Binance Hacked for $6.3 Billion: How the Biggest Crypto Heist in History Happened (And What Indian Users Should Do)
Hackers drained $6.3B from Binance in 20 minutes. Here's exactly how the attack worked, who's blamed, if your funds are safe, and 7 steps to take right now.
On this page 11 sections
- 01What happened? The Binance hack in 30 seconds
- 02Timeline: how the heist unfolded
- 03How the hack actually worked (explained simply)
- 04What was stolen? Breakdown by blockchain
- 05Who is behind the Binance hack?
- 06Is my money on Binance safe?
- 07How big is this? Compared with past crypto hacks
- 08Market impact: Bitcoin, BNB and crypto stocks fall
- 09What Indian Binance users should do right now
- 10Lessons from the Binance hack
- 11Frequently asked questions
Last updated: 31 October 2026, IST
⚡ Key takeaways
- Hackers drained about $6.3 billion (≈ ₹53,000 crore) from Binance on 29 October 2026 — the largest crypto theft ever recorded.
- Most of the money left in about 20 minutes, across 10 blockchains.
- Blockchain firms TRM Labs and Chainalysis blame North Korea’s “TraderTraitor” unit (linked to the Lazarus Group). Binance has not named anyone yet.
- Binance says user funds are safe and it will cover all losses. Deposits and withdrawals were paused; Binance said they should restart within about 48 hours.
- Around $2.7–3 billion has already been frozen by Tether, Circle and others.
- Biggest risk for you now: fake “Binance support” and “fund recovery” scams.
Binance, the world’s largest crypto exchange, has suffered the biggest crypto heist in history. Attackers moved roughly $6.36 billion out of Binance wallets late on 29 October 2026 (early hours of 30 October in India), according to blockchain analytics firm TRM Labs. That is about four times bigger than the previous record — the $1.5 billion Bybit hack of February 2025.
Many people online are calling it the “Binance scam”. To be clear: this was not a scam run by Binance. It was a hack — outside attackers broke into Binance’s systems. But scams are now following it, and that is where ordinary users are most at risk. Below we explain exactly how the attack worked, who is behind it, whether your money is safe, and what you should do today.
What happened? The Binance hack in 30 seconds
On the evening of 29 October (UTC), attackers took control of Binance’s hot wallets — the online wallets an exchange uses to process everyday withdrawals. They then sent the funds to wallets they controlled. Binance froze all deposits and withdrawals the same day.
Binance’s first investigation traced the entry point to a hacked laptop belonging to one of its DevOps engineers. A day later, the company said it had found “additional points of breach”, and co-CEO Richard Teng said it was “not a single ‘one-click’ action” — meaning the attack was more complex than one stolen login.
Timeline: how the heist unfolded
| When | What happened |
|---|---|
| ~36 hours before | Attacker funds an “operator” wallet with small withdrawals from the Tornado Cash mixer and test-runs its code (TRM Labs). |
| 29 Oct, 20:05 UTC (30 Oct, 1:35 AM IST) | Main drain begins. Most of the $6.3B leaves Binance wallets on 10 blockchains in about 20 minutes. |
| ~23:05 UTC (4:35 AM IST) | A second wave of outflows. |
| 29 Oct | Binance suspends all deposits and withdrawals. |
| Hours later | Tether, Circle, Ripple and others start freezing stolen stablecoins. Attacker races to swap USDT into ETH before more is frozen. |
| 30 Oct | Binance confirms “additional points of breach”, says it is working with law enforcement, and expects withdrawals back in ~45–48 hours. |
How the hack actually worked (explained simply)
Binance has promised a full post-mortem but has not published the root cause yet. Here is what investigators have pieced together so far.
Step 1: A hacked engineer’s laptop
According to Forbes, Binance said a compromised laptop of a DevOps engineer gave the attacker access to a “service container” — part of the internal system that approves withdrawals. North Korean groups commonly get in this way, using fake job offers, booby-trapped files or malicious coding tools sent to employees.
Step 2: Taking over the withdrawal system
Binance says it has found no evidence that any wallet’s private key was leaked. Instead, the attacker appears to have abused the system that signs transactions. On nine of the ten blockchains, the stolen funds left through normal-looking signed transfers. TRM Labs concludes the attacker most likely compromised Binance’s hot-wallet signing infrastructure.
Step 3: A clever Ethereum trick
On Ethereum, the attacker used a feature called EIP-7702, which lets a normal wallet temporarily act like a smart contract. They turned a Binance hot wallet into a “sweeper” that automatically emptied itself — pre-loaded with 50 signed authorisations so at least one would match the wallet’s next transaction.
Step 4: Drain fast, then race the freezes
Speed was the whole plan. Stablecoins like USDT and USDC can be frozen by their issuers, so the attacker quickly:
- Sold about 325 million USDT for ~122,300 ETH via UniswapX — accepting a 10%+ discount just to get out fast.
- Deposited USDT into lending apps (Aave, JustLend) and borrowed ETH against it.
- Split the stolen Bitcoin into neat 1,000 BTC and 100 BTC chunks across fresh wallets (a “peel chain”).
What was stolen? Breakdown by blockchain
Who is behind the Binance hack?
Both TRM Labs and Chainalysis say, with high confidence, that the attack was carried out by TraderTraitor — a North Korean state hacking unit linked to the infamous Lazarus Group. The FBI blamed the same unit for the 2025 Bybit hack, and TRM says the methods match other North Korea-linked heists, including the KelpDAO hack in April 2026.
Binance itself is more careful. Richard Teng said its investigation “has not attributed responsibility to any individual.” North Korea routinely denies involvement in hacking. Experts say stolen crypto helps fund the country’s economy and its sanctioned weapons programmes — which is why TRM’s Ari Redbord called this “a global security issue, not just a crypto theft” (Al Jazeera).
Is my money on Binance safe?
Binance says yes. The exchange has publicly stated that “user funds are safe” and that it will cover 100% of losses using its emergency fund (SAFU) and company reserves. It says it has set aside more than $6.34 billion to cover the hole, including about $5 billion already held in the affected tokens.
A few honest points to keep in mind:
- The loss is several times larger than the SAFU fund (set up in 2018, roughly $1 billion+), so most of the cover comes from Binance’s own balance sheet.
- About $2.7–3 billion has been frozen and may be recovered. Roughly $2.4–2.9 billion is still in attacker wallets, mainly ETH and BTC.
- Binance has warned the final number may change as it keeps tracing funds.
- Until withdrawals reopen, you cannot move funds off Binance. Binance co-founder Yi He said they should resume by Sunday (1 November).
How big is this? Compared with past crypto hacks
| Hack | Year | Amount |
|---|---|---|
| Binance | 2026 | ~$6.3 billion |
| Bybit | 2025 | ~$1.5 billion |
| WazirX (India) | 2024 | ~$235 million |
| All hacks combined (TRM) | 2025 | ~$2.87 billion (≈150 attacks) |
In other words, this single attack is more than double what hackers stole across the entire crypto industry in 2025.
Market impact: Bitcoin, BNB and crypto stocks fall
- 🔻 Bitcoin dropped to a six-week low of about $76,400.
- 🔻 Ether fell more than 3% to a two-month low near $2,178.
- 🔻 BNB slid about 5.6% to around $679.
- 💥 More than $1.6 billion in leveraged positions were liquidated in 24 hours, mostly longs (CoinGlass data via Yahoo Finance).
- 📉 Crypto stocks like Coinbase, Strategy and Circle fell 5–7%, even though Coinbase said it was not affected.
Markets steadied after the first shock, but analysts note crypto was already under pressure from high US interest rates and weaker ETF demand.
What Indian Binance users should do right now
Binance is widely used in India for spot trading and P2P USDT–INR deals. If you have funds there, here is a simple checklist:
- Don’t panic-sell. Binance has committed to covering losses. Selling in a panic market often locks in the worst price.
- Ignore anyone offering “fund recovery”. Fake Binance support agents on Telegram, WhatsApp, X and email are already active after the hack. Binance will never ask for your password, 2FA code or seed phrase.
- Only trust official channels. Check updates on Binance’s official app and verified X accounts — not links sent to you.
- Turn on strong security. Use an authenticator app or passkey (not SMS), set an anti-phishing code, and enable withdrawal address whitelisting.
- P2P traders, be extra careful. During paused withdrawals and price swings, watch for fake payment screenshots and “urgent” counterparties. Only release crypto after the money is actually in your bank.
- Don’t keep everything on one exchange. Once withdrawals reopen, keep only trading money on exchanges and move long-term holdings to a wallet you control.
- Keep your records. Screenshot your balances and transaction history now, in case you need them later.
🚨 Scam alert: If someone messages you saying they can “unlock” or “recover” your Binance funds for a fee — it is a scam. There is no fee to get your money back. Report such accounts and block them.
Lessons from the Binance hack
The biggest lesson is that even the largest exchange in the world can be breached — and often through people, not code. One compromised work laptop opened the door. For users, the takeaway is the old crypto rule: “not your keys, not your coins.” Exchanges are convenient for trading, but they are also the biggest targets.
We will update this article as Binance publishes its official post-mortem and withdrawals resume.
Frequently asked questions
Was Binance hacked or was it a scam?
It was a hack by outside attackers, not a scam by Binance. Attackers broke into Binance’s hot-wallet systems and moved about $6.3 billion out. Scammers are now using the news to trick users.
How much money was stolen from Binance?
About $6.36 billion according to TRM Labs (Chainalysis estimated $5.9 billion at the time). Around $2.7–3 billion has since been frozen.
Who hacked Binance?
TRM Labs and Chainalysis attribute it to North Korea’s TraderTraitor group, linked to Lazarus. Binance has not officially named anyone.
Will I lose my money on Binance?
Binance says user funds are safe and it will cover all losses from its SAFU fund and company reserves.
When will Binance withdrawals resume?
Binance said withdrawals should restart within about 45–48 hours of its 30 October update, around Sunday, 1 November 2026. Check Binance’s official app for the latest status.
Disclaimer: This article is for information only and is not financial advice. Crypto assets are volatile and risky. Figures are based on reports from TRM Labs, Chainalysis, Binance statements and major news outlets as of 31 October 2026 and may change.
This guide is for information only and isn’t financial advice. Rates, fees and rules change — always confirm on the official website before you decide. Read our disclaimer.
