Binance says $6.3 billion was stolen from its hot wallets

Binance says its hot wallets were compromised at around 20:05 UTC on 29 October 2026, "resulting in a loss of approximately $6.3B USD worth of token assets" (Binance, Security Incident Update #2, 30 October 2026). Hot wallets are the exchange's online wallets used to process withdrawals.

What Binance said in its first two updates

• Withdrawals: temporarily suspended while security checks were completed. Deposits were not affected.
• Cause, first view: the initial investigation suggested a compromised DevOps engineer's laptop, which let an attacker reach a service container and submit unauthorised withdrawal transactions. Binance said it had found no evidence of a wallet private key leak (Security Incident Update, 30 October 2026).
• Cause, second view: the follow-up investigation "uncovered additional points of breach".
• Frozen funds: about $3 billion frozen on-chain with the help of blockchain partners.
• Losses: Binance said it would cover all stolen funds through its Secure Asset Fund for Users (SAFU) and its corporate treasury, and had set aside more than $6.34 billion, $5 billion of it in the same tokens that were stolen.

The Financial Services Regulatory Authority of Abu Dhabi Global Market said on 30 October that it was aware of the incident and was "engaging closely with Binance and monitoring the incident" (FSRA statement). Chainalysis, the blockchain analytics firm, describes the theft as the largest in crypto history (Chainalysis).

Where the story went next

The FBI named North Korea as responsible on 31 October: see FBI blames North Korea's TraderTraitor for Binance theft. Binance's own account of how the attack began is in Binance report: the hack began with a fake job interview, and the recovery is covered in Binance reopens withdrawals; 98% of stolen assets replaced. Live prices: BTC/USD.