Binance hack: what we know about the $6.3B breach.

On 29 October 2026, Binance, the world’s largest cryptocurrency exchange, suffered a security incident that it estimates affected around $6.3 billion in crypto assets. Blockchain analytics firm Elliptic puts the theft at $6.43 billion and calls it almost certainly the largest theft of any kind in history. Here is what Binance has confirmed, what independent researchers have found, and what is still only reported.

What happened in the Binance hack?

According to Elliptic↗ (opens in a new tab), at about 20:05 UTC on 29 October five Binance wallets on the XRP Ledger sent 233 million XRP to a single attacker-controlled address. Over the next 30 minutes, Binance hot wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Avalanche were also drained, with a second wave hitting Avalanche and Polygon shortly after 23:00 UTC.

Elliptic says the largest losses were on Ethereum, where $3.80 billion was taken across 186 tokens, including 1.9 billion USDT and 823 million USDC. It also reports 18,270 BTC (about $1.48 billion) and 612.7 million USDT on Tron stolen. These figures are Elliptic’s on-chain analysis; Binance’s own estimate is around $6.3 billion.

How did attackers get in?

In its official update↗ (opens in a new tab), Binance said its initial investigation suggests the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” Binance said it found no evidence of any wallet private key leak and will publish a detailed technical post-mortem.

In a later update reported by the BBC↗ (opens in a new tab), Binance said further investigation had “uncovered additional points of breach”, without giving details. Co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions” and that it “involved a more complex attack process”, adding that the investigation has not attributed responsibility to any individual.

The EIP-7702 technique on Ethereum

CryptoTicker↗ (opens in a new tab) reports, citing security firm Blockaid and its own on-chain checks, that the Ethereum attack used a type 4 transaction under EIP-7702, which since the Pectra upgrade lets a wallet delegate control to a smart contract. The transaction carried 50 authorizations for the hot wallet labelled “Binance 14”, all pointing to the same attacker contract. Each authorization had to be signed for that wallet, so how the attacker obtained that signing ability is a question for Binance’s post-mortem.

Who is behind it?

Elliptic says it is likely that North Korea-linked actors carried out the theft, noting that some stolen funds reached the same address as proceeds of the suspected DPRK exploit of Bitget, and that the attack is consistent with the methods of TraderTraitor, a group associated with the Lazarus Group. This is an analyst assessment: Elliptic notes that no government or law enforcement agency has confirmed attribution, and Binance has not commented on who was responsible. The BBC↗ (opens in a new tab) reports that TRM Labs said several elements of the attack resemble earlier North Korean-linked incidents such as the 2025 Bybit hack, and that Chainalysis said it has “high confidence” the North Korean group is linked. Binance did not directly respond to BBC questions about North Korea.

What has Binance done?

• Temporarily suspended withdrawals (and, initially, deposits) while security checks are completed. A later update reported by the BBC said deposits were unaffected and withdrawals were expected to resume in about 45 hours.
• Revoked the affected address authorisation.
• Worked with blockchain partners to freeze assets: Binance says about $3 billion is frozen on-chain; Elliptic has independently verified $2.84 billion frozen, almost all USDT and USDC.
• Engaged law enforcement and blockchain intelligence partners to trace and recover funds.
• Said it will cover all losses from its SAFU fund and company funds, and will publish an updated Proof of Reserves after remediation.

Elliptic reports that the attacker is swapping non-frozen funds into ETH and other assets that cannot be frozen.

What should Binance users do?

• Check updates only through the Binance app or a website address you already trust, as NordVPN CTO Marijus Briedis advised via the BBC.
• Watch for follow-on scams: Briedis warned of emails claiming your funds are at risk, fake support accounts offering help, and messages urging you to move crypto to a “safe” wallet.
• Never give anyone your password, verification codes or wallet recovery phrase, and treat pressure to act immediately as a reason to pause.
• Elliptic says its customers can already screen incoming funds against addresses it has attributed to the theft.

What does this mean for AI and security?

None of the sources we reviewed say AI was used to carry out the attack. What they stress is the human and infrastructure angle. Check Point’s Jayant Dave told the BBC: “The attackers didn’t break the encryption or steal the private keys. They took over the system that tells the keys what to sign.” Emily Taylor of the Global Signal Exchange told the BBC that a signature hacker technique is luring engineers with fake job adverts and persuading them to download a test or other software that compromises their computer. Elliptic notes the FBI has warned that TraderTraitor targets crypto staff this way. How the Binance laptop was first compromised has not been published.