Binance, the world's largest cryptocurrency exchange by trading volume, confirmed on October 30, 2026, that approximately $6.3 billion in digital assets was drained from its wallets overnight. The theft, which TRM Labs attributed to North Korea's elite hacking unit TraderTraitor with high confidence, is the largest single crypto heist on record, roughly four times the size of the $1.5 billion Bybit hack in February 2025.
According to TRM Labs, the attack began at approximately 20:05 UTC on October 29 and spanned ten blockchains in a coordinated sweep. The firm said preparation started at least 36 hours earlier, with the attacker's operator wallet receiving three small withdrawals from Tornado Cash, a privacy tool that obscures the origin of funds, starting the morning of October 28. On October 29, the attacker deployed code, ran tests on Binance wallets, and four hours after a final rehearsal, installed the same code on a Binance hot wallet, enabling valid signatures across chains.
Binance said in statements on its X account that its initial investigation points to a compromised DevOps engineer's laptop, which allowed unauthorized access to a service container and submission of withdrawal transactions. The company found no evidence of a private key leak and has engaged law enforcement and blockchain intelligence partners. "User funds are safe," Binance stated, adding that all losses would be covered from its Secure Asset Fund for Users (SAFU) as well as from company funds. However, Johnny Mehta, Chief Investment Officer at Axis Investment Management, told CNBC that the SAFU fund may not be large enough to cover the losses.
Deposits and withdrawals were suspended across several networks as a precaution. Binance has approximately 335 million registered users globally and had about $162.8 billion in assets under custody as of its 2025 annual report. The scale of the breach raises urgent questions for financial advisors about the safety of client assets held on centralized exchanges, particularly as regulatory scrutiny of crypto custody intensifies.
Stablecoin issuers and blockchain networks moved quickly to contain the damage. Tether, Circle, Ripple, and World Liberty Financial collectively froze approximately $2.67 billion in stablecoins. Arbitrum's Security Council used emergency powers to freeze an additional 8,426 ETH and 74.6 million ARB tokens. Binance confirmed a verified frozen total of approximately $3 billion.
The attacker, however, converted freezable stablecoins into assets beyond any issuer's reach. About 325 million USDT was sold through decentralized trading protocols in exchange for approximately 122,300 ETH at a steep discount of more than 10%. As of October 30, 2026, the attacker holds more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion, in assets that no issuer can freeze.
Bernardo Brites, CEO of Trace Finance, a stablecoin infrastructure company, told Reuters that "the more time passes, the less likely they will be able to fold those funds into other exchanges or payment providers - they essentially get blacklisted." This suggests that while the stolen funds may be difficult to recover, they may also be difficult to launder, potentially limiting the attacker's ability to monetize the haul.
For advisors, the incident underscores the importance of due diligence when recommending crypto exposure. The breach follows a pattern of state-sponsored thefts, with TraderTraitor identified by the FBI as responsible for the Bybit hack in February 2025. As clients increasingly seek alternative assets, advisors must weigh the risks of custodial platforms against the potential benefits of digital assets. The performance of crypto-focused funds has been volatile, and this event may prompt a reassessment of risk management practices.
Binance's response, including the use of SAFU and cooperation with law enforcement, will be closely watched. The exchange has not yet disclosed the full extent of the losses or the timeline for restoring services. As the investigation continues, the industry faces a stark reminder of the vulnerabilities inherent in centralized custody, even for the largest players.
