Binance Hit by $6.3 Billion Hack: Bitcoin Slides Toward $76,000 as North Korea Is Blamed

Last updated: October 30, 2026. This story is developing, and we will update the article as Binance and investigators release new details.

The crypto market woke up to bad news on Friday, October 30, 2026. Binance, the world’s largest cryptocurrency exchange, confirmed a major security incident late on Thursday, October 29. Investigators describe it as the biggest crypto hack in history, with roughly $6.3 billion in digital assets moved out of Binance wallets. Bitcoin fell to a six-week low near $76,400 within hours, and the sell-off spread to Ether, BNB, and crypto-linked stocks.

Also readBefore Debt Recovery in Dubai: Legal Checks for Businesses

If you hold crypto, trade on exchanges, or simply follow digital-asset markets, this story matters. In this guide, we explain what happened, how the attackers likely got in, why Tether, Circle, and Ripple froze funds, who is being blamed, and what the hack means for Bitcoin’s price and your own security.

In this article

1. Key Facts at a Glance
2. What Happened to Binance?
3. How Did the Hackers Break In?
4. Tether, Circle, and Ripple Step In to Freeze Stolen Funds
5. North Korea Linked to the Attack
6. Market Reaction: Bitcoin, Ether, BNB, and Crypto Stocks
7. Is This a Solvency Crisis for Binance?
8. How Does This Compare With the Bybit Hack?
9. What Should Crypto Users Do Right Now?
10. What to Watch Next
11. Frequently Asked Questions
12. Final Thoughts

Key Facts at a Glance

• Amount affected: About $6.3 billion (TRM Labs puts it at $6.36 billion) moved out of Binance wallets across 10 blockchains, most of it in about 20 minutes.
• Frozen so far: Binance says roughly $3 billion has been frozen on-chain. That leaves about $3 billion or more outside the frozen total.
• Suspected attackers: TRM Labs, Elliptic, and Chainalysis link the theft to North Korea’s TraderTraitor group, the same group tied to the 2025 Bybit hack.
• Customer impact: Withdrawals are paused, while deposits are working normally. Binance says user funds are safe and it will cover all losses.
• Restart timeline: Binance expects to resume withdrawals within 48 hours, after it finishes a security overhaul of its withdrawal service.
• Market impact: Bitcoin dropped about 4% to 5% at the worst point, Ether about 5% to 6%, and BNB between roughly 5% and 10%, depending on the tracker and the time.

What Happened to Binance?

Late on Thursday, Binance acknowledged a “potential security issue” and moved fast to contain it. The exchange paused customer withdrawals and trading on its Binance Alpha platform while security teams and outside investigators ran checks. Within hours, the scale of the incident became clear. TRM Labs reports that the attacker moved about $6.36 billion out of Binance wallets on ten blockchains, which makes this the largest crypto theft ever recorded.

Binance co-CEOs Yi He and Richard Teng have led the public response. Binance.US and Coinbase both said they were not affected.

Withdrawals Paused, Deposits Unaffected

Early reports said Binance had stopped both deposits and withdrawals. Binance has since clarified that deposits operate normally. Only withdrawals remain paused. The exchange says it is rebuilding its withdrawal service and related addresses, and it expects to restart withdrawals within 48 hours. Binance gave this as a target rather than a firm promise, so timelines could change. The pause hurts traders who wanted to move funds during a falling market, and that uncertainty adds pressure on prices.

Binance Promises to Cover All Losses

Binance says user funds are safe and that it will cover every loss. It plans to pay from its Secure Asset Fund for Users (SAFU), which holds roughly $1.2 billion, plus company funds. Binance’s founder Changpeng Zhao, who no longer runs the exchange, said as a shareholder he expects users to be fully covered. For ordinary account holders, this pledge is the most important piece of reassurance.

How Did the Hackers Break In?

Full details are not public yet, and the story has already changed once. Binance’s first findings pointed to a compromised laptop belonging to a DevOps engineer. According to Binance, that access let the attacker reach an internal service and submit unauthorized withdrawal transactions. Later on Friday, the exchange said investigators had found additional points of breach. Teng said the attack was more complex than a single “one-click” action and that no individual has been blamed. Binance also says it found no evidence that wallet private keys leaked.

Binance also pointed to several features that match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals that funded an operator wallet, preparation that started well before the theft, and signatures collected in advance and then used in one quick burst. Here is why these details matter:

• People are the weak point. Even strong cryptography fails when one employee device gets infected.
• The attack was planned. Staging before the theft suggests the attackers were inside long before anyone noticed.
• Speed matters. Moving billions across ten blockchains in about 20 minutes leaves almost no time to react.

Tether, Circle, and Ripple Step In to Freeze Stolen Funds

One reason the damage is not even larger is that stablecoin issuers acted quickly. Stablecoins like USDT, USDC, and RLUSD are centralized enough that their issuers can block specific addresses.

Tether Freezes About $1.57 Billion

Tether froze roughly $1.57 billion of USDT linked to the hack. As the world’s largest stablecoin issuer, Tether holds a lot of power in situations like this, and it used it within hours.

Circle Freezes Another $800 Million

Circle, the second-largest stablecoin issuer, froze over $800 million of USDC in coordination with law enforcement. Together, Tether and Circle froze about $2.4 billion.

Ripple and Others Add to the Freeze

Ripple froze about $200 million in RLUSD, and Binance’s Yi He publicly thanked the team. The Arbitrum Security Council also froze about $30.5 million in ARB and ETH, and World Liberty Financial worked with custodian BitGo to freeze part of its tokens. Binance’s own verified frozen total rose from $2.54 billion to about $3 billion during Thursday night and Friday.

Still, not everything can be frozen. Native coins like Bitcoin and Ether on public blockchains have no issuer who can lock them. That limitation leaves a large portion of the stolen funds in the attackers’ hands.

North Korea Linked to the Attack

Several blockchain analytics firms have tied the theft to North Korean hackers. According to TRM Labs’ analysis, the attack matches the group behind last year’s Bybit hack, known as TraderTraitor, and the firm attributes it with high confidence. Chainalysis also believes TraderTraitor is responsible, and the FBI previously named the same group for the Bybit theft.

Elliptic’s research estimates that about 44% of the stolen assets have been frozen, almost all of them stablecoins. Estimates of what remains unfrozen vary from about $2.9 billion to $3.3 billion, so treat any single figure as provisional.

A Pattern of State-Backed Crypto Theft

This is not North Korea’s first major crypto heist. Chainalysis data shows that North Korean hackers stole about $2 billion in 2025, bringing their total since 2016 to roughly $6.75 billion by the end of last year. If the Binance attribution holds, this single attack nearly matches that entire decade-long total.

Market Reaction: Bitcoin, Ether, BNB, and Crypto Stocks

Markets reacted fast. Fear of contagion pushed prices down across the board, and CoinDesk data cited by media put total crypto liquidations near $1.5 billion.

• Bitcoin (BTC): Fell to a six-week low of about $76,400 to $76,650, down roughly 4% to 5% at the worst point, then recovered to around $78,500 on Friday morning.
• Ether (ETH): Dropped to a two-month low near $2,180 to $2,200, a fall of roughly 5% to 6%.
• BNB: Binance’s native token traded near $700, down roughly 5% to 10% depending on the tracker and the time of day.
• Crypto stocks: Coinbase fell nearly 5% and Strategy nearly 6% in extended US trading, and Circle shares also declined.

The stock drop shows how closely traditional markets now connect to crypto. When a giant exchange gets hit, investors worry about the entire sector, not just one company. Prices are moving quickly, so check a live tracker for current figures.

Is This a Solvency Crisis for Binance?

This is the question investors care about most. Fundstrat’s head of digital assets, Sean Farrell, argued that while this is the largest crypto hack on record, it does not currently look like a solvency event for Binance. By his estimate, about $3.3 billion remains unfrozen. If frozen stablecoins are eventually returned, the roughly $1.2 billion SAFU fund could cover about a third of the remaining loss, and Binance’s own funds would cover the rest. Binance held about $144 billion in customer assets before the hack, so the theft equals roughly 4% of that total.

That view makes sense for now, mainly because Binance has pledged to cover losses and has already frozen a large share of the stolen funds. But the situation is still developing. If recovery efforts stall or the pause on withdrawals drags on, sentiment could worsen. Farrell said the key indicators to watch are how quickly withdrawals resume and whether outflows stay orderly.

How Does This Compare With the Bybit Hack?

Before this incident, the largest crypto theft on record was the February 2025 attack on Bybit, where hackers took about $1.5 billion in Ether. The Binance hack is roughly four times larger. It also shows that the same threat group has grown more ambitious, moving from a major derivatives exchange to the biggest platform in the industry.

What Should Crypto Users Do Right Now?

You cannot control an exchange’s security, but you can reduce your own risk. Follow these steps:

1. Stay calm and avoid panic selling. Binance says user funds are safe and covered, and selling in fear often locks in losses.
2. Use official channels only. Check Binance’s verified accounts for updates, and ignore DMs or emails offering “compensation,” “recovery,” or an early “withdrawal unlock.”
3. Enable strong two-factor authentication. Prefer an authenticator app or hardware key over SMS.
4. Diversify where you store assets. Do not keep everything on one exchange. Consider a hardware wallet for long-term holdings.
5. Watch for phishing scams. Hacks like this attract fraudsters who copy official branding to steal credentials. A trusted VPN also helps on public Wi-Fi; see our guide on what a VPN is and how it works.
6. Review your exposure. Know which exchanges, tokens, and crypto-related stocks you hold, so you can judge your real risk.

What to Watch Next

• Resumption of withdrawals: Binance targets a restart within 48 hours. A smooth restart would calm nervous users.
• Recovery of stolen funds: More freezes and law-enforcement action could shrink the loss, especially if the attackers try to move the unfrozen coins.
• Binance’s final investigation report: It should clarify how the attackers gained access beyond the first compromised laptop. Binance also plans a fresh proof of reserves.
• Regulatory response: Lawmakers and regulators may use this event to push for stricter exchange security rules.
• Market stability: Bitcoin’s reaction around the $76,000 to $78,000 range will show whether fear is fading or growing.

For independent reporting while the story develops, see CNBC’s explainer on what happens next and NPR’s report on the North Korea link. For more market and technology coverage, visit our Business To Mark homepage or browse our U.S. News section.

Frequently Asked Questions

Is my money safe on Binance?

Binance says user funds are safe and that it will cover all losses using its SAFU fund and company reserves. Deposits work normally, but withdrawals are temporarily paused while security upgrades continue. Binance is not a bank, and exchange balances are not automatically insured, so the pledge depends on Binance following through.

When will Binance withdrawals resume?

Binance says it expects to resume withdrawals within 48 hours of its Friday update. This is a target, not a guarantee, so watch official Binance announcements.

Who is responsible for the Binance hack?

TRM Labs, Elliptic, and Chainalysis link the attack to North Korean hackers, specifically the TraderTraitor group, which was also tied to the 2025 Bybit theft. Binance has not blamed any individual employee.

How did the hackers get into Binance?

Binance’s first findings pointed to a compromised DevOps engineer’s laptop that gave access to an internal service. The exchange later said investigators found additional points of breach, so the full picture is still emerging.

Why did Bitcoin fall after the hack?

Investors feared contagion. A hack of this size on the largest exchange raises concerns about trust, liquidity, and possible forced selling across the market.

Final Thoughts

The $6.3 billion Binance hack is a turning point for crypto security. It shows that even the biggest, best-funded exchanges remain vulnerable, especially when attackers target the people and devices behind the infrastructure. The quick action by Tether, Circle, Ripple, and Binance has limited the damage, and the pledge to cover user losses reduces the immediate risk for customers. But with billions still outside the frozen total and state-backed hackers behind the theft, the industry faces hard questions about security, oversight, and trust.

For now, the smartest move is to stay informed, protect your own accounts, and rely on verified sources as the story develops.

Disclaimer: This article is for informational purposes only and is not financial advice. Cryptocurrency investments carry high risk. Always do your own research before making any decision.