The Largest Crypto Hack Ever

More than $6 billion reportedly left Binance wallets on October 29, 2026. TRM Labs estimates the theft at $6.36 billion, making it the largest cryptocurrency theft on record by reported dollar value. For anyone new to crypto, the central lesson is straightforward: the security of an exchange depends on the people, software and approval systems that control its wallets.

Hot wallets connect to online systems so exchanges can process withdrawals. In this case, researchers believe attackers compromised systems involved in authorizing transactions. Investigators have not yet established the complete sequence of failures. [1]

Updated October 31, 2026. Loss estimates, attribution assessments and recovery figures remain subject to change as the investigation continues.

What happened at Binance

TRM says approximately $6.36 billion moved out of Binance wallets across ten blockchains, with most taken in about 20 minutes beginning at 20:05 UTC on October 29. That timing describes the main burst of theft, rather than the entire incident. TRM also documented later outflows.

Elliptic’s analysis, updated at 05:00 UTC on October 31, reports $6.43 billion across eleven blockchains. The figures are estimates from different analyses, not interchangeable audited totals. Coverage, classification and valuation can affect comparisons; a final reconciliation is still needed.

Who is suspected and what attribution means

TRM attributes the Binance theft to North Korea’s TraderTraitor activity with high confidence. Elliptic also considers that attribution likely, but its October 31 update says no government has yet confirmed responsibility. Those are research assessments, not a public government finding about the incident.

TraderTraitor is also a label whose usage has evolved. A 2022 US government advisory used it for malicious cryptocurrency applications. Later FBI statements use it to identify North Korean cyber activity. The DMM statement associates the activity with names including Jade Sleet, UNC4899 and Slow Pisces.

How the attack may have worked

Binance initially suspected a compromised DevOps engineer’s laptop. DevOps staff help operate the systems behind a service. Binance later said investigators found additional breach points. CoinDesk reported that the complete sequence had not yet been determined. It would be premature to present “one infected laptop caused everything” as the established explanation.

TRM’s on-chain analysis identifies abuse of Ethereum’s EIP-7702 delegation feature and ordinary signed transfers on other chains. Delegation lets a wallet authorize code to act for it. TRM assesses that the cross-chain activity points to compromised signing infrastructure. A valid signature shows a transaction was authorized cryptographically; it does not prove the human owner intended it.

CoinDesk reports that Binance said the delegation bypassed its normal approval controls. That helps explain the concern, but it is not a complete forensic report. The available evidence does not establish the initial malware, every access path or whether private keys were extracted.

The practical distinction matters: attackers may steal a key, trick someone into signing, or compromise a system that requests signatures. Each can move funds, but each requires a different fix. The reporting points toward failures around wallet operations; it does not demonstrate that Bitcoin’s or Ethereum’s underlying cryptography was broken.

The history behind TraderTraitor

2022 — Trojanized apps. The FBI, CISA and Treasury warned about recruitment messages aimed at cryptocurrency employees. Targets were encouraged to download trading applications containing hidden malware. “Trojanized” means software that appears useful while secretly performing harmful actions. The advisory described JavaScript applications built with Node.js and Electron. A professional-looking download page is not evidence that an application is safe. [5]

2023 — JumpCloud. Mandiant investigated a downstream customer affected by the compromise of the identity-management provider JumpCloud. It attributed the intrusion to North Korea-linked UNC4899 and said the cluster likely corresponded to TraderTraitor. This is a supply-chain example: attackers reach an organization through a provider it trusts. JumpCloud separately confirmed North Korean involvement and said fewer than five customers and fewer than ten devices were affected. These findings do not establish a Binance connection. [6a–6b]

2024 — DMM Bitcoin. In December, the FBI, Japan’s National Police Agency and the US Defense Cyber Crime Center attributed the May theft of $308 million to TraderTraitor. Their account describes a fake recruiter approaching an employee at wallet-software provider Ginco with a malicious Python test, followed by stolen session information. The agencies said attackers likely manipulated a legitimate transaction request, resulting in the loss of 4,502.9 BTC. [7]

2025 — Bybit. The FBI publicly attributed approximately $1.5 billion stolen around February 21 to North Korea and called the activity TraderTraitor. Separate technical reporting by Elastic describes compromise of a Safe wallet developer’s workstation and malicious changes to the wallet’s web interface. This illustrates why even offline storage requires trustworthy transaction preparation and review. It does not prove Binance was attacked through the same provider or technique. [8–9]

Frozen funds are not the same as repaid customers

Binance said in its October 30 update that approximately $3 billion had been frozen on-chain. Elliptic’s October 31 analysis independently identified $2.85 billion frozen or seized. Those are dated snapshots with different scopes. Freezing can prevent movement, but does not mean assets have already been returned or customer claims settled. [2–3]

Binance also said it would cover losses using company resources. CoinDesk reported more than $6.34 billion reserved for that purpose and a target to restore withdrawals by Sunday, November 1. A funding commitment and a reopening target are statements of intent, rather than proof of completed reimbursement or restored service. Check current official notices before acting. [4]

Security lessons for ordinary crypto users

Protect your exchange account with a unique password and phishing-resistant authentication, such as a supported security key or passkey. Save official websites as bookmarks. Review active sessions and account permissions. These measures reduce personal account risk, though they cannot repair an exchange’s internal signing systems.

Treat unsolicited job tests, trading tools and support downloads cautiously. Verify the person through a separate trusted channel. Do not run unfamiliar code on a device used for wallets, work credentials or financial accounts. The historical cases show why a believable recruiter or familiar brand can still be part of a trap. [5–7]

Keep your recovery phrase offline and private. Never enter it into a support chat, “security check” or reimbursement website. A recovery phrase can restore control of a wallet; anyone who obtains it may gain the same control. After a major breach, verify every compensation claim through official channels and distrust anyone asking for an advance payment to recover funds.

Decide deliberately how much you keep with an exchange. Self-custody gives you control, along with responsibility for backups, device security and transaction approval. Learn with small amounts and test transfers first. A hardware wallet can protect keys, but approving a harmful transaction can still put assets at risk.

Read what a wallet is asking you to authorize. Check the destination, amount and any permission change using a trustworthy display. Stop if the request is unclear. Multiple approvers help only when each can independently verify what is being signed.

What exchanges should learn

The broader operational lesson is to make a single compromised device insufficient to authorize a major withdrawal. Independent approval, restricted signing permissions, withdrawal limits and alerts for unusual transfers can reduce the damage. Delegation changes deserve explicit review, and trusted suppliers need security scrutiny too. These are general defensive lessons, rather than claims about controls Binance did or did not deploy.

Watch the short version

The Binance theft is a reminder to understand who controls your crypto and what authorizes it to move. Follow the investigation and build security habits before the next urgent headline arrives.

Educational information only. This article is not individualized financial advice.