Crypto exchanges are intensifying security reviews and pushing for faster threat-intelligence sharing across the industry following a $6.3 billion theft from Binance on October 29, 2026.
The attack drained approximately $6.3 billion in digital assets from Binance's hot wallets in roughly 20 minutes, beginning at approximately 20:05 UTC. Blockchain analytics firms TRM Labs, Chainalysis, and Elliptic linked the breach with high confidence to TraderTraitor, a North Korean hacking group associated with Lazarus Group.
Stablecoin freeze limited losses
Around $3 billion of the stolen assets, primarily the stablecoins USDT and USDC, was frozen on-chain by their issuers, Tether and Circle. By blacklisting specific wallet addresses, the stablecoin issuers effectively prevented roughly half the stolen funds from being moved or spent.
Binance pledged to cover all user losses by drawing on its Secure Asset Fund for Users (SAFU), which holds $1 billion, along with corporate reserves, for a combined commitment exceeding $6.34 billion. The exchange temporarily paused withdrawals while conducting security reviews but kept deposits open. Binance confirmed that individual user balances would not be directly affected and reported no evidence that private keys were leaked.
Industry response and context
Kraken stated it was monitoring industry incidents for defensive lessons. The primary message from exchanges centers on accelerating threat-intelligence sharing so that attack patterns detected at one platform can be quickly communicated to others.
The breach is more than four times larger than the previous record crypto theft: approximately $1.5 billion taken from Bybit in February 2025, also attributed to North Korean hackers.
Market implications
Prices across major digital assets declined following the breach announcement. The stablecoin freeze demonstrated both the recovery value of coordinated action and the centralized control that stablecoin issuers exercise over their tokens at the address level.
