The $6.3 Billion Binance Hack, Explained: What Happened, Where the Money Went, and What to Do Now

Hackers emptied Binance's hot wallets on 10 blockchains in about 20 minutes. Here is what is confirmed, what is still rumor, where the money is sitting, and what you should do about it.

By the Sphinx Agent Editorial Team · Published October 31, 2026 · Facts checked against sources up to October 31, 2026, 17:00 UTC. Numbers will change as investigators publish more. We will update this page when they do.

What happened, minute by minute

Binance keeps most customer funds in cold storage, offline. A smaller share sits in "hot wallets," which stay online so withdrawals can go out quickly. Those hot wallets were the target.

The attacker didn't hit one chain at a time over days. They hit almost everything at once. Here is the sequence, using the timeline TRM Labs built from on-chain data.¹ All times are UTC on October 29.

Binance paused deposits and withdrawals that night. Deposits were working again by Friday morning. Withdrawals stayed off while the company rebuilt its security setup.⁶ Binance says it has set aside more than $6.34 billion of company money to cover the loss, including $5 billion it already held in the same tokens. It also said it would publish a full proof-of-reserves report by Monday, November 2.²¹

How one laptop could open the door

This is the part most people are asking about, so here's exactly what Binance has said, and what it hasn't.

What Binance has confirmed

On the night of the theft, Binance said its early investigation pointed to a compromised laptop belonging to a DevOps engineer. DevOps engineers run the systems that keep a company's software working. From that laptop, the attacker reached a "service container" (a small, self-contained piece of Binance's internal software) and used it to submit withdrawal requests. Binance said it saw no sign that any wallet's private keys had leaked.⁷

The next day, the story got bigger. Binance said it had found "additional points of breach." Co-CEO Richard Teng said the attacker did not rely on one engineer's permissions and that it was not a single "one-click" action, but "a more complex attack process." Binance has promised a full technical post-mortem.⁶

Teng added two more details on October 30. He said the attacker used a "self-destruct mechanism" to wipe their tools and traces, and that the Ethereum wallet takeover "did not pass through our normal approval controls."²¹ That second point is important. It means the attacker found a path to the signer that skipped the checks a normal withdrawal goes through.

Why a laptop matters when the keys were safe

Think of Binance's signing system as a bank vault clerk who stamps every withdrawal slip. The keys never leave the clerk's desk. That part apparently held up.

The problem is that the clerk stamps any slip that arrives through the trusted internal mail slot. If an attacker can get inside the building and drop their own slips into that slot, the clerk stamps them as normal. Nothing has to be stolen. The system just does what it was built to do, for the wrong person.

That matches what TRM Labs sees on-chain. Their read is "a compromise of Binance's hot wallet signing infrastructure," because Bitcoin, Tron, XRP and Solana were all drained with normal, validly signed transfers in the same window.¹

How does an engineer's laptop get compromised in the first place?

Binance has not said how this specific laptop was hacked, or how long the attacker had access. Anyone telling you the exact method right now is guessing.

What we can tell you is how this same group has done it before, because the FBI has documented it:

• DMM Bitcoin, 2024 ($308 million). A TraderTraitor operative posed as a recruiter on LinkedIn and approached an employee at Ginco, the company running DMM's wallet system. The "pre-employment coding test" was a malicious Python script on GitHub. The attackers used that foothold to tamper with a real transaction request.¹⁶
• Bybit, February 2025 ($1.5 billion). The FBI attributed the theft to TraderTraitor.¹⁷ The investigations that followed found the attackers had gotten into a developer's machine at Safe{Wallet}, a wallet provider Bybit used, and changed what Bybit's staff saw when they approved a transfer.
• The general playbook. A joint U.S. government advisory says TraderTraitor floods crypto company employees with messages that look like job offers, then gets them to download booby-trapped apps. The targets it names are often in system administration or DevOps roles, the same kind of job Binance says was compromised here.¹⁸

The pattern is the same every time. They don't break the encryption. They fool one person with access, then use that person's trusted spot inside the network. A fake job offer to a busy engineer is cheaper than any technical exploit.

The same thing happened to hardware wallet owners this year. The secure chip held, but a trusted reseller sold devices with a spy chip inside. Attackers go around the strong part, not through it.

The Ethereum trick, in plain English

On Ethereum, the attacker did something cleverer than a normal withdrawal, and it explains why the theft kept going for hours.

Since Ethereum's 2025 Pectra upgrade, a feature called EIP-7702 lets a normal wallet hand its controls to a piece of code with one signed permission slip. It was built for convenience features like batching payments.

The attacker got Binance's system to sign one of those permission slips pointing to their own "sweeper" code. There was a catch: each slip only works if it matches the wallet's exact transaction count at that moment, and Binance's busiest hot wallet changes that count every few seconds. So the attacker had 50 slips signed in a row, one for each upcoming number. One matched. That was enough.¹

Once the code was installed, the wallet effectively belonged to the attacker. About three and a half minutes later it was emptied. And because the permission stayed in place, new deposits that kept arriving were swept too, six more times over the next three and a half hours.¹

EIP-7702 was not "hacked." It worked as designed. The real failure was that the attacker could get Binance's own system to sign whatever they asked.

Where the money is now

Every firm tracking this has a slightly different total, because they count different chains and use prices from different moments. That's normal. Here are the main estimates side by side.

What was taken, chain by chain

Source: TRM Labs.¹

Frozen: about $2.8 to $3 billion

Stablecoins like USDT and USDC are issued by companies that can block specific addresses. That's why so much was stopped so quickly. Elliptic has verified $2.85 billion frozen or seized, about 44% of the total, and 94% of that is stablecoins.³ Binance's own count is around $3 billion.⁸

• Tether: about 1.77 billion USDT across Ethereum, Tron, Avalanche and Polygon.¹
• Circle: about $825 million, mostly USDC.¹
• Ripple: 40.5 million RLUSD.¹
• World Liberty Financial: 27.8 million USD1.¹
• Arbitrum Security Council: 8,426 ETH and 74.6 million ARB.¹
• Aave froze the lending markets the attacker had used.¹

Still loose: about $2.4 to $3.2 billion

Bitcoin, ether, XRP and TRX have no company in the middle that can freeze them. Elliptic puts the unfreezable amount at about $3.21 billion.³ TRM counts over 420,000 ETH and 18,270 BTC, about $2.4 billion, plus smaller amounts elsewhere.¹

How they're moving it

The attacker clearly expected the freezes and raced them. They dumped about $325 million in USDT for ether at a loss of roughly 10% to get it out of freezable form before the issuers acted.¹ Elliptic saw some stablecoin sales at losses of 12% to 26%. Speed mattered more to them than price.³

Other moves so far:^1,3

• Deposited 60 million USDT into Aave and borrowed about 19,760 ETH against it.
• Sent 300 million USDT to a Tron wallet feeding the JustLend lending platform.
• Pushed the 18,270 BTC through a "peel chain," which shaves off small amounts into new wallets one hop at a time.
• Started routing funds through bridges and swap services between chains.

Chainalysis is also seeing something new: thousands of transactions in a short time, money cycled back to addresses used earlier, and many fresh addresses that first receive exactly 1 TRX before getting larger amounts.² TRM expects the bitcoin to move through bridges, swap services and over-the-counter brokers next.¹

Want to follow it yourself? Elliptic has published a free blocklist of more than 1,000 addresses linked to the theft, which exchanges and payment companies can screen against.³ Arkham, Etherscan and TRM also tag the attacker's wallets on their public explorers. Binance itself has not published an address list.

Who did it

The three biggest blockchain intelligence firms all land on the same name: TraderTraitor, a North Korean state-sponsored hacking unit, often grouped under the wider "Lazarus" label.

• TRM Labs says "high confidence," based on on-chain and off-chain intelligence. It points to the same habits seen at Bybit and the April 2026 KelpDAO hack: small Tornado Cash deposits to fund an operator wallet, staging well ahead of time, and pre-collected signatures fired off in one burst.¹
• Chainalysis says its strongest evidence is that Binance's stolen funds were mixed on-chain with money from last month's Bitget theft, which was already tied to North Korea.²
• Elliptic calls it "likely," citing the Bitget overlap and links to earlier TraderTraitor thefts from BigONE, WOO X and AFX. It also flags caveats: the Bitget overlap is small, the attacker was slow to convert some stablecoins, and there's no official confirmation.³

Important: these are private companies, not governments. The FBI has not publicly attributed this one yet, and Binance has not named an attacker.⁷ If North Korea is behind it, this matters beyond crypto. North Korea uses crypto theft to help fund its nuclear program while under U.N. sanctions.¹⁹

Was AI involved? The rumor, checked

A lot of posts online say AI pulled this off. We looked hard for proof. Here's where it actually stands.

Where the rumor comes from:

• The laundering looks automated. Elliptic counted 546 TRX transfers with a median gap of 96 seconds, randomized amounts, and time-sliced token sales.³ Chainalysis calls it "a programmatic process."² That is real. But a script can do all of that. Hackers have used scripts for this for years.
• Elliptic is honest about the limits. It says on-chain data cannot show whether AI agents are involved, and that it is watching for signs.³
• TV commentary got ahead of the facts. On a Yahoo Finance segment, Scott Melker said AI was "definitely helping" hide the transactions, then added it was "not necessarily the case here." He did not cite a named report.¹⁰
• Experts are warning about the future, not describing this attack. Immunefi's head of security, Goncalo Magalhaes, said: "There's no sign AI was used here."⁹ Eric Schiffer told Fox Business "the bloodbath of AI hacking is to come," which is a prediction, not a finding.¹¹

So why are we still talking about AI?

Because the real lesson here doesn't need AI to be true. One person's laptop led to a $6.3 billion loss at the biggest exchange in the world. Now imagine the slow parts of this attack done by software that never sleeps.

The slowest, most expensive parts of an operation like this are the human ones:

• Researching which employees have the access you want.
• Writing a believable recruiter persona and keeping up a conversation for weeks.
• Building a fake "coding test" that passes a quick look.
• Mapping an internal network once you're inside.
• Laundering billions across a dozen chains faster than freezes land.

AI agents, meaning AI that can take actions instead of only answering questions, are getting good at every one of those tasks. Immunefi's Magalhaes put it in one line: AI makes "finding weaknesses cheap, while fixing them still runs at human speed."⁹

We build AI agents for a living, so we'll say it plainly. The same tools that answer a small business's customers at 2 a.m. can be pointed at something far worse. The tool isn't good or bad. The person giving it instructions decides that.

Rumors vs. facts

The bigger problem: AI is finding holes faster than anyone fixes them

Binance wasn't beaten by a brand-new software bug, as far as anyone knows. But this hack landed in the middle of the worst year on record for software vulnerabilities, and the reason is AI.

The numbers

• About 13,000 new vulnerabilities were reported in October 2026 alone, roughly 400 a day, according to the Electronic Frontier Foundation. That's about 3% of all the vulnerabilities logged since 1988, in a single month. The EFF expects more than a quarter of every vulnerability ever recorded to come from 2026.¹²
• One of them took government websites offline. Eight days before the Binance hack, AI-assisted researchers disclosed PHP2Shell, a decade-old hole in the language behind most of the web. Germany, France, Belgium, the Netherlands and Finland pulled public sites offline rather than risk them.
• Monthly disclosures roughly doubled this year, from 5,045 in January to 10,740 in August, per Google's Threat Intelligence Group.¹³
• Zero-days (holes attackers use before a fix exists) are up too. Google counted an average of 8 exploited zero-days a month in 2025, 11 a month so far in 2026, and 22 in August alone.¹³
• AI-found bugs are nastier. Half of the vulnerabilities Google classed as likely AI-discovered let an attacker run their own code on the target. Across all vulnerabilities, it's about a quarter.¹³
• One AI project found more than 10,000 serious flaws within weeks. Anthropic's Project Glasswing, which gives security partners access to its Claude Mythos Preview model, reported over 10,000 high- or critical-severity vulnerabilities in widely used software by late May.¹⁴

And those are only the ones we know about

Every number above counts holes that someone found and reported. Google says public data "significantly" undercounts AI-found vulnerabilities, partly because cloud companies often fix bugs quietly without ever filing a public report.¹³

Nobody counts the holes that criminals and state hackers find and keep to themselves. Those are the ones that end up in attacks like this.

Fixes aren't keeping up

• Attackers often move first. Mandiant's M-Trends 2026 report puts the average time-to-exploit at minus seven days. In plain terms, attacks often start about a week before a fix is available. Back in 2018 that gap was 63 days in defenders' favor.¹⁵
• Companies are getting slower, not faster. Verizon's 2026 breach report found businesses took a median of 43 days to fix vulnerabilities that were already being attacked, up from 32 days the year before. Only 26% were fully fixed.²⁰
• Even AI companies say the fixing is the hard part. Anthropic has said finding vulnerabilities is now far easier than fixing them, and that "no company — including Anthropic — has developed safeguards strong enough to prevent such models from being misused."¹⁴

Put those together. Bugs are being found at double last year's pace, attackers are often a week ahead of the patch, and the average company takes six weeks to install it. That gap is where your money is exposed, whether it sits on an exchange, in an app, or on your own laptop.

What to do now to keep your funds safe

If you have money on Binance

1. Don't panic-sell. Your balance is still in your account. Binance says its shortfall is its problem, not yours.⁴
2. Get your news from the source. Use Binance's official announcements page and verified X account, not screenshots passed around in groups.
3. Lock down your login. Switch to a passkey or hardware security key if you can. Turn on the anti-phishing code in your security settings so you can spot fake Binance emails.
4. Turn on a withdrawal whitelist. That way funds can only go to addresses you've approved in advance.
5. Plan your exit, don't rush it. If you want to move funds to your own wallet, do it once withdrawals reopen and the queue calms down. Send a small test first.

For any crypto you own, anywhere

1. Only keep on an exchange what you're actively trading. Long-term holdings belong in a hardware wallet that you control. Buy it directly from the maker, though. Two 2026 attacks drained wallets through a tampered reseller and a firmware bug.
2. Write your seed phrase on paper or metal. Never type it into a website, a cloud note, or a photo.
3. Read every signature request. Wallet "permission" requests can hand over control of your whole wallet, just like what happened to Binance's. If you don't understand what you're signing, don't sign it.
4. Check and revoke old approvals with a tool like Revoke.cash or your wallet's built-in permissions page.
5. Spread your risk. Don't keep everything on one exchange or in one wallet.

If you work in crypto or tech

This is how TraderTraitor gets in, so this is where you defend.

1. Never run a recruiter's "coding test" on a work computer. The FBI's cases against this group start exactly this way.¹⁶ Use a separate, disposable machine or virtual machine.
2. Be suspicious of flattering job offers that come with files to download. Verify the recruiter through the company's real website, not the link they sent.
3. Keep personal and work devices separate. No browser extensions, side projects or personal accounts on a machine that can reach production.
4. If your machine can trigger money movement, treat it like a vault door. Push for hardware keys, second-person approval on large transfers, and alerts on unusual signing patterns, like 50 signatures in one request.
5. Patch fast. Install operating system and browser updates the day they arrive, not "this weekend."

What we still don't know

• How the engineer's laptop was first compromised, and how long the attacker had access.
• What the "additional points of breach" were.
• Why no internal control flagged the withdrawals before they went out.
• Whether the FBI or another government will formally confirm North Korea's role.
• How much of the roughly $3 billion that is still loose will ever come back.
• Whether withdrawals actually reopen on schedule.

Binance has promised a detailed post-mortem. When it's out, we'll update this page and the date at the top.

One more thing. You may have seen posts linking this hack to claims that governments want you ready for 90 days without power. We checked that too. No government advisory mentions Binance, and none asks households for 90 days.

Frequently asked questions

How much was stolen in the Binance hack?

About $6.3 billion, according to Binance. Independent estimates run from $6.01 billion (Arkham) to $6.43 billion (Elliptic). It's the largest crypto theft on record.^1,3,6

When did the Binance hack happen?

Thursday, October 29, 2026. The first funds left at about 20:05 UTC (4:05 p.m. Eastern), and most were gone within about 20 minutes.¹

Is my money safe on Binance?

Binance says users will not bear the loss. As of October 31 it said it had covered up to 90% of the stolen assets using its SAFU emergency fund, part of its futures insurance fund, and corporate treasury. It says BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC are fully backed, and it is buying the remaining less-traded tokens.⁴

When will Binance withdrawals reopen?

Binance said it was on track to resume withdrawals by Sunday, November 1, 2026, subject to final security checks.⁴

Who hacked Binance?

TRM Labs, Chainalysis and Elliptic all point to TraderTraitor, a North Korean state-backed group the FBI blamed for the 2025 Bybit theft. No government has confirmed it yet.^1,2,3

Did hackers steal Binance's private keys?

Binance says it found no evidence of a key leak. The attacker got Binance's internal systems to sign withdrawals on their behalf.⁷

Was AI used in the Binance hack?

Not as far as anyone has shown. The laundering looks automated, but investigators have not found evidence that AI was used to break in.^3,9

Can the stolen crypto be recovered?

Part of it already has been frozen, about $2.8 to $3 billion, mostly stablecoins. Bitcoin and ether can't be frozen by an issuer, so recovering those depends on catching the attacker when they try to cash out through an exchange or broker.³