The biggest crypto hack in history just transpired on the largest crypto exchange. Binance has put a number on the security incident that rocked the exchange on Thursday, October 29. In an update posted today, the exchange confirms nearly $6.3 billion was affected. This is a developing story and the figures could change as Binance and its partners keep tracing the funds.
Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private… pic.twitter.com/5REncAI77y
— Binance (@binance) October 30, 2026
The industry came together to freeze approximately $3 billion onchain, which leaves around $3.3 billion out of reach at the time of writing. DeFillama states that the unrecovered portion alone is more than was stolen across all of crypto last year. It is also equivalent to how much was lost in 2023 and 2024 combined.
A Compromised Laptop Gave the Attacker a Way In
Binance’s initial findings point to a compromised DevOps engineers laptop. The exchange said that the attacker used the machine to reach an internal service container and push unauthorized withdrawal transactions from there. As of now, Binance states that it has found no signs that any wallet private keys were leaked, and it plans to put out a full technical post-mortem report once the facts are verified.
What is verified now is that the attack began around 4:30 P.M. ET, according to onchain data from Arkham. Data from Arkham shows that the attacker siphoned large amounts of Bitcoin, Ethereum, Tron and Solana among other assets. Tether CEO Paolo Ardoino confirmed on X that they froze $1.567 billion in USDT and Circle CEO Jeremy Allaire also confirmed that they froze over $800 million in USDC. Ripple, World Liberty, BitGo and Paxos also froze stolen assets, and Arbitrum’s Security Council froze around $30.5 million. The largest DeFi lending protocol, Aave, also froze its lending markets as precautionary measure, after the attacker borrowed Ethereum against stolen USDT.
Tether froze more than 1.567B USDT related to a potential Binance exchange hack.
Protecting the industry and our partners is our main priority.
Stay safe everyone.
— Paolo Ardoino 🤖 (@paoloardoino) October 29, 2026
Circle is closely tracking reports of a potential exploit involving Binance. In coordination with law enforcement, we have frozen more than 800M USDC associated with the incident and will continue supporting the investigation.
— Jeremy Allaire (@jerallaire) October 29, 2026
We’re aware of reports of a potential incident affecting Binance-affiliated wallets.
Aave’s contracts are unaffected, and positions remain overcollateralized. As a precaution, all DAO-operated markets across V3 and V4 have been frozen.
The freeze pauses new deposits and…
— Aave (@aave) October 29, 2026
Binance have also paused deposits and withdrawals as security checks are ongoing. Binance has also revoked authorization for the affected address and is working with law enforcement and blockchain intelligence firms to recover the funds. The exchange says its SAFU emergency fund and company reserves will cover every dollar of user losses, and an updated Proof of Reserves will follow after remediation.
Blockaid Traces the Drain Back to One Hot Wallet
Blockchain security firm Blockaid has published one of the most detailed onchain breakdowns of the attack so far. Its report centers on Binance 14, one of the exchange’s largest and busiest Ethereum hot wallets.
According to Blockaid, the attacker funded an operator address through Tornado Cash starting Oct. 28 and rehearsed the whole sequence on its own wallets with test runs of $2 to $6. At 20:20 UTC on Oct. 29, it sent a single transaction carrying 50 EIP-7702 authorizations signed with the Binance 14 key. The wallet was still processing withdrawals, so the attacker had no way of knowing which nonce would be live and signed a whole range instead. One matched. That handed control of the wallet to an unverified sweeper contract only the attacker could operate.
About three minutes later, the sweeper emptied Binance 14 of 167,464 ETH, 1.615 billion USDT and around 60 other tokens, worth roughly $2.5 billion at the time. The wallet was left holding 1 ETH. Within 12 minutes, 10 more Binance hot wallets on Ethereum, Arbitrum, Avalanche and Optimism sent funds to the same collection address. The delegation stayed active, so the attacker returned at 21:44 UTC and took another 200 million USDT in fresh deposits without a new signature.
Blockaid CEO Ido Ben-Natan said that the evidence points to compromised signing infrastructure, and he does not think a key was leaked. That fits with Binance’s account of a breached laptop and service container. Ben-Natan also drew parallels with the $1.5 billion Bybit hack of February 2025, which this incident now dwarfs several times over.
Onchain investigator ZachXBT suspects North Korea’s Lazarus Group, though neither Binance nor any authority has confirmed the attribution. Binance has asked users to rely only on its official channels for updates.
The smartest crypto minds already read our newsletter. Want in? Join them .
