30th October 2026 – (Washington) Hackers stole about US$6.3 billion from Binance in what experts say is the biggest cryptocurrency heist to date, draining wallets the exchange uses to process transactions in a burst of activity that unfolded largely within roughly 20 minutes shortly after 8.00pm GMT on Thursday. Binance initially suspected a compromised laptop but later said an internal review had identified additional points of breach. Analysts at TRM Labs said the attackers penetrated the platform’s signing infrastructure, which authorises transactions, enabling instructions that emptied targeted wallets.
The exchange said losses will be covered through its Secure Asset Fund for Users and corporate resources. As the theft progressed, counterparties and stablecoin issuers moved to restrict the outflow, with around 50 per cent of the stolen assets in freeze‑capable stablecoins subsequently immobilised. That still leaves billions in bitcoin and ether outside any issuer’s control, limiting recovery prospects unless the funds are pushed through venues willing and able to block them or investigators obtain private keys.
Investigators and blockchain intelligence firms noted similarities with past operations attributed to North Korean hacking groups, though Binance said it has not yet identified the culprits and Pyongyang routinely denies involvement. TRM Labs drew parallels with last year’s Bybit breach, while Chainalysis reported that proceeds from an earlier Bitget attack were being mixed with flows linked to the latest raid. Explaining the mechanics, Hong Kong lawyer Joshua Chu said that, in simple terms, the attackers may not have stolen a “vault key” so much as hijacked the system that tells the vault to release funds.
Authorities worldwide have been engaged, with coordination involving United States agencies including the Federal Bureau of Investigation and the United States Secret Service, according to a person familiar with the matter. Market participants said the thieves are likely to obfuscate the trail by swapping into lesser‑known tokens, routing through multiple services and using mixing tools. Some of the proceeds have reportedly been posted as collateral to borrow ether, while blacklisting of known addresses is expected to tighten as more actors flag the tainted coins.
The incident has rattled confidence across digital assets, with cryptocurrencies falling on Friday and the aggregate value of stablecoins slipping as investors pulled back. It adds to a multiyear trend of high‑impact breaches even as large exchanges invest heavily in security. Industry figures cautioned that while freezes can quickly lock down a material share of stablecoins, bitcoin and ether remain censorship‑resistant by design, meaning substantial sums could sit idle for years if on‑ramps refuse them and investigators keep pressure on known wallets.