Binance says a security breach affected about $6.3 billion in cryptocurrency, prompting a scramble to freeze stolen assets and restore its reserves. The attack unfolded on October 29, 2026. Blockchain intelligence firm TRM Labs estimates the theft at $6.36 billion and describes it as the largest crypto heist on record.
The exchange has pledged to cover customer losses. But three figures matter: the assets stolen, the funds frozen and Binance’s reserve to replace them. They measure different parts of the response, not three amounts that can be added together.
What happened in the Binance hack?
According to TRM Labs’ investigation, funds left Binance wallets across ten blockchains, with most of the transfers taking place in roughly 20 minutes. The affected networks included Bitcoin, Ethereum, Tron, Solana and the XRP Ledger.
Binance’s October 30 security update describes a compromised employee laptop followed by additional points of entry. The company says the theft involved multiple steps and could not have been carried out through a single engineer’s permissions alone. It reports finding no evidence that wallet private keys were leaked.
Those findings remain preliminary. Binance has promised a fuller account once its investigation ends. Even if attackers did not steal the keys, they still found a way to move funds. The key question is how they bypassed the controls that should have blocked those transfers.
Frozen assets are not yet recovered funds
In a separate reserve update, Binance says it has earmarked more than $6.34 billion of company funds to cover the incident. It says it already holds about $5 billion in the affected tokens. The exchange is buying the remaining roughly $1.34 billion through markets and over-the-counter deals.
Binance also reports that partners have frozen approximately $3 billion in assets. It says that amount is separate from its replacement reserve and still subject to recovery and verification. The company plans to verify user holdings publicly through its proof-of-reserves reporting.
A freeze can stop assets from moving without returning them to their owner. That distinction matters when assessing the eventual loss. Likewise, a promise to replace missing tokens does not show that investigators have recovered the stolen funds.
Investigators point to North Korea
TRM attributes the attack to TraderTraitor, a North Korean hacking operation, with high confidence. That is the firm’s assessment; it should not be confused with a final finding from Binance or law enforcement about this incident.
There is a significant earlier case. In a February 2025 public advisory, the FBI attributed the theft of approximately $1.5 billion from Bybit to North Korea and identified the activity as TraderTraitor. The Binance estimate is more than four times that amount. The FBI advisory concerns Bybit, however, and does not itself establish who carried out the Binance attack.
What customers are waiting for
In its October 30 update, Binance said withdrawals remained suspended. It expected to restore them in about 45 hours, with the exact timing to follow in an official announcement. That is a forecast, not confirmation that withdrawals have resumed. The company says customers will not bear the losses.
The next meaningful milestones are restored withdrawals, verification of replacement assets and a technical explanation of how the breach crossed internal controls. Until then, the headline theft estimate and the eventual unrecovered loss remain different questions.
This report reflects statements and findings available on October 30, 2026. The investigation is ongoing.
Sources: TRM Labs, Binance — Security update, Binance — Replacement reserves and frozen assets, FBI / IC3
