How much was stolen in the Binance hack of 2026? On October 29, 2026, an attacker moved about $6.36 billion out of Binance wallets across 10 blockchains, most of it in roughly 20 minutes, in what analysts call the largest crypto theft on record, and Binance says about $3 billion has been frozen. Binance has pledged to cover all losses from its SAFU emergency fund and company money, and the blockchain analytics firms TRM Labs and Chainalysis attribute the attack to North Korea’s TraderTraitor group, though no government has formally confirmed that.
Binance Hacking – Introduction
Binance hacking changed overnight on October 29, 2026. The world’s largest crypto exchange had lived through a $40 million hot wallet theft in 2019 and a $570 million bridge exploit in 2022, and neither came close to this. Preliminary figures put the loss far above any earlier incident on Binance’s record and above the previous industry record.
The numbers are still moving. Binance, blockchain investigators and token issuers report different totals for what was stolen and what is frozen, and the company says its investigation is early. This report sets out the figures as of October 30, 2026, with each number attributed to its source. It covers the incident, Binance’s hack history, industry rankings, North Korea’s role, recoveries and market reaction, one data table at a time.
Interesting Facts About the Binance Hack 2026
LARGEST CRYPTO THEFTS VS BINANCE 2026 (US$ million; each █ = $250 million)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Binance, October 2026 █████████████████████████▍ 6,360
Bybit, February 2025 ██████ 1,500
Ronin, March 2022 ██▍ 620
BNB bridge, October 2022 ██▎ 570
Bitget, September 2026 █▌ 388
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Interesting Fact | 2026 Data |
|---|---|
| Stolen, per TRM Labs | About $6.36 billion |
| Impacted, per Binance | About $6.3 billion |
| Date and start time | October 29, 2026, 20:05 UTC |
| Duration of most transfers | About 20 minutes |
| Blockchains involved | 10 |
| Frozen, per Binance | About $3 billion |
| Frozen, per TRM Labs | About $2.7 billion |
| Attribution | TraderTraitor, a North Korean unit, per TRM and Chainalysis |
Source: TRM Labs, October 29-30, 2026; Binance security announcement, October 30, 2026; CNBC and Forbes, October 29-30, 2026.
The first four rows describe the theft. TRM Labs traced about $6.36 billion leaving Binance wallets from 20:05 UTC on October 29, most of it within about 20 minutes, and Binance’s own estimate of the total impact is about $6.3 billion. The funds left wallets on 10 blockchains, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
The last four rows describe the response. Binance and its partners froze about $3 billion, while TRM counted about $2.7 billion frozen as of early October 30, a difference that reflects timing and method. TRM Labs and Chainalysis both attribute the attack to North Korea’s TraderTraitor group, which the FBI previously linked to the $1.5 billion Bybit theft. Governments have not issued a formal attribution.
Binance Hack Timeline 2026 | October 29-30 Hour by Hour
FUNDS STOLEN, FROZEN AND STILL HELD BY THE ATTACKER (US$ billion; each █ = $0.25 billion)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Stolen (TRM) █████████████████████████▍ 6.36
Frozen (Binance) ████████████ 3.0
Frozen (TRM, early Oct 30) ██████████▊ 2.7
Attacker still holds (TRM) █████████▌ 2.4
Frozen at 23:35 UTC (Binance) ██████████▏ 2.54
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Time (UTC) | Event |
|---|---|
| October 29, 20:05 | Funds begin leaving Binance wallets on 10 chains |
| October 29, about 20:25 | Most of the $6.36 billion has moved |
| October 29, 23:35 | Binance says verified frozen funds reached $2.54 billion |
| October 29, evening | CZ posts: “It does look like a hack on Binance” |
| October 29, evening | Tether freezes more than $1.56 billion; Circle freezes more than 800 million USDC |
| October 30, 00:30 | TRM counts about $2.7 billion frozen |
| October 30 | Binance says about $3 billion frozen, $6.3 billion impacted |
| October 30 | Binance suspends deposits and withdrawals; says it expects to restore them within 48 hours |
Source: TRM Labs; Forbes, October 30, 2026; CNBC, October 29-30, 2026; Technology.org, October 30, 2026.
The hack unfolded in a single evening. Assets began leaving Binance-controlled wallets at 20:05 UTC and flowed to one attacker, and TRM said the preparations began at least 36 hours earlier. By 23:35 UTC Binance reported verified frozen funds of $2.54 billion, and Tether and Circle moved quickly to lock stablecoins, with Tether freezing more than $1.56 billion and Circle more than 800 million USDC. Reports say about $2.3 billion of the frozen total is in USDT and USDC.
The numbers still disagree because of timing. TRM estimated that the attacker still held about $2.4 billion while about $2.7 billion was frozen. Binance later reported about $3 billion frozen. The company said a software engineer’s laptop may have been compromised, which allowed hackers to access systems and start unauthorized withdrawals, and it found no evidence that wallet private keys leaked. The full attack path is not confirmed.
Binance Hack History 2019-2026 | Every Major Incident and Amount
BINANCE-RELATED LOSSES BY INCIDENT (US$ million; each █ = $250 million)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
May 2019 hot wallet ▏ 40
October 2022 BNB bridge (net) ▌ 115
October 2022 minted (gross) ██▎ 570
October 2026 hot wallets █████████████████████████▍ 6,360
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Incident | Amount | How It Happened and What Followed |
|---|---|---|
| May 2019, hot wallet | 7,000 bitcoin, about $40-41 million | Phishing and stolen keys; covered by SAFU |
| October 2022, BSC Token Hub bridge | 2 million BNB, about $570 million | Forged proof exploit on a cross-chain bridge; Binance paused the chain |
| October 2022, net after intervention | About $100-115 million unrecovered | Validators froze the rest; $7 million frozen by partners |
| August 2026, SafePal data leak | About 40,000 buyers’ details | Order-tracking bug at a Binance Labs-backed wallet maker |
| October 2026, hot wallets | About $6.36 billion | Suspected compromise of signing access; 10 chains |
| Total across the three major incidents | Not totaled by Binance | Different layers: exchange wallet, blockchain bridge, hot wallets |
Source: Reuters and NBC News, October 2022; TheStreet and Al Jazeera, 2019 and 2026; Forbes; Crypto Times, October 30, 2026.
Binance has faced three major incidents of different types. In May 2019 hackers withdrew 7,000 bitcoin worth about $40 to $41 million from a hot wallet, and the exchange covered the loss from its SAFU fund. In October 2022 an attacker used a flaw in the BNB Smart Chain bridge to mint 2 million BNB, worth about $570 million, but validators halted the chain and Binance said the unrecovered amount was about $100 million to $115 million. That event hit a blockchain bridge, not the exchange’s own wallets.
The 2026 incident is of a different order. The $6.36 billion figure is far above the 2022 gross amount of about $570 million and the 2019 loss of about $40 million. It also targeted the exchange’s hot wallets, which the 2022 bridge exploit did not. A separate August 2026 leak at SafePal, a wallet maker backed by Binance Labs, exposed the names and home addresses of about 40,000 buyers, so Binance’s wider ecosystem has been hit twice this year.
Biggest Crypto Hacks in History 2026 | Binance vs Bybit, Ronin, Bitget and KelpDAO
BIGGEST CRYPTO EXCHANGE AND PROTOCOL THEFTS (US$ million; each █ = $250 million)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Binance (October 2026) █████████████████████████▍ 6,360
Bybit (February 2025) ██████ 1,500
Ronin (March 2022) ██▌ 620
BNB bridge (2022) ██▎ 570
Bitget (September 2026) █▌ 388
KelpDAO (April 2026) █▏ 292
WazirX (July 2024) ▉ 235
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Rank | Incident | Date | Amount | Attribution |
|---|---|---|---|---|
| 1 | Binance | October 2026 | $6.36 billion | TraderTraitor (TRM, Chainalysis) |
| 2 | Bybit | February 2025 | $1.5 billion | North Korea (FBI) |
| 3 | Ronin Network | March 2022 | About $620 million | North Korea |
| 4 | BNB bridge | October 2022 | About $570 million | Unattributed |
| 5 | Bitget | September 2026 | About $388 million | Not stated |
| 6 | KelpDAO | April 2026 | About $292 million | North Korea-linked (TRM) |
| 7 | WazirX | July 2024 | $230-235 million | Lazarus Group |
Source: TRM Labs; CNBC; Forbes, October 30, 2026; BigGo Finance; Wikipedia 2024 WazirX hack.
Binance sits alone at the top. At $6.36 billion it sits well above the $1.5 billion Bybit theft of February 2025, which held the record until now, and Ronin’s roughly $620 million. The BNB bridge exploit of 2022 ranks fourth at about $570 million gross. Two more incidents this year, $388 million at Bitget in September and $292 million at KelpDAO in April, make 2026 a heavy year for exchanges even before Binance.
Most large thefts trace to the same source. The FBI attributed Bybit to North Korea’s TraderTraitor, and TRM says the Binance attack shares features with Bybit and KelpDAO: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance and executed in one burst. Bitget lost about $388 million and froze only $1.1 million, its chief executive told CNBC, which shows how little recovery usually follows.
North Korea Crypto Hacks 2026 | TraderTraitor, Lazarus and Stolen Totals
NORTH KOREA CRYPTO THEFT FIGURES (US$ billion; each █ = $0.25 billion)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Binance, October 2026 (suspected) █████████████████████████▍ 6.36
All North Korea theft, 2025 ████████ 2.02
Bybit, February 2025 ██████ 1.50
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| North Korea Metric | Data |
|---|---|
| Group blamed for Binance | TraderTraitor, under the Lazarus umbrella |
| Confidence level (TRM Labs) | “High confidence” |
| Chainalysis view | Likely the work of TraderTraitor |
| Formal government attribution | None yet |
| North Korea theft in 2025 | $2.02 billion (Chainalysis) |
| Bybit theft, February 2025 | $1.5 billion, attributed by the FBI |
| Preparation before the Binance theft | At least 36 hours |
| Wallet staging method | Signatures obtained in advance, executed in one burst |
Source: TRM Labs; Chainalysis as reported by CNBC and BigGo Finance; FBI attribution of the Bybit incident, October 30, 2026.
North Korea is the leading suspect in the record theft. TRM Labs attributes the attack with high confidence to TraderTraitor, a unit that operates under the Lazarus Group umbrella, and Chainalysis says it looks like the same group’s work. Neither Binance nor any government has confirmed this. North Korea stole about $2.02 billion in crypto in 2025, most of it from the $1.5 billion Bybit hack, so the Binance figure alone is larger than North Korea’s total for last year.
The method matters too. TRM says the attackers prepared at least 36 hours ahead, funded an operator wallet with small Tornado Cash withdrawals and used signatures obtained in advance. That fits earlier North Korean operations. If the attribution holds, the money is a state asset, and recovering it depends on exchanges and stablecoin issuers freezing funds before the attackers convert them to untraceable assets.
Binance Hack Recovery and Frozen Funds 2026 | Tether, Circle and Remaining Losses
FROZEN OR RECOVERED FUNDS AFTER MAJOR HACKS (US$ million; each █ = $250 million)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Binance 2026, frozen (Binance) ████████████ 3,000
Binance 2026, frozen (TRM) ██████████▊ 2,700
Tether freeze ██████▎ 1,567
Circle freeze ███▎ 823
Bitget 2026, frozen ▏ 1.1
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Recovery Metric | Data |
|---|---|
| Frozen, per Binance | About $3 billion |
| Frozen, per TRM Labs | About $2.7 billion |
| Tether froze | More than $1.567 billion in USDT |
| Circle froze | About $823 million in USDC |
| Stablecoin share of frozen funds | About $2.3 billion |
| Attacker still held (TRM) | About $2.4 billion |
| Bitget, September 2026 | $388 million stolen, $1.1 million frozen |
| Binance’s promise | Cover all losses from SAFU and company funds |
Source: Binance; TRM Labs; CZ and Tether CEO Paolo Ardoino statements via TheStreet and Forbes; CNBC, October 2026.
Freezes matter more than arrests. Tether froze more than $1.567 billion, and Circle froze about $823 million in USDC, and reports put about $2.3 billion of the $3 billion Binance says is frozen in stablecoins. TRM adds that the attacker still held about $2.4 billion in assets that may be harder to stop, such as bitcoin and ether. Frozen funds can be returned only after legal processes that sometimes take months.
The contrast with other 2026 incidents is stark. Bitget lost about $388 million in September and froze only $1.1 million, and its chief executive said she did not expect to recover much. Binance and its partners froze about $3 billion within a day. Binance has promised to cover every customer loss from its SAFU fund and company funds, and it says it will publish an updated proof of reserves once remediation is complete.
Binance Security and SAFU Facts 2026 | Customer Funds, Reserves and Governance
BINANCE'S STATED RESERVES AND LOSS COVER (US$ billion; each █ = $0.25 billion)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Impact, per Binance █████████████████████████ 6.3
Frozen, per Binance ████████████ 3.0
SAFU fund (reported) ████▊ about 1.0-1.19
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Security Metric | Data |
|---|---|
| Binance’s statement | “User funds are safe” |
| Likely entry point | A software engineer’s laptop may have been compromised |
| Private keys leaked | No evidence, per Binance |
| SAFU fund size (reported) | About $1.0 to $1.19 billion |
| Deposits | Unaffected, per Binance |
| Withdrawals | Suspended; restoration expected within 48 hours |
| Changpeng Zhao’s role | Co-founder, no longer manages Binance.com |
| Solvency view (Fundstrat) | No significant solvency risk currently |
Source: Binance security announcement, October 30, 2026; Forbes; CNBC; Crypto Times, October 30, 2026.
Binance says customers will not lose money. The company’s statement says user funds are safe, that it found no evidence of leaked private keys and that it will cover all losses from SAFU and other company funds. SAFU, its emergency fund for users, is reported at about $1.0 to $1.19 billion, which is well below the $6.3 billion impact, so company resources would have to cover the rest. Sean Farrell of Fundstrat said the breach does not currently appear to create a significant solvency risk.
Questions about governance and controls will follow. Changpeng Zhao, the co-founder, wrote that he no longer manages Binance.com but expects all user funds to be covered, and co-founder Yi He said the company would pay all hacking losses. Bloomberg Intelligence analyst James Seyffart said hot wallet drains are not new, but this size on the largest exchange is meaningful. Withdrawals remained paused on October 30, with a restart targeted within 48 hours.
Crypto Market Reaction to the Binance Hack 2026 | Bitcoin, Ether and BNB Prices
PRICE CHANGE AFTER THE BINANCE HACK NEWS (percent; each █ = 1 point)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
BNB ◄███████ more than -7%
Ether ◄█████▏ -5.2%
Bitcoin ◄████▌ -4.5%
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Market Metric | October 30, 2026 |
|---|---|
| Bitcoin | Down about 4.5% |
| Ether | Down about 5.2% |
| BNB | Down more than 7% |
| Polymarket exploit, same day | About $2.6 million taken from users’ wallets |
| Bitget hack, September 2026 | About $388 million |
| Bybit hack, February 2025 | $1.5 billion |
| KelpDAO exploit, April 2026 | About $292 million |
| Bloomberg Intelligence comment | “It’s definitely a bad look. And this is one after another.” |
Source: Forbes, October 30, 2026; The Block, October 29, 2026; CNBC, October 2, 2026; Bloomberg Intelligence.
The market reacted fast. As of early Friday, bitcoin was down about 4.5%, ether down 5.2% and BNB, Binance’s own token, down more than 7%, the steepest fall among the major coins. The slide came as the exchange suspended withdrawals and as news spread that some of the stolen assets were stablecoins and others were major tokens that could be sold. Prices for most major coins fell together because Binance handles a large share of global trading.
The incident also comes in a string of 2026 attacks. Bitget lost about $388 million in September, KelpDAO lost about $292 million in April, and Polymarket lost about $2.6 million from user wallets the same day as Binance. Bloomberg Intelligence’s Seyffart called the sequence “one after another.” Traders now watch for the restart of withdrawals, the pace of freezes and any formal attribution by US authorities, each of which could move prices again.
Crypto Hacks in 2026 | Bitget, KelpDAO, Polymarket and SafePal Compared
2026 CRYPTO INCIDENTS BEFORE AND AFTER BINANCE (US$ million; each █ = $250 million)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Binance (October) █████████████████████████▍ 6,360
Bitget (September) █▌ 388
KelpDAO (April) █▏ 292
Polymarket (October) ▏ 2.6
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| 2026 Incident | Amount or Impact |
|---|---|
| Binance, October 29 | About $6.36 billion across 10 chains |
| Bitget, September | About $388 million stolen; $1.1 million frozen |
| KelpDAO, April | About $292 million; TRM links features to North Korea |
| Polymarket, October 29 | About $2.6 million from users’ wallets; users “will be made whole” |
| SafePal data leak, August | About 40,000 buyers’ names and home addresses exposed |
| Bitget CEO’s recovery outlook | “Not expecting to recover a lot of funds” |
| Cross-chain bridge losses since 2022 (Chainalysis, 2022) | About $1.4 billion |
| Trading halted | Polymarket paused its international platform |
Source: Forbes, October 30, 2026; CNBC, October 2, 2026; The Block, October 29, 2026; TRM Labs; NBC News, October 2022.
Binance is the largest incident in a heavy year. Bitget lost about $388 million in September and froze only $1.1 million of it, its chief executive told CNBC, and KelpDAO lost about $292 million in April in an exploit that TRM says resembles earlier North Korean operations. On the same day as the Binance theft, prediction market Polymarket halted trading on its international platform after about $2.6 million was taken from users’ wallets, and it pledged to make affected users whole.
The attacks hit different layers of the industry. Exchange hot wallets, a bridge, a prediction market and a wallet maker’s customer data all appeared on the 2026 list. A SafePal order-tracking bug exposed the names and home addresses of about 40,000 buyers in August, which raises phishing risk for crypto holders. Earlier, Chainalysis counted about $1.4 billion lost to cross-chain bridge breaches from the start of 2022 to October 2022, a reminder that bridges remain a weak point.
Binance Hack FAQs 2026
How much was stolen in the Binance hack?
TRM Labs puts the theft at about $6.36 billion, and Binance estimates about $6.3 billion impacted, on October 29, 2026.
Was Binance hacked in 2026?
Binance reported a security incident on October 29, and its co-founder said it “does look like a hack.” The company calls it a security incident and says user funds are safe.
Who hacked Binance?
TRM Labs attributes the attack with high confidence to North Korea’s TraderTraitor group, and Chainalysis agrees. No government has formally confirmed it.
How much of the Binance hack money was recovered?
Binance says about $3 billion is frozen. TRM counted about $2.7 billion as of early October 30, and the attacker still held about $2.4 billion.
Will Binance customers lose money?
Binance says no. It pledged to cover all losses from its SAFU fund and company funds.
What is SAFU?
The Secure Asset Fund for Users is Binance’s emergency fund for customers. It is reported at about $1.0 to $1.19 billion.
How did the Binance hack happen?
Binance says a software engineer’s laptop may have been compromised, allowing unauthorized withdrawals. The full attack path is not confirmed.
Is the Binance hack the biggest crypto hack ever?
Yes by dollar value. At about $6.36 billion it is well above the $1.5 billion Bybit theft of February 2025.
Were Binance withdrawals suspended?
Yes. Binance suspended deposits and withdrawals and said it expects to restore them within 48 hours.
What happened to Bitcoin after the Binance hack?
Bitcoin fell about 4.5%, ether about 5.2% and BNB more than 7% by Friday morning.
Has Binance been hacked before?
Yes. In May 2019 hackers took 7,000 bitcoin worth about $40 million, and in October 2022 a bridge exploit minted 2 million BNB worth about $570 million.
What was the Bybit hack?
A $1.5 billion theft in February 2025, attributed by the FBI to North Korea’s TraderTraitor group.
Which other exchanges were hacked in 2026?
Bitget lost about $388 million in September 2026, and KelpDAO lost about $292 million in April.
How much did Bitget lose in 2026?
About $388 million in September 2026, and only $1.1 million of it was frozen.
How much did KelpDAO lose?
About $292 million in April 2026, in an exploit TRM Labs says resembles earlier North Korean operations.
What did Polymarket lose on October 29?
About $2.6 million from users’ wallets, according to The Block, and the company said affected users would be made whole.
How much crypto did North Korea steal in 2025?
About $2.02 billion, according to Chainalysis, most of it from the $1.5 billion Bybit hack.
Did the SafePal leak involve Binance?
SafePal is a wallet maker backed by Binance Labs. An August 2026 bug exposed about 40,000 buyers’ names and home addresses, according to Crypto Times.
How many blockchains were affected?
10, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
Disclaimer: This research report is compiled from publicly available sources. While reasonable efforts have been made to ensure accuracy, no representation or warranty, express or implied, is given as to the completeness or reliability of the information. We accept no liability for any errors, omissions, losses, or damages of any kind arising from the use of this report.