On October 29th, attacks resulted in the withdrawal of funds from assets on multiple blockchains, prompting Binance to suspend withdrawals, while industry partners froze approximately $3 billion. The exchange has pledged to use over $6.34 billion to cover the losses.

Release:

Binance, the world's largest cryptocurrency exchange, suffered a loss of approximately $6.36 billion after an attack on October 29, 2026, making it the largest cryptocurrency theft case in history. The attackers withdrew around $6.36 billion from wallets distributed across 10 blockchain networks.

Blockchain activities first raised suspicion around UTC at around 20:00, when billions of dollars began to flow out of wallets associated with this world's largest cryptocurrency exchange. The majority of the capital outflow occurred within about 20 minutes.

This attack affected Binance’s wallets on Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche, and Polygon. Based on estimated losses, the scale of this incident is approximately four times that of the hack in February 2025 on Bybit, which resulted in a loss of 1.5 billion US dollars.

Binance initially acknowledged receiving reports of potential security issues and assured its customers that their funds were still safe. Subsequently, the exchange suspended withdrawals during the period when its security team was investigating the incident.

How did the Anbin hack occur?

An initial investigation by Binance revealed that the attacker may have compromised the laptop of an engineer with the username DevOps, accessed an internal service container, and submitted unauthorized withdrawal transactions.

However, the exchange later clarified that this attack involved multiple points of breach, and the process was more complex than simply intruding into the permissions of a single employee.

Richard Teng clarified that 'the attackers did not simply use the privileges of one engineer,' and this attack was not a 'click-and-go' one-click operation. [ https :// x.com /_RichardTeng/ status /2116072080525656150]

An independent investigation by blockchain analytics firm TRM Labs provided more technical details. The analysis indicates that the attackers may have compromised Binance’s hot wallet signing infrastructure, enabling them to initiate unauthorized transactions on multiple blockchains. On Ethereum, the attackers took advantage of a feature known as EIP-7702, which allows external wallet owners to delegate execution rights to smart contract code through signing authorization. The attackers prepared 50 pre-signed authorizations and used one of them to turn one of Binance’s hot wallets into a cleaner controlled by them. This allowed the attackers to drain the wallet and repeatedly collect incoming funds.

TRM also identified a preparatory phase that began at least 36 hours before the theft, which included test transactions and small withdrawals from Tornado Cash. Binance has not yet released a complete technical post-event report.

North Korea's TraderTraitor is suspected of being involved in this attack.

TRM Labs Based on on-chain and off-chain intelligence, this attack is attributed with a high degree of confidence to TraderTraitor, a hacker group believed to be associated with North Korea. The company pointed out that this attack shares similarities with previous attacks thought to be linked to North Korea, including the Bybit vulnerability exploitation in February 2025 and the KelpDAO incident in April 2026.

Blockchain investigator ZachXBT also reported that funds from the Anbin vulnerability exploitation incident and the previous $388 million Bitget vulnerability exploitation incident converged to the same address after going through THORChain.

This discovery indicates that the same attacker may have carried out both attacks. The Bitget incident is also attributed to TraderTraitor.

Tether, Circle and other partners freeze $3 billion

Stablecoin issuers and blockchain partners quickly took action to restrict the movement of stolen assets. Tether froze approximately $1.77 billion in USDT, while Circle froze about $825 million in USDC. Ripple also froze around $200 million, and World Liberty Financial froze $27.8 million in USD1.

The security committee of Arbitrum intervened separately, freezing 8,426 ETH and 74.6 million ARB, with a value of approximately 30 million US dollars.

By Friday morning, about $3 billion in stolen assets had been frozen, according to Binance. However, the attackers managed to convert some of the stolen stablecoins into assets that the issuers could not directly freeze. It is reported that the attackers exchanged approximately $325 million of USDT for ETH through market makers and decentralized trading infrastructure, at a significant discount. The attackers also supplied USDT to lending protocols, including Aave, in order to borrow ETH, which led to the freezing of affected markets by Aave.

TRM It is estimated that at that time, the attacker still controlled over 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion at the time of their assessment.

Binance promises to allocate $6.34 billion to cover all losses.

Binance has repeatedly assured its customers that they will not bear the financial consequences of this incident.

In the update on Friday, the exchange announced that it had reserved over $6.34 billion in company funds to cover this incident. According to the post, approximately $5 billion has already been made available in the same form of tokens that were affected by the hacker attack. Binance stated that it is purchasing the remaining assets through market and over-the-counter trading channels to match the balance of the stolen tokens and to make up for any shortfall. The exchange also confirmed that it will utilize its user security asset fund ( SAFU ) and company resources to cover the losses.

Binance has temporarily suspended withdrawals, revoked the authorization of affected addresses, and begun security improvements. Deposits can still be made as usual, and the exchange expects to resume withdrawals on November 1, 2026. The company also promises to release an updated version of its reserve certification after the repairs are completed.

The crypto market continues its downward trend, with liquidation volumes reaching $1.6 billion.

The Binance incident has brought further pressure to the already weak cryptocurrency market. Bitcoin fell by more than 5% following reports of an attack, trading around $76,500 at one point before rebounding to around $77,000. BNB has fallen by nearly 6% in the past 24 hours, while Solana has dropped by about 7% to $93.

According to CoinGlass, in the past 24 hours, approximately 245,721 traders were liquidated, with a total liquidation amount reaching 1.6 billion US dollars.

Long positions accounted for approximately $1.35 billion, which is 84.2% of the total liquidated amount, while short positions amounted to about $252.35 million. Binance had the highest proportion in exchange liquidations, exceeding 49% of all liquidations. The largest single liquidation order was a long position on Binance with the identifier BTCUSDT, valued at $11.09 million.

Market sentiment has also further deteriorated. The Fear & Greed Index for CoinMarketCap dropped from 46 (neutral) on October 28 to 38 on October 29, and then to 36 on October 30, sliding further into the fear zone.

What will happen next?

The Binance hack has raised thorny issues regarding the security of cryptocurrency exchanges, particularly their internal signing infrastructure and withdrawal approval systems. Although the exchange has pledged to allocate sufficient resources to cover the estimated losses, recovering the remaining stolen assets is another challenge. TRM Labs predicts that the attackers of Binance will continue to transfer funds through cross-chain bridges, exchange services, and over-the-counter brokers. After suffering a $388 million hack in September 2026, Bitget, the CEO of Gracy Chen, stated in the “Squawk Box Europe” program on CNBC that she “does not expect to recover much of the funds,” citing the limited success in recovering funds from previous hacks.

Binance reiterates that its current top priority remains to complete security improvements, provide a comprehensive explanation of how the attacker obtained access rights, and resume withdrawals by November 1st.

Read more content from SolanaFloor.

$ BTC holds at $80,000 while the Fed maintains interest rates unchanged Kamino support Backpack Securities mortgages

Solana vs . Hyperliquid : Where did I go wrong in Kyle Samani