October 30, 2026 | TickerRoast Markets Analysis
Binance, the world’s largest cryptocurrency exchange, suspended deposits and withdrawals on Thursday evening after attackers drained about $6.3 billion from its wallets across ten blockchains. Blockchain analytics firm TRM Labs attributes the theft to North Korea. Binance says it will cover all losses, and stablecoin issuers have frozen about $2.7 billion, but more than $2 billion remains out of reach.
Twenty Minutes, Ten Blockchains
According to a detailed reconstruction by TRM Labs, an attacker moved approximately $6.36 billion out of Binance wallets on Oct. 29, most of it in about 20 minutes starting at 20:05 UTC. Wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and other networks sent their balances to addresses controlled by a single attacker, with a second wave reaching Binance wallets on Avalanche and Polygon around 23:05 UTC. TRM values each transfer at the price of the asset when it was taken.
Binance itself put the total at about $6.3 billion, according to Al Jazeera, which reports that the exchange suspended all deposits and withdrawals and described the event as a security incident. That would make it the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
| Network | Assets taken (TRM Labs estimate) |
|---|---|
| Ethereum | About $3.79B, incl. 200,630 ETH, 1.875B USDT, 823M USDC |
| Bitcoin | 18,270 BTC, about $1.47B |
| Tron | 612.7M USDT and 46.4M TRX, about $628M |
| XRP Ledger | 233.46M XRP, about $296M |
| Solana | 970,500 SOL, about $96M |
| Arbitrum, Optimism, Base, Avalanche, Polygon | About $77M combined |
How the Attackers Got In
Binance’s initial explanation, as reported by Al Jazeera, is that a hacker gained access to an engineer’s compromised laptop and used it to make unauthorized transactions. The exchange said it would publish a detailed technical post-mortem once its investigation is complete.
TRM’s on-chain analysis points to something broader. On Ethereum, the attacker used an EIP-7702 delegation, prepared with 50 pre-signed authorizations, to turn one of Binance’s best-known hot wallets into a sweeper it controlled, then emptied it of 167,464 ETH and 1.615 billion USDT in one transaction. On the other chains, Binance wallets with different key types and signing schemes sent funds through ordinary signed transfers within about half an hour. In TRM’s assessment, the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing. TRM says preparation began at least 36 hours earlier, with small withdrawals from Tornado Cash funding the operator wallet.
North Korea, Again
TRM attributes the attack with high confidence to TraderTraitor, the North Korean hacking unit the FBI named as responsible for the Bybit theft. It cites matching techniques from earlier heists, including staging well before the theft and signatures obtained in advance and executed in one burst. Ari Redbord, TRM’s global head of policy, told Al Jazeera that theft at this scale funds weapons proliferation, making it a global security issue rather than just a crypto crime. Binance has not publicly attributed the attack and says it is working with law enforcement.
The Race to Freeze the Funds
The response was faster than in past hacks. TRM reports that Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion of stablecoins, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for a total of roughly $2.7 billion. Tether froze 971.1 million USDT in the main receiving wallet 37 minutes after the main sweep. The attacker tried to stay ahead by selling USDT to market makers and borrowing ETH against USDT on the lending protocol Aave. TRM says it now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion in assets beyond any issuer’s reach.
The chart shows bitcoin’s daily price since early July, with the latest candle at about $77,994 on Oct. 30. The hack-day candle broke below both the 20-day average near $81,350 and the 50-day average near $81,900, which had converged during October, and the RSI has fallen to about 37. Bitcoin is still well above the $63,000 area where it traded through July and early August, before its late-summer breakout.
Market Fallout
Prices reacted quickly. Al Jazeera reports that bitcoin fell about 5% after the theft, dropping below $77,000, while investingLive reports bitcoin near $77,700 in Asian trading and BNB, Binance’s own token, down 8.6% to near $694. The hack also landed on a weak day for risk assets in general, with Nasdaq futures down after disappointing results from Amazon and Intel.
Binance’s promise to cover all losses matters more than the price move. According to Al Jazeera, the exchange holds about $155 billion of assets, citing CoinMarketCap, which suggests it can absorb a net loss in the low single-digit billions once frozen funds are recovered. The real test will be the reopening of withdrawals. Binance has given no timeline, and a long suspension would be the clearest sign of trouble, because customers who cannot withdraw are exactly the ones most likely to leave once they can.
A Question of Custody
For me, the broader lesson concerns centralized custody. Sean Foley, a crypto markets specialist at Macquarie University, told Al Jazeera that assets held at a centralized exchange are only as safe as the exchange itself, and that the larger its holdings, the larger a target it becomes. The speed of the stablecoin freezes shows that the industry now has tools to limit damage, but they only work on tokens with a central issuer; bitcoin and ether, which make up most of what the attacker still holds, cannot be frozen. I expect this incident to sharpen regulators’ focus on how exchanges secure hot wallets and how much customer money they keep online at any given time.
Sources
- North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History — TRM Labs
- Binance says $6.3bn stolen in biggest crypto heist in history — Al Jazeera
- investingLive Asia-Pacific market news: Binance hack shakes crypto — investingLive
Market data: Yahoo Finance, close of 2026-10-30. Charts generated by TickerRoast from this data.
Disclaimer: This article is for informational and educational purposes only. It provides general financial and business analysis and does not constitute investment advice, a personal recommendation, a recommendation to buy, sell or hold any security, or an offer to transact in any financial instrument. Information is based on publicly available sources as of October 30, 2026 and market data as of the 2026-10-30 close (Yahoo Finance). Past performance is not a reliable indicator of future results; forecasts are uncertain and actual results may differ materially. Investing in shares involves risk, including the loss of capital. The publisher does not guarantee the accuracy or completeness of the information and accepts no responsibility for investment decisions made on the basis of this article. Readers should consult official company disclosures, conduct their own research and, where appropriate, seek advice from a licensed financial adviser. Any relevant financial interests held by the author or publisher in the securities mentioned are disclosed where applicable. This article was prepared with the assistance of AI tools and is based on the sources listed above.
Anonymous reader poll, just for fun. Not investment advice.
Read next
Get the daily market briefing
The stories that move markets, in your inbox every trading day at 9 a.m. ET. Free, unsubscribe anytime.
