The $6 Billion Binance Heist: How Crypto Exchanges Are Being Robbed

On 29 October 2026, attackers moved more than $6 billion out of Binance, the world’s largest cryptocurrency exchange, in what is the largest crypto theft on record. Five weeks earlier, Bitget lost $387.5 million in a similar attack on its online wallets. The FBI has attributed the Binance theft to North Korea. This briefing explains what happened, how the attack worked, what it means for users, and the concrete steps to remediate, prevent and protect.

Figures are as reported up to 3 November 2026. Estimates of the amount stolen range from $6.3 billion to $6.43 billion depending on the source, and investigations are ongoing. North Korea denies involvement.

What happened at Binance

The largest crypto theft on record: $6.36 billion moved out of Binance wallets on 29 October 2026, most in about 20 minutes, across 10 blockchains, with about $3 billion of stablecoins frozen

On the evening of 29 October, starting at about 20:05 UTC, funds began leaving Binance’s hot wallets (the online wallets an exchange uses to process everyday withdrawals) on ten blockchains. Blockchain intelligence firm TRM Labs counted about $6.36 billion, most of it moved in roughly 20 minutes. That is more than four times the previous record, the $1.5 billion theft from the Bybit exchange in 2025.

Blockchain	Reported amount stolen
Ethereum	About $3.8 billion
Bitcoin	18,270 BTC, about $1.5 billion
Tron	About $628 million (mostly USDT stablecoins)
XRP Ledger	About $296 million
Solana	About $96 million
Others	Arbitrum, Optimism, Base, Avalanche and Polygon, smaller amounts

Binance suspended withdrawals, said it would absorb the financial impact so that users would not lose money, and resumed withdrawals in phases from 1 November. Stablecoin issuers and industry partners, including Tether, Circle and Ripple, froze about $3 billion of the stolen stablecoins. Crypto prices fell sharply when the news broke, and customers withdrew billions of dollars once withdrawals reopened.

Two exchanges, five weeks

Timeline from the Bitget theft on 24 September 2026 to the Binance theft on 29 October, the FBI attribution on 31 October and resumed withdrawals on 1 November

Bitget, 24 September 2026. Bitget detected unauthorised transfers from some of its hot and warm wallets. The final count was $387.5 million across seven blockchains. Its offline cold wallets were not affected. Bitget’s CEO said IP addresses used in the attack matched a North Korean group, and blockchain analytics firm Elliptic assessed a North Korea link as highly likely. Bitget covered the loss from its user protection fund and resumed withdrawals in phases from 28 September.

The link. While tracing the Binance theft, Chainalysis saw stolen Binance funds mix on-chain with funds from the Bitget theft, which it treated as strong evidence that the same North Korean group was behind both.

How the attack worked

How the attack worked in five steps: engineer's laptop, internal service, valid signatures, EIP-7702 sweep, laundering

No blockchain was broken and, according to Binance, no wallet private key was stolen. The attacker got inside Binance’s own systems instead:

A laptop. Binance’s initial investigation said the incident may have started with a compromised laptop belonging to a DevOps engineer. Binance later said it had found additional points of breach, and has not explained how the laptop was compromised.
An internal service. From the laptop, the attacker reached a service container that was allowed to submit withdrawal transactions.
Valid signatures. Binance’s own hot-wallet signing system then signed the attacker’s transfers on ten blockchains, so the transactions looked legitimate.
EIP-7702 on Ethereum. EIP-7702 is an Ethereum feature, available since 2025, that lets an ordinary wallet hand its actions to a piece of code. The attacker sent one transaction containing 50 signed authorisations that pointed a busy Binance hot wallet at a “sweeper” contract, which then emptied it. Binance’s CEO said this delegation bypassed the company’s normal approval controls. Analysts stress that EIP-7702 itself was not flawed: the problem was that the attacker could get Binance’s wallet to sign.
Laundering. The FBI said the group was converting stolen assets mainly into ether and was expected to launder them through DeFi platforms and instant swap services, and asked exchanges to block transactions linked to the attacker’s addresses.

Who is behind it

On 31 October, the FBI said North Korea was responsible, attributing the theft to TraderTraitor, a state-backed group also tracked as Lazarus Group, Jade Sleet and APT38. TRM Labs, Chainalysis and Elliptic reached the same conclusion. North Korea has denied involvement, calling the US announcement a provocation.

The group’s pattern is consistent: it targets the people and systems around crypto wallets rather than the blockchains themselves. Security firms note that targeting employees, for example with fake job offers or malicious files sent to developers, is a route the FBI has warned North Korean groups use. Before Binance, analysts already counted more than $1 billion in suspected North Korean crypto thefts in 2026, and Chainalysis counted at least $2 billion in 2025.

If you run a crypto platform: remediate now

Stop the bleeding. Pause withdrawals, isolate suspected devices and servers, and revoke the credentials of any service that can request signatures.
Revoke delegations and permissions. Check every hot wallet for unexpected EIP-7702 delegations or smart-contract approvals and revoke them; rotate keys where there is any doubt.
Freeze and trace. Contact stablecoin issuers and other exchanges immediately to freeze stolen funds, and engage a blockchain intelligence firm to trace them.
Preserve evidence and report. Keep logs and device images, and report to law enforcement (in the United States, the FBI’s IC3) and your national CERT.
Communicate clearly. Publish regular, factual updates, explain how users are protected, and publish proof of reserves when possible.

Prevent: what crypto businesses should change

Control	What to do
Separate developers from signing	No laptop or developer account should be able to reach a service that requests withdrawals. Put signing systems in a separate, tightly controlled environment
Independent transaction checks	Every withdrawal request should be checked by a policy engine that the requester cannot control: amounts, destinations, and special transaction types such as EIP-7702 delegations
Multi-party approval	Large or unusual withdrawals need approval from several people on separate devices
Limits and circuit breakers	Cap how much can leave hot wallets per hour, and stop automatically when limits are hit
Keep most funds cold	Hold only what daily operations need in hot wallets; keep the rest in offline cold storage
Harden staff devices	Endpoint detection, no local admin rights, hardware security keys, and training on fake recruiters and malicious files
Monitor and rehearse	Alert on unusual signing activity in real time, and practise incident response with tabletop exercises

Protect yourself as a crypto user

Six steps for crypto users: passkey or security key, withdrawal allowlist, anti-phishing code, keep less on exchanges, ignore refund offers, never sign blindly

Use a passkey or security key for your exchange account instead of SMS codes.
Turn on a withdrawal allowlist, so funds can only go to addresses you approved in advance.
Turn on the anti-phishing code your exchange offers, so you can recognise genuine emails.
Keep less on exchanges. Hold long-term savings in a hardware wallet you control, and keep its recovery phrase offline and private.
Ignore “refund” and “verification” messages. Scammers use big hacks as cover to impersonate support. Use only the official app or website, and never share codes or recovery phrases.
Never sign blindly. Read what your wallet asks you to approve. Requests to delegate your account or grant unlimited spending are red flags.

The takeaway

The weakest point was not the blockchain. It was one laptop and the permissions behind it.

Binance and Bitget were not robbed by breaking cryptography. Attackers reached the systems that sign transactions and made the exchanges approve the theft themselves. For crypto businesses, the lesson is to separate staff devices from signing systems and verify every transaction independently. For users, it is to protect logins strongly, keep long-term savings off exchanges, and treat every unexpected message after a hack as a likely scam.