Binance confirmed on October 30, 2026, the theft of approximately 6.3 billion dollars in cryptocurrencies, equivalent to nearly 34 billion reais, in what market analysts describe as the largest recorded theft in the sector.
The attack took place on Thursday, October 29, with unauthorized transfers completing in about 20 minutes. According to TRM Labs' reconstruction, the outflows began at 20:05 UTC on October 29 after the attacker compromised the system responsible for authorizing transfers.
The tracking firm states that the intruder used Ethereum's EIP-7702 feature to assume control of a hot wallet and had prepared the operation for at least 36 hours. The technical explanation evolved within less than a day. On Thursday evening, Binance initially pointed to a compromised notebook belonging to a DevOps engineer as the entry point, which granted access to a service container used to submit withdrawals.
On Friday, the company stated that the incident resulted from multiple factors and disclosed additional intrusion points. Co-CEO Richard Teng wrote that the attacker did not rely solely on one engineer's permissions and that the operation was not a single-click action. The exchange reported no evidence of private key leakage, indicating the attacker instead forced the company's infrastructure to sign the transfers on their behalf.
Approximately 3 billion dollars have been located and partially blocked with help from other firms, though this does not constitute full recovery. Tether froze more than 1.57 billion in USDT and Circle froze more than 800 million in USDC, according to statements from Paolo Ardoino and Jeremy Allaire. The theft represents nearly 4 percent of assets under custody, per DefiLlama.
Co-CEO Yi He said Binance will cover all losses using the SAFU fund and its own capital. The company suspended withdrawals on several networks on Thursday, restored deposits on Friday, and projected restoring withdrawals within about 45 hours. It is cooperating with the FBI and the United States Secret Service, according to Reuters.
Attribution remains disputed. TRM Labs points with high confidence to the North Korean group TraderTraitor, linked to Lazarus, and Chainalysis reached the same conclusion, yet Binance declared on October 30 that its investigation has not identified the responsible parties.
