Hackers took about $6.36 billion from Binance’s hot wallets on ten blockchains on Thursday, October 29, in the largest crypto theft on record, a Binance hack the exchange says began with an engineer’s compromised laptop.
Most of it was gone in about 20 minutes. Tether and Circle froze about $2.6 billion of stolen stablecoins within an hour, and Binance now puts the verified frozen total at around $3 billion. The exchange has promised to cover every loss and paused withdrawals, which it expects to reopen by Sunday.
The market didn’t wait. BNB fell 8.7% in an hour, Bitcoin slid below $77,000, and about $1.5 billion in leveraged positions were wiped out. So what exactly happened, how much is really gone, and where does BNB go from here?
Breaking: The hackers behind the $6B #Binance hack, $1.5B #Bybit hack, and $388M #Bitget hack may all be linked to North Korea's Lazarus Group.https://t.co/4IESZvOjHJ
— Lookonchain (@lookonchain) October 30, 2026
What Happened in the Binance Hack?
An attacker got Binance’s own systems to sign withdrawals out of its hot wallets, the online wallets an exchange uses to pay out customers. Binance said on Friday that its first findings point to a DevOps engineer’s compromised laptop, which let the attacker reach a service container and send unauthorized withdrawal transactions. It found “no evidence of any wallet private key leak.”
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
— Binance (@binance) October 30, 2026
The heist had been staged for more than a day. TRM Labs’ reconstruction lays out the timeline (times in UTC):
- October 28, morning: the attacker’s operator wallet is funded with three small withdrawals from the Tornado Cash mixer.
- October 29, earlier in the day: the attack code is tested on two wallets, rehearsed on a third, then installed on a Binance hot wallet about four hours later.
- 20:05–20:09: five Binance XRP Ledger wallets send 233.46 million XRP to a single address.
- 20:20: a Binance Bitcoin hot wallet sends 18,270 BTC, and a Tron wallet follows with 612.7 million USDT within two minutes.
- 20:23: the main Ethereum hot wallet empties: 167,464 ETH and 1.615 billion USDT.
- 21:29: Binance posts that it is investigating “a potential security issue.”
- 23:05: a second wave hits Binance wallets on Avalanche and Polygon.
On Ethereum, the attacker used EIP-7702, a feature added in the May 2025 Pectra upgrade that lets a normal wallet hand its controls to a smart contract. The hot wallet signed 50 such handovers to a “sweeper” contract, so new deposits kept getting drained for hours: TRM counted six more sweeps between 20:41 and 23:56.
TRM attributes the attack “with high confidence” to TraderTraitor, the North Korean unit the FBI blamed for the $1.5 billion Bybit hack in February 2025. Binance hasn’t named anyone.
How Much Was Stolen, and How Much Did Tether and Circle Freeze?
About $6.36 billion left Binance, and roughly $2.7 billion of it is frozen. That is TRM’s count at 00:30 UTC on Friday, valued at prices at the time of each transfer. Binance’s own figure is “around $6.3B” stolen and around $3 billion verified frozen, and it says that number may still rise.
Ethereum took the biggest hit, about $3.79 billion, followed by the 18,270 BTC from the Bitcoin wallet, worth about $1.47 billion.
Stablecoins were the attacker’s weak spot, because their issuers can block an address. The freezes came fast:
- Circle: at 21:04 UTC it froze 823 million USDC in the main receiving wallet. CEO Jeremy Allaire said Circle acted “in coordination with law enforcement.”
- Tether: 971.1 million USDT was frozen at 21:01, and CEO Paolo Ardoino put the total above 1.567 billion USDT by 21:25. TRM now counts about 1.77 billion USDT frozen across Ethereum, Tron, Avalanche and Polygon.
- Ripple: froze 40.5 million RLUSD at 22:01, after the attacker had sold 48 million on decentralized exchanges.
- World Liberty Financial: froze 27.8 million USD1.
- Arbitrum: its Security Council forced 8,426 ETH and 74.6 million ARB, about $30 million, out of the attacker’s wallet.
The rest is moving. TRM says the attacker still controls about $2.4 billion, including the BTC, which is being split into 1,000 BTC and 100 BTC pieces. About 325 million USDT was swapped for roughly 122,300 ETH through UniswapX, paying more than 10% over the market price for the ether, the cost of getting out before Tether could act. Ethereum can’t be frozen by an issuer.
A frozen balance isn’t money back in Binance’s hands, though. Releasing it takes the issuers, law enforcement and, in some cases, courts, and none has given a timeline.
CZ Warned About Phishing for Days. What Has Binance Said Since?
Binance founder Changpeng Zhao (CZ) had spent the week telling traders to lock down their accounts. On October 23 he argued that AI is a bigger threat to crypto users through leaked data and sharper phishing than through any attack on encryption. On Wednesday he posted a checklist after four data leaks in a day, at Coinbase’s vendor Amplitude, Korea’s Bithumb and two Korean brokers. His line on breaches: “scammers move fast after one.”
The next day, his own exchange was the one in the headlines. Binance hasn’t said how the engineer’s laptop was compromised. But it shows the same weak point CZ kept flagging: one person’s device.
Since the theft, CZ and co-CEO Yi He have kept to one message: users won’t pay. “Loss might be a bit higher than that, but will cover,” CZ replied on Thursday night. Hours later he added: “It hurts, but we will survive.”
The latest updates, as of Friday morning:
- Withdrawals: paused on all networks. In a service update at 04:36 UTC, Binance said it is rebuilding its withdrawal service and addresses and expects to resume “within 48 hours.”
- Deposits: working as normal.
- Other services: Binance Alpha trading is suspended, and Friday’s PREDICT listing is postponed.
- Root cause: “multiple factors,” with a full post-mortem to follow.
- Binance.US: not affected, as a separate platform.
The phishing risk is now Binance’s users’ problem too. Yi He’s latest post on Friday asked users to trust only official Binance channels and not to click unofficial links or share account details with anyone. Fake “refund” and “withdrawal verification” messages usually follow a hack like this.
How Did the Market React to the Binance Hack?
With a fast sell-off, then a partial bounce. BNB, Binance’s own token, fell from $744.90 to $680 in the 20:00 UTC hour, an 8.7% drop. Bitcoin went from $80,849 to $76,500 by early Friday, and Ether from $2,337 to $2,174.
Leverage made it worse. CoinGlass shows $1.55 billion in liquidations over 24 hours, hitting 239,610 traders, and 83.6% of it, $1.29 billion, came from long bets. Bitcoin positions made up $501.6 million and Ethereum $360.6 million. Binance itself handled 49.4% of the total, including the largest single order: an $11.09 million BTCUSDT long closed at $79,254.71.
The Crypto Fear & Greed Index dropped from 51 to 30, into “fear.”
Bitcoin’s low came within $30 of its 200-day exponential moving average (EMA) at $76,473, and buyers stepped in there. It trades near $78,000 now.
BNB Price Analysis: Can BNB Hold $680 After the Binance Hack?
So far it has. BNB bounced to $720 by 03:00 UTC as Binance repeated that it would cover all losses, but sellers capped it there, and it is back at $706, down 6.2% in 24 hours.
- Resistance: $720, Friday’s rebound high, then $745.74, where BNB traded before the hack.
- Support: $692.49, the 200-day EMA, then $680, the low of the hack hour. Below that, $674.60, the September 1 low.
| Path | What has to happen | Next stop |
|---|---|---|
| Push higher | A daily close above $720 | $745.74, the pre-hack level |
| Stall | Holding between $680 and $720 | Sideways trade until withdrawals reopen |
| Slip | A daily close below $680 | $674.60, the September 1 low |
The next test is the 48-hour window. If Binance reopens withdrawals by Sunday morning without a rush for the exits, the worst of this Binance hack may already be in the price. If the reopening slips, $680 is the level to watch.
EXPLORE: Best Meme Coin ICOs to Invest in 2026
Follow 99Bitcoins on X For the Latest Market Updates, and Subscribe on YouTube For Daily Expert Market Analysis.
The post Binance Loses $6.3Bn in Largest Crypto Theft Ever as Tether and Circle Freeze $2.6Bn: What We Know About Binance Hack appeared first on 99Bitcoins.
Source: https://99bitcoins.com/news/altcoins/binance-hack-tether-circle-freeze/
