The Binance hack drained about $6.36 billion from the world’s largest crypto exchange on 29 October 2026, and Binance says it has since covered about 95% of the impacted amount from company resources. Fintechbits counted the addresses in the FBI notice of 31 October: it lists 628 wallet addresses tied to the Binance hack, 608 on Ethereum, 19 on Bitcoin and one on Solana (FBI notice). The FBI attributes the theft to North Korea’s TraderTraitor group.

How the Binance Hack Unfolded

Blockchain analytics firm TRM Labs traced the outflows across ten blockchains, most of them in about 20 minutes from 20:05 UTC. TRM puts the total at approximately $6.36 billion valued at the moment each asset was taken, about four times the $1.5 billion Bybit theft of February 2025.

On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled, submitting 50 pre-signed authorizations in one transaction so that one would match the wallet’s moving transaction count. Wallets on nine other chains sent funds through ordinary signed transfers in the same window. TRM’s assessment is that the attacker gained control of Binance’s hot wallet signing infrastructure. Binance has not published a root cause and says a post-incident report will follow the investigation.

The FBI confirmed attribution for the Binance hack on 31 October, saying North Korea was responsible for the theft of more than $6 billion in virtual assets and that TraderTraitor actors were converting the proceeds mainly into ether.

Freezes Caught About $2.7 Billion

Stablecoin issuers moved fast after the Binance hack. TRM counts about $2.7 billion frozen onchain by the early hours of 30 October UTC: roughly 1.77 billion USDT frozen by Tether, about 825 million USDC frozen by Circle, 40.5 million RLUSD frozen by Ripple, 27.8 million USD1 frozen by World Liberty Financial and about $30 million in ETH and ARB moved by Arbitrum’s Security Council.

The rest of the Binance hack proceeds escaped issuer control. The attacker sold USDT to market makers at a discount of more than 10% and borrowed ether against USDT on Aave, and by TRM’s count still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach.

Fintechbits analysis

Why the Binance Hack Became a Balance Sheet Test

Binance’s response has been unusually quick. It reopened withdrawals in a first phase between 06:00 and 09:00 UTC on 1 November across 15 networks, from Bitcoin and Ethereum to Sui, and says it has covered about 95% of the impacted amount, up from about 90% in its previous update. The remaining 5% is in less liquid tokens outside its top ten assets. “Binance will bear the financial impact of the stolen funds. These losses will not be passed on to users,” the exchange said.

That promise is the centre of the Binance hack story, and it is a balance sheet test. An exchange able to replace roughly $6 billion within three days has deep reserves, and Binance has published a proof of reserves snapshot for its main assets. It also means the cost moved from users to Binance’s own capital, and the exchange has not said how much of that capital is left.

The stablecoin freezes are the other lesson. Issuers froze billions within an hour, which supports the argument that regulated dollar tokens can be policed. They also show how much power a handful of issuers hold over balances on public chains. Readers new to that mechanism can start with the Fintechbits explainer on how stablecoins work, and Ripple’s RLUSD, frozen in this incident, featured in Fintechbits’ coverage of Coinbase’s RLUSD listing.

The weak point in the Binance hack is the signing layer. If TRM is right that one actor obtained valid signatures for wallets on ten chains within hours, the failure sat in Binance’s internal key management, not in any blockchain.

Frequently asked questions

How much was stolen in the Binance hack?

TRM Labs counts approximately $6.36 billion taken from Binance wallets on ten blockchains on 29 October 2026, valued at the time of each transfer. The FBI describes it as more than $6 billion.

Who was behind the theft?

The FBI said on 31 October 2026 that North Korea was responsible, naming the activity TraderTraitor. TRM Labs reached the same attribution with high confidence based on onchain and offchain intelligence.

Will Binance customers lose money?

Binance says it will bear the financial impact and that losses will not be passed on to users. By 1 November it said it had covered about 95% of the impacted amount and restarted withdrawals in phases.

What to Watch Next

The post-incident report is the document that matters. Binance has promised one once its investigation ends, and it should say how signing access was obtained, whether TRM’s reading of a compromised signing system is correct, and how the replacement funds were split between reserves and Binance’s own capital. Regulators in the markets where Binance holds licences will read it closely too.