A record theft of more than $6.3bn from Binance, the world’s largest cryptocurrency exchange, has shifted scrutiny onto regulators, blockchain intelligence firms and the exchanges themselves, as questions mount over whether security and oversight are keeping pace with the scale of assets held on centralized platforms.
The attack unfolded on October 29, 2026, when an attacker moved approximately $6.36bn out of Binance wallets across ten blockchains, most of it within about 20 minutes starting at 20:05 UTC. Blockchain intelligence firm TRM Labs attributed the breach with high confidence to TraderTraitor, an elite North Korean hacking unit, citing robust on-chain and off-chain intelligence. TRM has described it as the largest crypto theft on record, roughly four times the $1.5bn Bybit hack of February 2025.
Chainalysis reached a similar conclusion. Its co-founder and chief executive Jonathan Levin wrote on X that the firm assessed the hack, which he put at $6.4bn, was likely carried out by the DPRK group TraderTraitor, citing links to a previous hack. He noted that industry partners had already frozen around $3bn and that Chainalysis would continue to follow all of the funds.
The accountability questions now extend to how the breach was permitted to happen in the first place. Binance co-chief executive Richard Teng said the initial investigation suggests the incident may have started with a compromised DevOps engineer’s laptop, which gave an attacker access to a service container where unauthorized withdrawal transactions were submitted. He was careful to draw a distinction over responsibility, stating that the attacker did not simply use one engineer’s permissions, that this was not a single one-click action, and that the investigation has not attributed responsibility to any individual. Binance says it has found no evidence of any wallet private key leak.
Teng has pledged that customer money is safe and that the company is covering every loss, echoing a company statement that user funds are completely safe and teams are working around the clock. He listed the exchange’s actions since discovering the theft: temporarily suspending withdrawals while it completes a security revamp of the withdrawal service and related addresses, revoking the affected address authorizations, and engaging law enforcement and blockchain intelligence partners to trace and recover funds. Binance has promised a detailed technical post-mortem once the investigation is complete and every fact verified, and says it will publish an updated Proof of Reserves once remediation is finished.
Freezing efforts have become a race against conversion. Binance said it had worked with partners to freeze affected assets, with about $3bn located so far, and gave no update on the remaining $3.3bn. Co-founder Yi He said the company would cover all hacking losses. Stablecoin issuers Tether and Circle moved quickly to blacklist the suspected attacker’s addresses, and more than $2bn of their tokens have been frozen so far by different providers. According to media company Decrypt, the attacker is now switching stablecoins, which can be frozen, into Ethereum, which has no issuer, meaning every dollar converted before a freeze lands is beyond their reach.
Analysts have framed the episode as a test of whether oversight of the sector is adequate. Jake Moore, global cybersecurity advisor at security firm ESET, said it is unbelievable that a single laptop has enough privileged access to enable such a heist, warning that if a single device can authorize enormous cryptocurrency transfers, hackers can simply target systems and people until they find a weak link. He said the case raises serious questions about whether exchanges are doing enough to protect customer assets and whether security and regulation are keeping up, while noting that recovering stolen cryptocurrency is far more difficult than tracing it, particularly when attackers move funds across multiple wallets and blockchains using well-known evasion tactics.
Cristiano Ventricelli, vice president of digital assets at Moody’s Ratings, said the incident underscores heightened cybersecurity risks associated with hot wallets, a vulnerability already exposed by the 2025 Bybit hack, and illustrates the risk concentration inherent in large, centralized intermediaries. He noted that stronger institutional controls can reduce some vulnerabilities but the scale of assets under custody can amplify the impact of a breach, and that broader credit and industry implications will depend on ultimate losses, affected counterparties, asset recovery and whether confidence in the digital-asset ecosystem holds.
Markets have reacted. Bitcoin fell by more than 3% to a six-week low of $76,368 before recovering to $78,335, down 0.6%, and Deutsche Bank market strategist Jim Reid reported that bitcoin was down 0.40% on the morning after a 3.03% slide the previous day. US stocks linked to cryptocurrencies fell in afterhours trading.
The breach’s breakdown by asset class has been detailed: Ethereum accounts for about $3.79bn, including 200,630 ETH and 185 other tokens, among them 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. Bitcoin outflows total 18,270 BTC, about $1.47bn, while Tron outflows of 612.7 million USDT and 46.4 million TRX amount to about $628m. The XRP Ledger lost 233.46 million XRP, about $296m, Solana outflows of 970,500 SOL total about $96m, and Arbitrum, Optimism and Base combine to about $39m, including 74.6 million ARB on Arbitrum, with Avalanche outflows of about $28m and Polygon about $10m.
Meanwhile, elsewhere in the financial world, NatWest rounded out the Q3 bank earnings season with pre-tax profits up just 1.9% to £2.2bn for the July to September period, despite an 8.9% rise in net interest income to £3.6bn, offset by an 81% jump in impairment charges from £153m to £277m. The bank said the increase reflects the one-off release of provisions last year rather than any change in conditions for borrowers, which has remained stable, while higher operating costs were primarily linked to the integration of wealth management business Evelyn Partners, bought earlier this year. Separately, Nationwide’s October House Price Index showed UK annual house price growth slowed to 0.5%, the slowest pace since January 2024, down from 0.8% in the year to September, with chief economist Robert Gardner citing an uncertain economic backdrop and rising mortgage rates. Whether Binance’s promised post-mortem and updated Proof of Reserves will restore confidence in centralized custody remains the sector’s most pressing open question.