Approximately $6.3 billion was drained from Binance's hot wallets on October 29, 2026, in a breach that unfolded over 20 to 30 minutes and affected more than ten blockchains. TRM Labs, Chainalysis, and the FBI have attributed the attack to TraderTraitor, a North Korean hacking group.
How the attack unfolded
Binance halted all withdrawals after the breach and worked with stablecoin issuers, including Tether (USDT) and Circle (USDC), to freeze roughly $3 billion of the compromised funds. The exchange also set aside more than $6.34 billion of its own money to cover user losses. Services were restored gradually rather than all at once.
Around half of the stolen assets were moved into tokens with no centralized freezing capability. Once funds land there, no issuer holds a switch that can stop them.
Binance published an initial incident report on November 3, 2026, describing a drawn-out campaign rather than a single smash-and-grab, involving malware and sophisticated laundering methods. The entry point was reportedly human, not technical: attackers used social engineering, including fake job interviews aimed at Binance engineers, to gain insider access.
Why freezable tokens matter here
Stablecoins like USDT and USDC are issued by companies that can freeze specific addresses. In this case, that power turned into roughly $3 billion that the attackers could not use. Tokenized securities work on a similar principle: they represent traditional assets on a blockchain, and their issuers typically keep administrative controls over who can hold or move them.
A familiar adversary at scale
North Korean groups like TraderTraitor are state-sponsored, and their operations against digital asset platforms have become a persistent threat. This incident extends that pattern to a scale the industry had not seen before. The tactics on display were not exotic—fake recruiters, malware, and layered laundering are standard tools. What stood out was the speed of the final draining and the breadth across more than ten chains at once.
Binance's ability to cover losses with more than $6.34 billion in company funds supports part of that argument. The fact that the funds left in under half an hour undercuts another part.
What this means for exchanges, issuers, and users
For stablecoin issuers, the episode is a double-edged showcase. Tether and Circle demonstrated that freeze powers can recover billions in a real emergency. The attackers' choice to rotate funds into assets without central controls is the clearest signal of all: sophisticated thieves already understand which tokens can be clawed back and which cannot, and they plan around it.
