Binance’s Record $6.3B Crypto Hack as It Happened
Ecosystem
English | News | Latest News
- Bitcoin
- Ethereum
- Altcoins
- Blockchain
- Regulation
- Markets
- Features
- Magazine
- Reviews
- Research
- Opinion
- Podcasts
- Newsletters
- Commissioned Articles
- Press Releases
- Special Projects
About
- About Cointelegraph
- History of Cointelegraph
- Editorial Policy
- Ads Disclosure
- Financial Risk Disclaimer
Crypto Market Data (as of Oct 30, 2026)
- DOGE: $0.07548 (1.21%)
- TRX: $0.3254 (3.56%)
- LINK: $11.43 (2.89%)
- ZEC: $1,263.67 (0.93%)
- ADA: $0.1933 (0.45%)
- XRP: $1.24 (1.37%)
- ETH: $2,242.80 (0.25%)
- BTC: $77,234.35 (1.72%)
- XMR: $597.20 (1.11%)
- BNB: $704.01 (1.67%)
- XLM: $0.1691 (1.22%)
- SOL: $95.88 (2.38%)
- HYPE: $88.06 (5.87%)
Article Content
Written by Felix Ng, staff editor Edited by Bryan O'Shea, staff editor
As it happened: Binance’s record $6.3 billion crypto hack
Latest News
Published Oct 30, 2026
This article provides a detailed account of Binance’s record $6.3 billion hack, from the initial onchain alerts to the freezing of funds and a widening security investigation.
What we know about the Binance hack:
- Total impact: Estimated at $6.3 billion.
- Frozen funds: Approximately $3 billion in crypto assets, with the potential for this number to increase as investigators trace additional assets.
- Exchange operations: Deposits are operating normally, and withdrawals are expected to resume as scheduled.
- Frozen assets: Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP), and Arbitrum (ARB).
Suspected attacker: Cybersecurity analysts suspect North Korea’s TraderTraitor is behind the attack.
Additional points of breach: Binance initially attributed the hack to a potentially compromised engineer’s laptop but later uncovered additional points of breach.
Compromised mechanism: The attacker utilized a “self-destruct mechanism” to destroy tools and traces during the breach, complicating the investigation.
EIP-7702 delegation: The attacker gained execution authority over a hot wallet using an EIP-7702 delegation, which "did not pass through our normal approval controls."
Timeline of events:
- Oct. 30 at 2:34 pm UTC: Binance targets withdrawals within 40 hours, aiming to publish a full proof-of-reserves report by Monday.
- Oct. 30 at 1:57 pm UTC: Aave lifts precautionary freeze across all V3 and V4 markets, with new deposits and borrowing resumed.
- Oct. 30 at 1:11 pm UTC: Binance cooperates with the FBI to recover assets following the hack.
- Oct. 30 at 12:41 pm UTC: Binance reveals it holds $5 billion in matching tokens to cover hack losses, stored in its custody.