In what is being called the largest heist in history, the world’s biggest cryptocurrency exchange, Binance, was struck by a hack reportedly worth $6.3 billion. The event sent shockwaves through the market, but the company was quick to reassure users.
What Exactly Happened?
On October 29, 2026, attackers drained approximately $6.3 billion in various cryptocurrencies from Binance's online 'hot wallets' in a coordinated attack that took only about 20 minutes. The exchange quickly suspended all withdrawals to contain the breach and began an immediate investigation. Binance confirmed the estimated total impact was around $6.3 billion, making it the biggest crypto theft on record, surpassing the previous record of $1.5 billion stolen from Bybit in 2025. The FBI has since attributed the sophisticated attack to TraderTraitor, a hacking unit sponsored by North Korea.
How Did the Attackers Get In?
This wasn't a simple breach. Binance revealed it was the result of a sophisticated, months-long campaign. The initial point of entry appears to have been a compromised laptop belonging to one of the company's DevOps engineers back in June. The hackers then used social engineering, including setting up fake job interviews on legitimate platforms, to trick another engineer into downloading malicious software. This eventually gave them access to an internal service container, allowing them to approve and execute the massive unauthorized withdrawals without ever needing to steal the wallet's private keys. The attack was so complex that it included a self-destruct mechanism that erased the hackers' tools as they went, making tracing difficult.
Is Customer Money Safe?
Binance's response was swift and clear: customer funds are safe and all losses will be covered by the company. In a statement, co-CEO Richard Teng confirmed that Binance would fully absorb the financial impact of the theft. The exchange did not pass the losses on to its users. To do this, Binance is using a combination of its corporate treasury and its Secure Asset Fund for Users (SAFU), an emergency insurance fund established in 2018 for exactly these types of extreme situations. By November 1, Binance had already replenished about 95% of the affected assets and began a phased resumption of withdrawals.
The 'SAFU' Fund and Recovery Efforts
The Secure Asset Fund for Users, or SAFU, is a key part of Binance's user protection strategy. Financed by a percentage of trading fees, the fund held approximately $1 billion in Bitcoin before the incident. While the SAFU fund alone could not cover the entire $6.3 billion loss, it served as the first line of defense. Binance allocated over $6.34 billion from its own corporate funds, alongside reserves from its futures insurance fund, to make users whole. Simultaneously, the exchange worked with partners and law enforcement to trace the stolen assets, successfully freezing around $3 billion on-chain, effectively stopping the hackers from moving nearly half the stolen amount.
Market Impact and What's Next
News of the record breaking heist initially caused a dip in the market with Bitcoin s price falling about 3–5%. However, the market stabilized relatively quickly, in part due to Binance s decisive promise to cover all losses. After withdrawals resumed, the platform saw a net outflow of about $3.6 billion as some users moved their funds, but the situation soon stabilized. The incident has reignited serious questions about the security of centralized cryptocurrency exchanges. While Binance s ability to absorb such a colossal loss demonstrates its financial strength, the attack underscores the persistent and evolving threats from sophisticated state sponsored hacking groups targeting the digital asset industry. Binance continues to work with law enforcement to recover more of the stolen funds.
