Binance Hack: How $6.3 Billion Was Stolen and the Phishing Wave That Follows

Last updated: November 2, 2026

Binance, the world’s largest crypto exchange, lost about $6.3 billion from its hot wallets on October 29, 2026, the largest crypto theft on record. Blockchain analytics firms TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean state-sponsored hacking unit. Binance says it is covering all losses. For its users, the next risk is phishing that exploits the breach.

Summary

• The attacker moved about $6.36 billion across ten blockchains, most of it in about 20 minutes, according to TRM Labs.
• Binance first traced the entry to a DevOps engineer’s compromised laptop, then reported additional points of breach.
• About $3 billion is frozen, and Binance says it has replaced about 95% of the stolen assets.
• Security firms are already warning Binance users about fake compensation, support and recovery offers.

What happened in the Binance hack?

Unauthorized transfers from Binance hot wallets (the online wallets used for day-to-day withdrawals) began at about 20:05 UTC on October 29. Binance suspended withdrawals, then deposits, and on October 30 put the impact at about $6.3 billion. Co-CEO Richard Teng said the drained wallets belonged to Binance, not to individual customers. Binance.US was not affected.

How much has been frozen and covered?

Tether froze about $1.6 billion in USDT, Circle more than $800 million in USDC, and Arbitrum’s Security Council froze 8,426 ETH and 74.6 million ARB, for a verified total of about $3 billion. Frozen is not recovered: those assets still have to be returned and verified.

Customer coverage does not depend on the freezes. Binance committed more than $6.34 billion from its treasury and its Secure Asset Fund for Users (SAFU), a $1 billion Bitcoin reserve. It has replaced about 95% so far; the rest are less liquid tokens.

What happened when withdrawals reopened?

Binance reopened withdrawals in phases from 06:00 UTC on November 1. By 15:30 UTC it had processed $4.65 billion in withdrawals and $1.01 billion in deposits, a net outflow of $3.64 billion, or 2.1% of its $171 billion in assets. Founder Changpeng Zhao wrote that “98% choose to stay,” a figure that refers to assets, not users.

Why does the Binance hack matter beyond Binance?

The Binance hack is four times the $1.5 billion Bybit theft of February 2025, which the FBI also attributed to TraderTraitor. In both cases the attackers did not break blockchain cryptography: they reached the systems that move money and made them send it.

The breach also hands scammers a believable story for about 335 million registered users waiting for news on refunds and withdrawals. PhishFort has documented Binance impersonation before, from fake Binance giveaways to phishing kits that copy the Binance login flow.

How did the attackers get into Binance?

Binance’s first update said the incident may have started with a compromised laptop belonging to a DevOps engineer, the role that runs the infrastructure used to deploy software. From it, the attacker reached a service container (a packaged back-end service) that could submit withdrawal transactions. Binance found no evidence that wallet private keys leaked.

A later update said the investigation had uncovered additional points of breach, so the laptop is the first confirmed step, not the full explanation. A technical post-mortem is pending.

Who is TraderTraitor?

TraderTraitor is a North Korean state-sponsored unit that the US Treasury links to the Lazarus Group. TRM Labs attributed the Binance hack to it “with high confidence,” and CNBC reported that the FBI has done the same. Binance has not confirmed the attribution.

A 2022 FBI, CISA and US Treasury advisory describes the group’s usual entry: fake job offers sent to crypto company staff, often in system administration or DevOps roles, to get them to install a trojanized crypto app. It is not confirmed that this is how the Binance laptop was compromised. PhishFort has tracked the same lure in fake Web3 recruitment agencies.

Which phishing lures should Binance users watch for?

These are the lures security firms are warning about after the hack, as of November 2, 2026.

How to protect accounts and brands after the Binance hack

For Binance users

• Open the Binance app or type the address yourself. Never log in from a message about the hack or compensation.
• Never share login codes, two-factor authentication (2FA) codes or seed phrases, even with Binance support.
• Ignore anyone offering to recover crypto for a fee. Binance says it is covering losses itself.

For security teams at exchanges and crypto brands

• Train engineers with production access to report unsolicited job offers, coding tests and app downloads.
• Make sure no single laptop or credential can submit withdrawals without a separate approval.
• From the day you disclose an incident, monitor lookalike domains, fake support accounts and fake apps that use your name, and have takedown requests ready.

PhishFort detects crypto brand impersonation, has analysts validate it and takes it down at the source. PhishFort has a 99%+ takedown success rate over the last year across its clients. See how PhishFort protects crypto brands from impersonation.

Sources

• Binance on X: security incident update (October 30, 2026)
• CBS News: $6.3 billion Binance hack was likely work of North Korea
• SOCRadar: Binance Hack, Inside the $6.3B Hot Wallet Theft
• AFP via Oman Observer: Binance confirms “complex” $6.3 bn hack
• Asia Financial: Hackers in $6bn hit on Binance exchange
• WinBuzzer: Binance pauses withdrawals after $6.3 billion crypto theft
• Crypto Briefing: Binance commits $6.34B to cover losses
• CNBC Africa: Binance sees $3.64 billion in net outflows as withdrawals resume
• Malwarebytes: Binance hit by largest-ever crypto theft
• FBI, CISA and US Treasury: TraderTraitor advisory AA22-108A (April 2022)