How a $6 billion hack became the world's biggest crypto theft

In a significant cyber incident, Binance, the world's largest cryptocurrency exchange, suffered an estimated $6.3 billion loss to hackers, marking the largest crypto theft on record. The theft transpired early Friday, with funds starting to exit Binance's hot wallets at around 12.24am UAE time on October 30. A single transaction involving roughly 167,464 Ether, valued at approximately $388 million, along with 63 other tokens, was sent to a newly created address funded through the Tornado Cash mixing service, as per Etherscan data.

The stolen assets subsequently spread across Bitcoin, Ethereum, Tron, and Ripple networks. Blockchain analytics firm Chainalysis initially estimated the total at $5.912 billion. Binance reported the impact to be around $6.3 billion, with roughly $3 billion frozen through partnerships with stablecoin issuers Tether and Circle. Preliminary investigations suggest the attacker infiltrated a DevOps engineer's laptop, gaining access to a service container to execute unauthorized withdrawals.

No evidence of leaked wallet private keys was found, and the affected access was promptly revoked. Blockchain analytics firm TRM Labs linked the attack with high confidence to North Korean hacking group TraderTraitor. Binance has suspended deposits and withdrawals and pledged to cover all losses using its SAFU insurance fund and company resources.

The industry had previously experienced about $22.7 billion in hacks, scams, and fraud between 2011 and March 2025, with $3.4 billion losses in 2025 and additional $2.35 billion to $2.68 billion in 2026, totaling roughly $26 billion to $27 billion before the Binance incident. Depending on the recovery of the Binance stolen assets, the total could potentially reach $30 billion.

The Binance theft is four times larger than the Bybit hack, equivalent to a quarter of all losses since 2011, and more than double the losses recorded in the first half of 2026. Despite the freeze, roughly $3 billion remains unaccounted for, which would be twice the previous record. Binance asserts that its operational wallets were targeted, not individual accounts, and it has pledged to reimburse customers.

However, until withdrawals resume, customers' balances are a claim on Binance. Industry analysts and security firms highlight that the largest breaches in 2026 were due to compromised credentials and devices rather than smart-contract bugs. Binance's own explanation of the compromised laptop aligns with this pattern. The incident has led to significant market turbulence, with Bitcoin falling below $77,000, Ether dropping to $2,200, and BNB falling below $700.

Approximately $1.5 billion in leveraged positions were liquidated. Law enforcement and blockchain intelligence firms are currently tracing the remaining funds, and Binance has promised updated reserve proofs and a technical post-mortem upon investigation completion. Additionally, users have been warned against unofficial links, messages, or requests for account details.