On October 29, 2026, approximately $6.36 billion in digital assets was drained from Binance’s hot wallets in a span of roughly 20 minutes. According to blockchain analytics firm TRM Labs, the scale of the incident has surpassed traditional crypto-sized hacks, prompting comparisons to major traditional financial heists.
The Attack Details
The unauthorized withdrawals began at approximately 4:05 p.m. ET, utilizing internet-connected hot wallets used by the exchange to process everyday withdrawals. The drain ultimately spanned at least 10 blockchains, with total losses estimated between $6.3 billion and $6.4 billion. This figure is roughly double the size of any previously recorded theft in the digital asset sector.
High-confidence intelligence links the attack to TraderTraitor, a North Korean state-sponsored hacking group. Investigators observed preparation and rehearsals at least 36 hours before the theft occurred. With this single event, cumulative North Korean crypto thefts for the year surpassed prior annual records, reaching approximately $7.4 billion through late October 2026.
Asset Freezes and Industry Response
In the wake of the breach, Tether, Circle, Ripple, and other token issuers managed to freeze an estimated $2.4 billion to $2.8 billion of the stolen funds. This intervention was possible because certain token issuers control the smart contracts behind their assets, allowing them to lock flagged stablecoins and render them unusable.
While the freezes helped recover a portion of the stolen assets, the multi-chain nature of the attack complicated tracing efforts as funds were scattered across at least 10 different blockchains. The rapid intervention by centralized issuers also underscored ongoing industry debates surrounding censorship resistance versus centralized intervention mechanisms.
