Binance, the world’s largest cryptocurrency exchange by trading volume, has confirmed that a security incident on Thursday, 29 October 2026, drained an estimated US$6.3 billion in digital assets from its wallets. The figure makes it the largest theft in the history of the crypto industry, roughly four times the US$1.5 billion stolen from rival exchange Bybit in February 2025.
In an update posted on its official X account late on Thursday, Binance put the estimated total impact at around US$6.3 billion and said that about US$3 billion of the affected assets had already been identified and frozen with the help of blockchain partners. The exchange suspended all deposits and withdrawals while security checks were carried out, revoked the compromised address authorisations and engaged law enforcement agencies and blockchain intelligence firms to trace the remaining funds.
How the attack happened
Binance’s preliminary investigation indicates that the breach began with a compromised laptop belonging to one of its DevOps engineers. According to the company, that access allowed the attacker to reach a service container inside its systems and submit unauthorised withdrawal transactions.
Blockchain intelligence firm TRM Labs, which tracked the theft as it unfolded, reports that the attacker moved funds out of Binance wallets on ten separate blockchains, including Ethereum, Bitcoin, Tron, the XRP Ledger and Solana. Most of the money left in a window of about 20 minutes, beginning at 20:05 UTC.
On Ethereum, TRM says the attacker exploited EIP-7702, a feature introduced in the network’s Pectra upgrade in 2025, which lets an ordinary wallet hand control of its behaviour to a smart contract. Using a batch of 50 pre-signed authorisations, the attacker converted one of Binance’s best-known hot wallets into a “sweeper” that only the attacker could command, then emptied it of more than 167,000 ETH and 1.6 billion USDT in a single transaction.
Because wallets on nine other chains, each using different key types and signing schemes, also released funds through ordinary signed transfers within roughly half an hour, TRM concludes that the most likely explanation is a compromise of Binance’s hot wallet signing infrastructure rather than a simple phishing attack.
North Korea in the frame
TRM attributes the attack, with high confidence, to TraderTraitor, the North Korean state-backed hacking unit that the FBI previously linked to the Bybit heist. Investigator ZachXBT and security firm Blockaid have also pointed to North Korea. The hallmarks include small withdrawals from the Tornado Cash mixing service to fund an operator wallet, preparation that began at least 36 hours before the theft and signatures gathered in advance and executed in one burst.
Binance itself has not publicly named the perpetrators, and inquiries continue.
A race to freeze funds
The response from the wider industry was swift. According to TRM, Tether froze about 1.77 billion USDT, Circle froze roughly 825 million USDC in coordination with law enforcement, Ripple froze 40.5 million RLUSD and World Liberty Financial froze 27.8 million USD1. Arbitrum’s Security Council also used its emergency powers to pull around US$30 million in ETH and ARB tokens out of the attacker’s reach.
The attacker, however, moved quickly to convert freezable stablecoins into assets that no issuer can block, selling hundreds of millions of USDT to market makers at a steep discount and borrowing ETH against stablecoin collateral on the Aave lending protocol. TRM estimates that the hacker still controls more than 420,000 ETH and 18,270 BTC, worth around US$2.4 billion.
Binance says customers will not bear the loss. The exchange has committed to covering all losses from company funds and its Secure Asset Fund for Users (SAFU), and has promised to publish an updated proof of reserves once remediation is complete. Co-founder Yi He said withdrawals were expected to resume by Sunday.
Market reaction
News of the breach weighed on crypto prices, with Bitcoin falling about 2% to a six-week low near US$77,600 in early Asian trading on Friday, according to Reuters, as traders digested the news.
What it means for Southern African businesses
For organisations across South Africa and the wider region, the incident is a stark reminder that the weakest link in even the most sophisticated digital operation is often a single endpoint. A lone engineer’s laptop appears to have opened the door to billions of dollars in assets.
TRM advises exchanges and treasury teams to screen deposits against labelled attacker addresses, monitor Ethereum-compatible wallets for unexpected EIP-7702 delegations, reject unexpected authorisation requests and separate signing infrastructure by chain and wallet tier. The broader lessons, including strict privileged-access controls, hardened developer devices and segmented approval paths, apply equally to banks, fintechs and any business holding digital assets on behalf of clients.
As investigators follow the money into cross-chain bridges and over-the-counter brokers, the Binance hack is likely to sharpen regulatory scrutiny of centralised exchanges and intensify the debate over how the industry protects customer funds.
