Binance Hack: $6.3 Billion Taken From Hot Wallets in About 20 Minutes
Part 1 of 8 in Recent Cyberattacks: Fall 2026 Briefings
On October 29, 2026, attackers moved roughly $6.3 billion in cryptocurrency out of Binance, the world’s largest crypto exchange. Binance says its hot wallets (wallets connected to the internet for day-to-day withdrawals) were compromised (Binance, Security Incident Update #2), and the FBI has since said North Korea was responsible (AP via ABC News). This briefing sets out what the public sources confirm, what they do not, and what any business that moves money can learn about payment approvals.
| Organization | Binance, cryptocurrency exchange |
|---|---|
| When | October 29, 2026, starting around 20:05 UTC (Binance, Security Incident Update #2) |
| What happened | Hot wallets compromised; Binance estimates the loss at about $6.3 billion in token assets (Binance, Security Incident Update #2) |
| Attribution | The FBI said on October 31 that North Korea was responsible and called the activity TraderTraitor (AP via ABC News) |
| Recovered or frozen | About $3 billion frozen on-chain, according to Binance (Binance, Security Incident Update #2) |
| Customer impact | Binance says it will absorb the loss, not its users (Binance, Security Incident Update #2); Binance planned a staged reopening of withdrawals from November 1 (Binance, Recovery Update #4) |
Each item is linked to its source. Verification status reflects the strongest source available on the verification date.
What happened
- Oct 29, about 20:05 UTC. Binance says its hot wallets were compromised (Binance, Security Incident Update #2). TRM Labs, a blockchain-analytics firm, reports that most of the funds left across ten blockchains in about 20 minutes (TRM Labs).
- Oct 30. Binance suspends withdrawals while it runs security checks and says its first finding points to a compromised engineer’s laptop (Binance, first incident update). Later the same day it says the investigation found additional points of breach and no evidence that wallet private keys leaked (Binance, Security Incident Update #2).
- Oct 30. TRM Labs and Chainalysis link the theft to North Korea’s TraderTraitor group (TRM Labs).
- Oct 31. The FBI issues a statement attributing the theft to North Korea and asks exchanges and analytics firms to block transactions tied to the attackers’ addresses (AP via ABC News; Euronews).
- Nov 1. Binance announces a staged reopening of withdrawals and says a post-incident report will follow (Binance, Recovery Update #4).
How the attackers got in
Binance has not published a root cause yet. Its early update pointed to an engineer’s laptop (Binance, first incident update), but it later said there were additional points of breach (Binance, Security Incident Update #2). Co-CEO Richard Teng told reporters the attack did not rely on a single engineer’s permissions or a one-click action (Cointelegraph recap).
TRM Labs says the evidence points to a compromise of the systems that sign hot-wallet transactions, rather than stolen private keys (TRM Labs).
Why it matters to businesses that are not crypto companies
Most organizations do not run crypto wallets, but almost all of them approve payments: wires, ACH files, vendor bank-detail changes, payroll. The pattern here, attackers reaching the system that approves transfers instead of breaking the vault itself, is the same pattern behind many business email compromise and payment-fraud losses.
What is still unknown
- The confirmed root cause and full entry path; Binance says a post-incident report will follow (Binance, Recovery Update #4).
- How much of the frozen amount will be recovered.
- Whether any Binance customer data was accessed. The sources reviewed do not report customer-data exposure.
How organizations can reduce payment and transfer risk
The following are general controls, not a statement about what Binance did or did not have in place.
- Separate duties for money movement: no single person, device or account should be able to create and release a payment.
- Verify payment changes out of band: confirm new or changed bank details by calling a known number, never one in the request.
- Protect the people who hold approval rights: phishing-resistant MFA, managed devices and extra monitoring for finance and admin staff.
- Limit what is always online: keep only the funds or authority needed day to day in systems reachable from the internet.
- Watch for unusual approval activity, such as approvals outside business hours or many transfers in a short time, and alert on it.
- Rehearse the first hour: know who calls the bank, who freezes transfers and who contacts law enforcement.
How OC Security Audit can help
We review the identity, approval and monitoring controls around money movement and administrative access, and give you a prioritized list of fixes.
- Microsoft 365 security audit: $3,500 fixed, read-only; covers MFA, admin roles, mail rules and alerting that often protect finance staff
- Microsoft Entra ID security audit: privileged roles, Conditional Access and sign-in risk
- Cybersecurity risk management: payment-process and fraud-risk review
- Incident response planning: a written first-hour plan for payment fraud
Ali Hassani, CISSP, C|CISO, is based in Irvine and works with organizations on-site across Southern California and remotely nationwide.
Schedule a consultationCall 949-777-5567An audit shows where your controls are weak and what to fix first. No audit or service can guarantee that an organization will not be attacked; the goal is to lower the likelihood and the impact.
More in this series
See all briefings and their verification status in the recent cyberattacks and data breaches tracker.
Sources
- Binance, October 30, 2026. https://www.binance.com/en/support/announcement/detail/d3306d9dca5243548c813b605e1d1751
- Binance, October 30, 2026. https://www.binance.com/en/support/announcement/detail/c5a8729a97ac486d963784d96c5642d7
- TRM Labs, October 29, 2026. https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- ABC News (Associated Press), October 31, 2026. https://abcnews.com/Business/wireStory/fbi-blames-north-korea-stolen-billions-binance-biggest-137741287
- Euronews, November 1, 2026. https://www.euronews.com/2026/11/01/fbi-blames-north-korea-for-63-billion-binance-crypto-hack
- Cointelegraph, October 30, 2026. https://cointelegraph.com/news/recap-binances-record-63b-hack-unfolded
- Binance, November 1, 2026. https://www.binance.com/en/support/announcement/detail/73911fb819b240f88b88256bdd318eda
About this briefing. This page summarizes publicly available information from the sources linked above, as of the verification date shown. OC Security Audit was not involved in responding to any incident described here and has no inside knowledge of them. Organization names are used only to identify the subjects of the cited public reports. Statements made by attackers are labeled as claims and are not treated as fact; details that the sources do not confirm are marked as unknown. Facts may change as investigations continue.
This content is for general educational purposes. It is not legal advice, a forensic conclusion or a finding about any organization’s security practices. See our editorial standards. To report an error, contact support@OCsecurityAudit.com and we will review it and publish a dated correction where needed.