The Binance Hack Explained: What Happened and What to Learn
Quick answer. On October 29, 2026, about $6.36 billion left Binance wallets, per TRM Labs. Binance says attackers reached an internal signing service. Within hours, issuers led by Tether and Circle froze about $2.67 billion in stablecoins, TRM says.
Video transcript
About 6.36 billion dollars left Binance wallets on October 29, the largest crypto theft on record, per TRM Labs. It was months in the making.
Binance says it began in June with a tampered Homebrew installation, then a fake job assignment in September. In October, the attacker gained control over two engineers and reached the signing service.
On Ethereum, Binance says, attacker delegations on a hot wallet ran outside the withdrawal system, so a pause could not stop them. With multi-party computation, no single key could revoke them at once.
TRM Labs and the FBI attribute the theft to North Korea's Trader Traitor unit, which North Korea denies. Binance makes no attribution itself.
Within hours, about 2.7 billion dollars was frozen, per TRM, roughly 42 percent of the total and almost all stablecoins.
Tether moved first, 37 minutes after the main Ethereum sweep, followed by Circle, Ripple, World Liberty Financial and Arbitrum's Security Council.
The attacker raced the freezes, selling USDT for ether at a steep discount, TRM says. About 2.4 billion dollars in ether and bitcoin was beyond issuers' reach.
Without assigning fault, any exchange can enforce policy at the signer, narrow what it signs, rehearse revocation, secure engineers' devices and line up issuer contacts.
Read the full analysis, then talk to Guardian about finding every path to your signing service.
The Binance hack is the largest crypto theft on record, according to TRM Labs. TRM puts it at about $6.36 billion, valued when each asset was taken.
Binance's own estimate is about $6.34 billion. Its November 3 initial report gives its account of how the attackers got in, and says the findings will be subject to further independent review.
Times below are UTC. Figures are as of November 5, 2026.
What We Know
Most of the value left in about 20 minutes from 20:05 on October 29, according to TRM.
| Time (UTC) | Event | Source |
|---|---|---|
| Oct 28, morning | Three Tornado Cash withdrawals fund the attacker's wallet | TRM |
| Oct 29, 20:05 | Five XRP Ledger hot wallets start sending 233.46M XRP | TRM, Binance |
| 20:20 | A bitcoin hot wallet sends 18,270 BTC | TRM |
| About 20:23 | The Ethereum hot wallet is swept: 167,464 ETH and 63 tokens | TRM |
| 21:01 | Tether's first freeze: 971.1M USDT | TRM |
| 23:56 | The last unauthorized transfer finalizes | Binance |
| Oct 30, 00:10 | Binance clears the EIP-7702 delegation on its hot wallet | Binance |
By TRM's count, Ethereum accounted for about $3.79 billion and Bitcoin about $1.47 billion. Tron, the XRP Ledger, Solana and five other chains made up the rest.
How the attackers got in
Binance's November 3 report describes a campaign, "not a single isolated breach or a simple phishing incident." In its account:
- June: a Wallet DevOps engineer downloaded a tampered Homebrew installation. Binance replaced the device and rotated credentials.
- September: someone posing as a project director approached a second engineer on a job platform. A fake "assignment" put malware on his work computer.
- October 20: from that computer, using an internal AI tool, the attacker moved to "gain control over" the first engineer and a third. The first held a container deployment token.
- October 29: on the third engineer's computer, the attacker used the first engineer's stolen credentials, deployed a container and triggered a malicious script.
Binance says the attacker used unauthorized access to an internal wallet signing service "to initiate transactions outside the normal withdrawal process."
Binance's October 30 update said it had "found no evidence of any wallet private key leak."
DefiLlama labels the incident "key leaked via infrastructure," as our crypto hack statistics show. That is DefiLlama's classification, not Binance's finding.
Why pausing withdrawals was not enough
On Ethereum, Binance says, the attacker submitted 50 signing transactions to set up EIP-7702 delegations. These gave an attacker-controlled contract "partial execution rights" over a hot wallet.
Suspending withdrawals alone could not stop them, Binance says. The authorizations "operated independently of Binance's normal withdrawal infrastructure."
Revoking them took time. The hot wallet used multi-party computation (MPC), so "there was no single private key" to revoke them at once, Binance says. It developed a specialized procedure and cleared the delegation at 00:10.
Who Did It
In its October 29 analysis, TRM Labs attributed the theft to TraderTraitor, a North Korean state hacking unit. "We make this judgment with high confidence," it wrote.
On October 31, the FBI said North Korea "was responsible for the theft of more than $6 billion USD in virtual assets" from Binance, BleepingComputer reported. It named TraderTraitor.
With the Secret Service and IRS Criminal Investigation, the FBI asked exchanges to block transactions with the attackers' laundering addresses. Its list has 628, BleepingComputer reported.
North Korea denied it. Kim Yo Jong called the FBI finding a "grave political provocation against the DPRK," Decrypt reported, citing state media.
Binance cites the FBI release but does not make the attribution itself. Co-CEO Richard Teng told CNBC the attackers "spent months building their way in."
The FBI has tied the same group to Bybit in 2025 and DMM Bitcoin in 2024. At DMM, it said, a fake recruiter's test was the way in.
How the Freezes Worked
Stablecoins were what issuers could stop. Who acted, and when, per TRM:
| Who | First action (UTC) | In all, per TRM |
|---|---|---|
| Tether | 21:01, 971.1M USDT | About 1.77B USDT |
| Circle | 21:04, 823M USDC | About 825M USDC |
| Ripple | 22:01, 40.5M RLUSD | Plus RLUSD in the hot wallet |
| World Liberty Financial | 22:10, 27.8M USD1 | Plus USD1 in the hot wallet |
| Arbitrum Security Council | 00:08 Oct 30, two forced transfers | 8,426 ETH and 74.6M ARB, about $30M |
By 00:30 UTC on October 30, about $2.7 billion was frozen, per TRM, $2.67 billion of it in stablecoins. That is about 42% of the total.
Tether says it froze "more than $1.5 billion." Circle acted "in co-ordination with law enforcement," the Associated Press reported.
The race
The attacker raced the freezes. TRM says it sold about 325 million USDT for ETH through UniswapX and other intent-based contracts, at a discount of more than 10%.
Assets with no issuer could not be frozen this way. TRM counted about $2.4 billion in ETH and BTC beyond issuers' reach.
Why the totals differ
TRM's $2.7 billion is a snapshot at 00:30 UTC on October 30. Binance's October 30 update cited about $3 billion.
Its November 3 report puts frozen or intercepted funds at about $2.85 billion, "subject to reconciliation and market price volatility."
What Exchanges Can Learn
Binance has not yet published its technical post-mortem, and this section assigns no fault. But its account so far points to controls any exchange can check now.
Enforce policy at the signer
Limits and approvals that live only in the withdrawal app do not bind a signer that can be reached another way.
Our guide to exchange withdrawal security controls walks each check between request and signature.
Narrow what the signer will sign
TRM advises rejecting EIP-7702 authorizations unless expected. One actor moved funds on ten chains, so it also advises separating signing and approval paths by chain and wallet tier.
Rehearse revocation
A pause that cannot undo what is already signed is half a pause. Test the revocation path for each wallet type, MPC included.
Treat engineers' devices as part of the wallet
In Binance's account, the intrusion began with a tampered Homebrew installation and a fake job interview. Our insider threat program template covers hiring checks, access tiers and offboarding.
Line up freezes in advance
Tether's first freeze came 37 minutes after the main Ethereum sweep, TRM says. Keep verified issuer contacts ready, as our incident response plan sets out.
Updates Since October 29
- October 29: Binance suspends withdrawals on several networks.
- October 30: Binance says deposits are unaffected, and losses are covered by SAFU and company funds.
- October 31: the FBI names North Korea. By then, Binance says, 98% of impacted token assets were replenished.
- November 1: withdrawals begin reopening in phases, Decrypt reported.
- November 3: Binance publishes its initial report and plans an independent review.
- November 5: Recovery Update #8 reopens more assets from 04:00 UTC, in stages.
Binance says a detailed technical post-mortem will follow the investigation, and an updated proof of reserves will follow remediation.
How Guardian Helps
Guardian's institutional practice specifies approval thresholds and key custody "before they are built rather than audited after."
Its infrastructure pentest treats your cloud "as a set of accounts to escalate through until something signs."
An OpSec audit maps every path to your funds, including what a signer actually sees.
After launch, Managed Security streams your monitoring into a 24/7 MDR team, with a 15-minute SLA on Critical alerts.
Frequently Asked Questions
How much was stolen in the Binance hack?
About $6.36 billion across ten blockchains, per TRM Labs, valued when each asset was taken. Binance estimates about $6.34 billion; the FBI says more than $6 billion.
Who was behind the Binance hack?
The FBI attributed it to North Korea's TraderTraitor group on October 31, 2026, after TRM Labs and Chainalysis did the same. North Korea denied it. Binance cites the FBI release but does not make the attribution itself.
How much of the stolen crypto was frozen?
About $2.7 billion by 00:30 UTC on October 30, per TRM Labs, mostly stablecoins frozen by Tether, Circle, Ripple and World Liberty Financial. Binance's November 3 report puts frozen or intercepted funds at about $2.85 billion.
Did Binance users lose money?
Binance says no: its SAFU fund and company funds cover the losses, and user funds are safe. Withdrawals began reopening in phases on November 1.
Sources
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
- Binance: 29 October 2026 Binance Security Incident, Initial Findings and Response Update (November 3, 2026)
- Binance: Security Incident Update (October 30, 2026)
- Binance: Binance Security Breach Update (May 7, 2019, with an October 30, 2026 update)
- Binance: Security Incident, Recovery Update #8, Withdrawals for More Assets to Reopen (November 5, 2026)
- Tether: Tether Freezes Over $1.5 Billion From Binance Hack (November 2, 2026)
- Associated Press, via The Irish News: Crypto giant Binance hit by 6.3 billion dollar hack suspected to be largest ever (October 30, 2026)
- BleepingComputer: FBI links $6.3 billion Binance crypto heist to North Korean hackers (November 1, 2026)
- The Record: FBI blames N. Korea's TraderTraitor for Binance theft, urges crypto industry to block transactions (November 2, 2026)
- Decrypt: FBI Blames North Korea for $6B Binance Hack as Exchange Reopens Withdrawals (November 2, 2026)
- Decrypt: North Korea Denies $6.3B Binance Hack, Calls FBI Finding a Political Provocation (November 3, 2026)
- CNBC: Binance co-CEO Richard Teng says hackers used fake job interviews, AI tool to steal $6.3 billion in crypto (November 3, 2026)
- FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack (February 26, 2025)
- BleepingComputer: FBI links North Korean hackers to $308 million crypto heist (December 24, 2024)
- Guardian: Crypto Hack Statistics 2026 (November 2026)
Find every path to your signing service
Guardian tests the devices, cloud accounts and approval flows that can make your wallets sign, before an attacker does.