The Binance hack explained: what happened and what to do

What happened

Late on 29 October 2026, Binance, one of the world's largest cryptocurrency exchanges, said that about $6.3 billion worth of digital assets had been taken from its wallets. Blockchain analysis company TRM Labs put the figure at about $6.36 billion and said most of the money moved out across ten different blockchains within about 20 minutes.

Binance said it had frozen roughly $3 billion of the affected funds with the help of partners, that customer deposits were not affected, that withdrawals were paused briefly, and that it would cover all losses. Its early investigation pointed to a compromised laptop, but it later said it had found additional points of breach and would publish technical details once the investigation is complete.

Who is thought to be behind it

TRM Labs and Chainalysis both linked the attack to TraderTraitor, a group that researchers associate with North Korea. Binance itself declined to comment on attribution and said it was working with law enforcement. North Korean groups have been linked to many large crypto thefts; Chainalysis estimated they took at least $2 billion in 2025, including the $1.5 billion theft from the exchange Bybit.

What is a "hot wallet"?

A crypto wallet is not a container of coins. It is a set of secret keys that prove ownership and allow funds to be moved. Exchanges keep:

• Hot wallets: connected to the internet so customer withdrawals can happen quickly. Convenient, but reachable by attackers.
• Cold wallets: kept offline for most of the funds. Much harder to attack, but slower to use.

Think of a shop: the till holds enough cash for the day, while the bulk sits in a safe in the back. Attackers aim for the till because it is open. Our explainer on wallets and keys goes deeper.

How can stolen crypto be traced?

Most blockchains are public records. Every transfer can be seen, even if the owners are not named. Analysis firms follow the money as it moves between addresses and try to spot it arriving at exchanges or services that can freeze it. That is how part of the money was frozen quickly. Criminals respond by splitting funds into many small pieces and swapping them between different coins and services, which slows tracing but rarely stops it completely.

What you should do if you use crypto

1. Use only official apps and websites, typed in yourself or from the official app store.
2. Never share your password, 2-step codes or recovery phrase with anyone, including people claiming to be support staff.
3. Ignore "fund recovery" offers. After every big hack, scammers promise to recover lost money for a fee. They cannot.
4. Turn on strong sign-in protection, such as an authenticator app or a passkey, and a withdrawal address allow-list if your exchange offers one.
5. Keep only what you need on any exchange. Remember that crypto is not protected like a bank account in most countries.

Tip: No genuine exchange will ever ask you to move your funds to a "safe wallet" to protect them. That request is always a scam.

The bigger lesson

Even huge, well-funded companies can be breached through a single compromised device or account. For organisations, it is a reminder to limit what any one laptop or person can reach, and to keep most valuable assets offline. For individuals, it is a reminder that the scams that follow a breach are often more dangerous than the breach itself. Our analysis Why crypto exchanges keep getting hacked looks at the pattern.