Binance, the world’s largest cryptocurrency exchange, lost $6.3 billion in a cyberattack on 29 October 2026. The funds were drained from its hot wallets in 20 minutes across ten blockchains. The incident has surpassed the $1.5 billion Bybit hack of February 2025 to become the largest crypto hack recorded.
What Is Binance and How Does It Work?
Binance is the world’s largest cryptocurrency exchange by trading volume. A cryptocurrency exchange is a platform where users buy, sell and hold digital assets. Binance offers markets in more than 350 cryptocurrencies and reports over 300 million registered accounts.
Binance was founded in July 2017 by Changpeng Zhao, known as CZ, and Yi He. Zhao, a Canada based software developer born in China, had earlier built trading systems for the Tokyo Stock Exchange and Bloomberg Tradebook. Binance raised about $15 million through an initial coin offering to launch. Within 180 days it became the largest digital asset exchange in the world.
Cryptocurrency is digital money that exists only in electronic form. It runs on blockchain, a shared public ledger stored across many computers. The ledger records every transfer. No central bank issues or controls it. Bitcoin was the first major cryptocurrency. Ether, the coin of the Ethereum network, is the second largest. Transactions are secured by cryptography using a public address and a secret private key. New Bitcoin is created through mining, in which powerful computers solve puzzles to validate blocks of transactions.
Binance works as an off chain custodian. Users deposit money or crypto and trade inside Binance systems. Binance holds most customer funds in cold wallets, which stay offline, and keeps a smaller share in hot wallets, which stay online to process daily withdrawals. Binance also runs its own network, BNB Chain, and its own coin, Binance Coin (BNB). Tokens issued on this network follow the BEP20 standard, and transactions can be viewed on its explorer Bnbscan.
Analogy · Hot Wallet and Cold Wallet Expand analogy
A hot wallet is like cash kept in a shop till for daily payments. It is handy but easy to steal. A cold wallet is like cash kept in a bank locker. It takes more time to access but is far safer.
What Happened in the $6.3 Billion Binance Cyberattack?
Binance lost about $6.3 billion from its hot wallets on 29 October 2026 between 20:04 UTC and 23:56 UTC. Most of the loss occurred in about 20 minutes. Binance suspended withdrawals, revoked the malicious access at 00:10 UTC on 30 October and set aside $6.34 billion in company funds to cover user losses. Blockchain issuers have frozen between $2.7 billion and $3 billion of the stolen assets.
How Attackers Entered Binance Systems
Binance said the intrusion was a months long campaign. In June 2026, an engineer installed a tampered version of Homebrew software while searching for an AI tool. Binance detected that device and replaced it. In September 2026, a software engineer was contacted on a job platform by a person posing as a project director.
The engineer faced a video interview with a fake HR manager and later a fake chief executive. He was then asked to download a coding assignment on his work computer. The file contained zero day malware that escaped normal antivirus checks. On 20 October, the attackers used this access and an internal AI tool to reach two wallet team computers. On 29 October, they used stolen credentials to create a container in an internal service and run a malicious script that could request withdrawals.
How $6.3 Billion Left Hot Wallets in Minutes
The attacker drained 17 Binance hot wallets across ten blockchains including Ethereum, Bitcoin, Tron, Solana and XRP Ledger. On Ethereum, the first sweep moved 167,464 ETH and about 1.6 billion USDT from a wallet known as Binance 14. On Bitcoin, 18,270 BTC left in one block. About 613 million USDT left on Tron and 233.5 million XRP left on the XRP Ledger. Before the freeze, the attacker swapped about $729 million in stablecoins into ETH and TRX.
A key technical feature in the attack was EIP-7702. This Ethereum upgrade, activated in the Pectra upgrade in May 2025, lets a normal account temporarily run smart contract code. At 20:20 UTC, one transaction submitted 50 authorisations signed by the Binance 14 address. Each pointed to an attacker controlled sweeper contract. The code then gained execution rights over the wallet and moved all assets without using the normal withdrawal process. Binance uses multi party computation for its hot wallets, so no single key could cancel the delegation quickly. Bitcoin and Tron do not support this feature, and funds there left through ordinary signed transfers using compromised signing infrastructure.
Blockchain firms TRM Labs and Chainalysis have attributed the attack with high confidence to TraderTraitor, a North Korea linked unit also called the Lazarus Group. Binance said the US Federal Bureau of Investigation has also attributed the campaign to North Korea. The pattern matches the $1.5 billion Bybit hack of February 2025, which the FBI also linked to North Korea.
Freezing has limited the damage. Tether froze more than 1.5 billion USDT and Circle froze 823 million USDC within an hour of the first drain. Ripple, World Liberty Financial, First Digital and the Arbitrum Security Council also locked assets. About 98 percent of affected tokens have been replenished from company reserves. Because Bitcoin and Ether have no central issuer, about $2.4 billion in those coins cannot be frozen and remains at risk of laundering through mixers and small exchanges.
Has Binance Been Hacked Before?
Yes. Binance has disclosed four security incidents between 2018 and 2026. The total loss has risen sharply each time. The 2026 loss is more than 150 times the 2019 loss.
| Year | What Happened | Loss Reported |
|---|---|---|
| 2018 | Phishing attack using fake website addresses to steal login keys. Binance halted withdrawals in time. No funds were stolen. | No loss |
| 2019 | Attackers used phishing and malware to get API keys and two factor codes and withdrew from the Bitcoin hot wallet. The wallet held about 2 percent of Binance Bitcoin. Cold wallets stayed safe. | 7,000 BTC, worth about $40.7 million |
| 2022 | Attackers exploited the BSC Token Hub, the bridge that moves assets to BNB Chain, by forging a security proof. They minted 2 million BNB worth about $570 million. Validators halted the chain. About $100 million to $110 million had already left the chain. | About $570 million minted, about $100 million moved |
| 2026 | Attackers compromised internal wallet systems and drained hot wallets on ten blockchains in minutes. | About $6.3 billion |
After the 2019 breach, Binance paid users from the Secure Asset Fund for Users (SAFU). Binance created SAFU in July 2018 by setting aside 10 percent of trading fees. It was valued at $1 billion in January 2022. In February 2026, Binance converted the fund into 15,000 BTC. The fund is held by Nest Clearing and Custody Limited and regulated in the Abu Dhabi Global Market.
For the 2026 hack, Binance said it would use part of SAFU along with corporate reserves and futures insurance funds. Data on 3 November 2026 showed SAFU Bitcoin holdings had fallen to about 7,500 BTC, worth about $580 million, after withdrawals on 31 October. Binance has pledged to restore SAFU to $1 billion but has not given a timeline. Current co chief executives are Yi He and Richard Teng, who succeeded Changpeng Zhao after Zhao pleaded guilty to US money laundering violations in 2023 and served a four month sentence in 2024.
Why This Is the Largest Crypto Hack in History
The Binance loss is more than four times the previous record. The Bybit hack on 21 February 2025 was then the largest ever at about $1.5 billion. Attackers took 401,347 ETH from a Bybit cold wallet during a routine transfer by masking the signing screen. Bybit stayed solvent because customer assets were backed one to one. It processed 350,000 withdrawals in 12 hours. The Binance hack of 2026 has now taken that record by a wide margin.
| Incident | Date | Amount Lost |
|---|---|---|
| Poly Network | August 2021 | About $611 million |
| BNB Chain bridge | October 2022 | About $570 million minted |
| Ronin Network | March 2022 | More than $600 million |
| Bybit | February 2025 | About $1.5 billion |
| Binance | October 2026 | About $6.3 billion |
The scale matters for three reasons. First, it tests the exchange security model. Binance proof of reserves in 2025 showed about $163 billion in user holdings. A $6.3 billion hole is large but can be covered from reserves. Smaller exchanges could not survive such a loss. Second, it shows the power of stablecoin freezes. Issuers can freeze USDT and USDC remotely, which saved nearly half the loot. They cannot freeze Bitcoin or Ether, which is why those coins remain the main laundering risk. Third, it may speed up regulation of signing systems, fake recruitment screening and staff device security across exchanges. Binance has said it blocked 57 suspected North Korea linked attempts in 2026 and will bring in external experts for a review.
Is Binance Legal and Safe in India?
Binance is legal to use in India and is registered with the Financial Intelligence Unit India (FIU-IND). Binance is registered as Nest Services Limited, a Seychelles company trading as Binance. It is listed as number 47 among 54 registered providers as of 9 March 2026. Registration means Binance must verify customers, store transaction records and report suspicious trades under the Prevention of Money Laundering Act, 2002.
The path to registration was difficult. Since March 2023, all virtual digital asset service providers serving Indian users must register with FIU-IND. On 28 December 2023, FIU-IND issued notices to nine offshore platforms including Binance, KuCoin and Kraken for operating without registration. Their apps and websites were blocked in January 2024. Binance registered in May 2024. On 19 June 2024, FIU-IND fined Binance ₹18.82 crore for serving Indian clients while unregistered. Services resumed in August 2024. In April 2025, Binance asked all Indian users to complete fresh KYC including PAN. Binance was not among the 15 offshore platforms named for blocking in September 2026.
Registration is not a licence. No crypto exchange has a Reserve Bank of India licence. FIU-IND registration gives no deposit insurance and no SEBI style investor protection. Crypto can be legally bought, held and sold in India but it is not legal tender.
Indian tax still applies wherever the trade happens. Gains on virtual digital assets face a flat 30 percent tax plus cess under Section 115BBH of the Income Tax Act. A 1 percent TDS applies on transfers under Section 194S. Losses cannot be set off against other income.
On safety, Binance says user assets are backed and losses will be covered from SAFU and company funds. Binance suspended withdrawals after the October 2026 drain and later restored them. FIU-IND rules from 8 January 2026 also require registered exchanges to record wallet addresses, verify locations, confirm bank accounts and block mixer linked transfers. Users still face market risk, P2P fraud risk and the risk that frozen assets may take time to recover.
Key Takeaways
- The Binance cyberattack on 29 October 2026 caused a $6.3 billion loss, the largest crypto hack recorded.
- The attacker used fake job interviews and EIP-7702 authorisations to drain 17 hot wallets across ten blockchains in minutes.
- Tether and Circle froze over $2.3 billion in USDT and USDC, while about $2.4 billion in Bitcoin and Ether cannot be frozen.
- Binance was founded in July 2017 by Changpeng Zhao and protects users through the SAFU fund created in July 2018.
- Binance is registered with FIU-IND as Nest Services Limited after paying a ₹18.82 crore penalty on 19 June 2024.
