Zhao noted that Mt. Gox lost more bitcoin by volume, so the accurate description is the largest crypto theft by dollar value.

Timeline

• 24 September 2026. Bitget loses about $388m from hot and warm wallets in a separate incident.
• 29 October. The roughly 20-minute drain; Tether and then Circle begin freezing linked wallets within the hour; Binance suspends withdrawals.
• 30 October. Binance says it will cover all losses and has reserved more than $6.34bn; TRM attributes the attack to TraderTraitor with "high confidence"; Abu Dhabi's Financial Services Regulatory Authority (FSRA) issues a statement.
• 31 October. The FBI attributes the theft to North Korea; Binance reports 90% of losses replenished and takes a proof-of-reserves snapshot.
• 1 November. Withdrawals begin resuming in phases; Binance reports about 95% replenished.
• 2 November. Tether says it froze more than $1.5bn in USDT; Binance publishes a proof of reserves for ten tokens.
• 3 November. A further withdrawal phase is scheduled; no final post-mortem has been published.

How the attack worked (preliminary findings)

Everything in this section is preliminary and may change once investigations conclude. Binance's initial investigation pointed to a compromised laptop belonging to a DevOps engineer. The attacker reportedly used it to reach a service container and submit unauthorised withdrawals; Binance later said it had found "additional points of breach", according to Khaleej Times.

TRM Labs says the attacker used 50 pre-signed authorisations under EIP-7702, an Ethereum feature that lets a wallet delegate execution to a smart contract. These were likely obtained through phishing, as reported by Forbes.

Binance says it found no evidence that any wallet private key leaked. The withdrawals carried valid signatures, which suggests the attacker directed the signing infrastructure rather than breaking the cryptography. In short, the maths held; operational processes around it did not.

Were Binance users' funds lost?

Binance says users will not bear the loss. It reserved more than $6.34bn of company funds and said it was drawing on SAFU (its emergency user fund), its futures insurance fund, a bitcoin reserve and its corporate treasury to buy back the affected tokens.

Replenishment was reported at 80% on 30 October, 90% on 31 October and about 95% on 1 November. The remaining share consists of less liquid tokens that Binance says it is still sourcing.

Withdrawals began resuming in phases on 1 November, covering 15 networks in the first phase. On 2 November Binance published a proof of reserves for ten tokens, based on a 31 October snapshot. A snapshot shows holdings at one moment; it is not a continuous audit.

The Tether and Circle freezes, and why they matter

Tether said on 2 November that it froze more than $1.5bn in USDT tied to the attack. Circle froze about $823m in USDC. According to Elliptic, as reported by Decrypt, about $2.85bn, or 44% of the haul, was frozen or seized, compared with roughly 3% after the Bybit hack.

The freezes were not instant. About $786m in stablecoins was swapped, borrowed against or traded before they took effect, much of it into ETH and TRX. The bitcoin portion cannot be frozen by an issuer at all.

The same power cuts both ways. A stablecoin issuer can block any address it links to wrongdoing, which helped here, but it also means a USDT or USDC balance in a self-custody wallet can be frozen. That is an issuer-level control that no wallet type removes.

Why do exchange hacks keep happening?

A centralised exchange pools customers' assets in wallets it controls. Most sit in cold storage, but hot wallets must stay online to process withdrawals, and they are reachable through the people, laptops and software that operate them.

• Bybit, February 2025. About $1.5bn, also attributed to TraderTraitor.
• Bitget, September 2026. About $388m, after a flaw in a third-party security product gave access to internal credentials and fake withdrawal commands were injected into the wallet backend.
• Binance, October 2026. About $6.3bn, with an engineer's laptop and pre-signed authorisations reported as the entry points.

The pattern is the same: one large pool of funds, reached through operations rather than through the blockchain itself. In the UAE, the FSRA said it was "engaging closely with Binance and monitoring the incident". As The National noted, supervisory rules on technology governance, cybersecurity, safeguarding and incident response set expectations, but they do not rule out losses.

Custodial vs non-custodial: why the design matters

BlockX is building a non-custodial P2P marketplace, so we have an interest in this distinction. With a custodial exchange, you hold an account balance; the exchange holds the keys. With self-custody, you hold the keys yourself.

The three incidents above share one root cause. Bybit, Bitget and Binance each held their customers' assets in wallets the company controlled, so a single breach of the company's operations reached a pool worth hundreds of millions or billions of dollars. A prize that size is exactly what attracts state-backed groups such as TraderTraitor.

Non-custodial design removes that pool. You keep your own keys, and in a non-custodial escrow each trade's crypto is locked in a smart contract dedicated to that trade, released only by the contract's rules rather than from an employee's laptop or a company server. There is no central wallet holding every user's funds, so there is no single point whose compromise reaches everyone at once. The route used against Binance, a compromised workstation driving a withdrawal pipeline, has no equivalent target to aim at.

Holding your own keys does ask for good habits, and the tools for them are mature:

• Multisignature and hardware signing. Requiring two or more keys, each on a separate hardware wallet, means a single phished approval is no longer enough to move funds. Combined with readable transaction previews, and a rule never to approve delegations you do not understand (including EIP-7702 authorisations), it makes the technique reported in the Binance attack far harder to repeat.
• Escrow code anyone can inspect. Well-built escrow contracts are published on-chain and independently audited, so the rules that lock and release funds can be checked by anyone rather than taken on trust.
• Keys you can back up. A recovery phrase kept offline, and hardware wallets bought directly from the manufacturer, guard against loss and tampering. The October 2026 case of a Ledger device fitted with an implant and sold through the unofficial reseller CryptoBilis shows why the second point matters.
• Escrow on the crypto side, checks on the bank side. In a P2P trade the crypto stays locked until the seller confirms the bank payment has arrived. Checking that payment in your own banking app, never from a screenshot, covers the part of the trade that happens off-chain.

Stablecoin freezes also work in users' favour here. Tether and Circle froze more than $2.3bn of the stolen USDT and USDC within about an hour, by their own accounts. That issuer-level protection applies to USDT and USDC wherever they are held, including in self-custody wallets and escrow contracts.

The lesson of 29 October is not that crypto is too risky to hold. It is that concentrating everyone's keys in one place creates a target worth billions. Keeping your own keys, with sensible safeguards, takes that target away.

What to do if you hold funds on an exchange

1. Treat the balance as a claim. Keep on any exchange only what you need for active trading, and know who controls the keys.
2. Use official channels only. After a major hack, fake "compensation" or "account verification" messages are common. Check announcements in the app or on the exchange's own site.
3. Read proof-of-reserves reports for what they are. They are dated snapshots, useful but not proof of future solvency.
4. If you move funds to a wallet, test first. Send a small amount, confirm the network matches, and buy hardware wallets directly from the manufacturer.
5. Review every signature request. Do not approve delegations or permissions you do not understand, and revoke old approvals you no longer use.
6. Keep records. Save statements and transaction IDs in case of disputes or tax questions.

Related guides

• Non-custodial vs custodial crypto: what's the difference?
• What is self-custody in crypto?
• How to check if a USDT address is blacklisted

This article is general information and is current as at the date shown above. Facts about the Binance incident are preliminary and this article will be updated as investigations conclude. Figures cited are snapshots from the sources listed and change over time. Nothing here is legal, tax or financial advice, and nothing on this website constitutes a financial product offer or solicitation.