On the evening of Thursday 29 October 2026 funds started leaving the wallets of Binance, the world's largest crypto exchange. Within hours it was clear this was the largest theft in crypto history: about $6.3 billion, more than four times the previous record. About $3 billion was frozen, the FBI named North Korea as responsible, and Binance says it has replaced 90% of the assets and users will not bear the loss. Here is the full story hour by hour, its impact on Bitcoin and BNB, and what it means for you as a trader.
Latest updates (Sunday 1 November)
Full analysis: what the hack means for Bitcoin and traders →
- The FBI named North Korea as responsible on Saturday evening and said the attackers converted the funds to Ethereum to move and launder them.
- Binance has replaced 90% of the stolen assets, up from 80% on Friday, from its treasury, part of its user protection fund (SAFU) and part of its futures insurance fund. It said: "Binance will absorb the financial impact of these stolen funds, not our users."
- Withdrawals reopen in phases from Sunday 1 November after final security checks; deposits and unaffected services stayed open throughout.
- Proof of reserves: results of the new reserves snapshot are expected on Monday 2 November; the full proof takes 40 to 50 hours to generate.
The full story hour by hour (Mecca time)
The attack begins: funds leave the exchange's hot wallets, and users notice before any announcement.
BNB falls to $677.5, −10% from Wednesday's close, 42 minutes after the attack began.
Binance pauses withdrawals on several networks as a precaution while deposits continue. Tether freezes more than $1.5 billion and Circle more than $800 million.
Binance confirms about $6.3 billion of client assets were affected, pledges to cover the losses in full and sets aside more than $6.34 billion.
Bitcoin hits its low of the crisis: $76,287, −6.2% from Wednesday's close ($81,294).
80%, then 90% of the assets replaced; the FBI names North Korea.
Withdrawals reopen in phases after security checks.
Proof-of-reserves results.
How did the hack happen?
In its first explanation Binance said the attacker compromised the laptop of one of its DevOps engineers, used it to reach an internal service environment, and submitted unauthorised withdrawals from the hot wallets, the internet-connected wallets that serve day-to-day withdrawals.
Co-CEO Richard Teng later said the operation was more complex than one engineer's permissions and that the investigation found further breach points, while stressing there is no evidence that wallet private keys leaked. The exchange says more technical detail will follow when the investigation ends.
Who is behind it?
The FBI has named North Korea as responsible. Blockchain analytics firms attribute it to the TraderTraitor group linked to Lazarus, using the same playbook as earlier thefts: small withdrawals to fund an operator wallet, staging well in advance, then executing everything in one burst.
The attackers converted much of the money to Ethereum to move and launder it, while stablecoin issuers froze about $3 billion before it could move.
The impact on the market
The chart compares the main cryptocurrencies against Wednesday 28 October's close, the day before the attack. BNB, Binance's own coin, fell harder than Bitcoin.
The largest theft in crypto history
The previous record was about $1.5 billion in 2025. The Binance hack is more than four times larger.
What does it mean for you as a trader?
- Turn on two-factor authentication on every trading account and wallet, and use a withdrawal address whitelist if the platform offers one.
- Don't keep all your money in one place, and keep on any platform only what you need for trading.
- Deal with licensed, regulated companies, and read how client money is held before you deposit.
- Big news makes big swings: set your stop loss and position size before you enter, not after.
Video: the story in a minute
Trade Bitcoin and crypto with TNFX
Trade Bitcoin and the main cryptocurrencies long or short on MT5. Try it first on a free demo account, or open a live account when you are ready.
Common questions
What happened to Binance?
On 29 October 2026 Binance was hacked and about $6.3 billion was stolen from its hot wallets, the largest theft in crypto history. It paused withdrawals and pledged to compensate users in full.
Are user funds on Binance safe?
Binance says it will absorb the loss itself and had replaced 90% of the assets by 31 October, with proof-of-reserves results expected on 2 November. Follow the exchange's official announcements before any decision.
Who stole the money from Binance?
The FBI named North Korea as responsible; blockchain analytics firms attribute the attack to the TraderTraitor group linked to Lazarus.
When do Binance withdrawals reopen?
Binance said withdrawals reopen in phases from Sunday 1 November 2026 after security checks.
How did the hack affect Bitcoin?
Bitcoin fell to $76,287 on Friday 30 October, −6.2% from Wednesday's close, and BNB fell about 10%.