Binance Hack Explained: The $6.3B October 2026 Hot Wallet Theft, Step by Step

Binance Hack Explained: What Happened on October 29, 2026

$6.3 billion. Ten blockchains. About twenty minutes. That is the shortest accurate summary of the Binance hack. According to TRM Labs, as cited by Forbes, the first unauthorized transfer left a Binance hot wallet at 20:05 UTC on Thursday, October 29, 2026 (4:05 p.m. Eastern), and most of the $6.36 billion was gone within roughly 20 minutes. Chainalysis dates the start to about 4:20 p.m. ET on Ethereum and Bitcoin and puts the total at approximately $6.4 billion. Elliptic counts $6.43 billion. Binance itself put the impact at about $6.3 billion.

The spread between $6.3 billion and $6.43 billion is not a contradiction. Each firm prices the stolen tokens at a slightly different moment and counts a slightly different set of wallets and chains. Any of the three is a fair "binance hack amount"; the safest way to write it is "about $6.3 billion to $6.4 billion".

What was hit matters as much as the size. The theft drained Binance's own hot wallets, the online wallets an exchange keeps topped up so withdrawals can be processed quickly. Cointelegraph reports that co-CEO Richard Teng said on October 30 that the attack affected the exchange's own hot wallet; most customer assets were reportedly held in offline cold storage. Individual user accounts were not the target.

Binance 6 billion hack details: the first 72 hours

• Oct 29, 20:05 UTC: first unauthorized transfer (TRM Labs via Forbes).
• Oct 29, about 5:14 p.m. ET: stablecoin freezes begin (Chainalysis). Circle CEO Jeremy Allaire said Circle froze more than 800 million USDC and Tether CEO Paolo Ardoino said Tether froze more than 1.5 billion USDT (CNBC).
• Oct 29 to 30: Binance suspends withdrawals and revokes the affected address authorizations, while deposits keep working (CNBC).
• Oct 30, 12:30 a.m. ET: Chainalysis attributes the theft to North Korea's TraderTraitor group.
• Oct 31: Binance says it has covered up to 90% of the stolen assets; the FBI says North Korea was responsible (CNBC).
• Nov 1: withdrawals reopen in phases, bitcoin first, then the Ethereum network and BNB Smart Chain (CNBC).
• Nov 3: Binance publishes its postmortem tracing a months-long campaign (Forbes); Chainalysis counts about $2.8 billion frozen as of 11:30 a.m. ET.

For scale, the previous record was the February 2025 Bybit theft. Elliptic puts Bybit at $1.46 billion, which makes the Binance hack more than four times larger.

How Did the Binance Hack Happen? The Fake Job Interview Behind the Breach

Four months of preparation. Twenty minutes of theft. The most searched angle of this story, "binance hack job interview", comes straight from Binance's own postmortem, published November 3 and summarized by Ari Redbord in Forbes. The sequence, in the order Binance describes it:

1. June 2026 — reconnaissance through a fake download. A Binance wallet engineer searching for a popular AI coding tool downloaded a tampered installation. Binance's security team caught it, replaced the device and rotated credentials. The attackers had still learned who worked on wallet infrastructure.
2. September 2026 — the fake job. A second engineer was approached through a legitimate job-hunting platform and interviewed with a fictitious company. A fake HR representative shared personal photos and videos to build trust. A person claiming to be the company's chief executive then asked the engineer to download an "assignment". The code was malicious, and endpoint security tools missed it.
3. By October 20 — lateral movement. Using that machine together with an internal AI tool, the attackers took control of two more engineers' computers.
4. October 29 — the signing service. The attackers reached Binance's internal wallet signing service and moved funds outside the normal withdrawal process.

Chainalysis adds that the attackers spent weeks building trust and ran two rounds of interviews before sending the assignment. It calls the technique "contagious interviews" and attributes more than $14.3 million in losses over the previous 18 months to similar North Korea-linked fake-interview and malware schemes, which it reads as a rehearsal for Binance.

On-chain, Chainalysis describes the mechanics on Ethereum: an operator wallet funded through Tornado Cash submitted valid signed authorizations that let a Binance hot wallet run attacker-deployed code, and the attacker then called that wallet to sweep its assets. Other affected wallets appear to have sent funds through ordinary signed transfers. Coverage has focused on EIP-7702, the Ethereum upgrade that lets a regular account delegate execution to a smart contract; Cointelegraph's follow-up framing is that EIP-7702 did not cause the hack but may have amplified losses. Binance initially pointed to "a compromised DevOps engineer's laptop", and Teng later said the attack was more complex than one engineer's permissions (CNBC). Binance says some technical details will stay confidential.

The Binance AI Hack Angle: A Tampered AI Coding Tool and an Internal AI Assistant

Two AI tools sit inside the attack chain, and neither one "hacked" anything on its own. That distinction is why "binance ai hack" is rising as a search, and why the sourced answer is narrower than most social posts suggest.

• The lure (June): the first engineer was compromised by a tampered installer of a popular AI coding tool, not by a flaw in the tool itself (Binance postmortem via Forbes). The AI brand was the bait; the payload was ordinary malware.
• The accelerator (September to October 20): after the job-interview compromise, the attackers exploited access to an internal Binance AI tool to move deeper into the company's systems and take over two more engineers' machines (Forbes; Chainalysis).
• The laundering (after October 29): Elliptic traced thousands of automated transactions, including 1,113 TRX transfers with a median 90-second gap, but says it "cannot be determined from the on-chain data" whether AI agents were involved. CoinDesk reports the same Elliptic finding: automated laundering, no proof that AI agents directed the transactions. Elliptic adds that failed bridge retries look more like a script than an agent learning from mistakes.

What the sources do not say matters too. None of the reports we reviewed describe deepfaked video interviews; Forbes describes a fake HR representative sharing photos and videos, not synthetic faces. Chainalysis separately notes that a broader surge in blockchain-assisted attacks is driven partly by "the potential use of open-weight AI models", which is a sector trend rather than a finding about Binance.

The practical lesson for anyone building with AI agents is about permissions. An internal assistant that can read code, run commands or reach deployment systems becomes a path for an attacker who already controls one employee's laptop. We cover the defensive side in our hubs on agentic AI threat detection and SOC automation and AI coding agents and the software engineering labor market, and on the crypto side in our guides to AI agent crypto projects and Coinbase AgentKit wallets for autonomous AI agents, where the same question applies: what can the agent sign?

Who Hacked Binance? North Korea, TraderTraitor and the FBI Attribution

Four independent attributions point to the same unit. TRM Labs first flagged North Korea within hours, telling CNBC that the attack matched the Bybit hack and the April 2026 KelpDAO hack: "small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst." Chainalysis attributed the theft to TraderTraitor at 12:30 a.m. ET on October 30, citing real-time observation of Binance funds commingling with funds from the September 2026 Bitget theft, itself attributed to North Korean actors.

US authorities then went on the record. According to CoinDesk, the FBI's October 31 alert attributed the theft to TraderTraitor, listed cryptocurrency addresses tied to the stolen funds and asked exchanges and blockchain services to block them; the FBI has not released its full forensic findings. Elliptic said its on-chain evidence supports that attribution. TraderTraitor is generally described as part of the wider Lazarus Group cluster.

North Korea denies it. Kim Yo Jong, sister of leader Kim Jong Un, called the FBI's claims a "grave political provocation" in a statement published by state news agency KCNA on November 3 (CoinDesk). She disputed the FBI's Bybit attribution in 2025 as well.

The pattern behind "north korea hack binance" is the money. TRM Labs estimates North Korea has stolen about $12.8 billion in crypto since 2017 (via Forbes). Elliptic says North Korea-linked actors stole more than $6.5 billion in recent years before this attack, and that Binance alone nearly doubles that figure. The United Nations estimates the related IT-worker scheme brings the regime more than $600 million a year (cited by Chainalysis).

Is Park Jin Hyok Linked to the Binance Hack?

Park Jin Hyok is trending because he is the best-known name attached to North Korean hacking, not because any source has tied him to this theft. He is a North Korean programmer on the FBI's cyber most-wanted list, charged by the US Department of Justice in 2018 over the 2014 Sony Pictures attack and the 2017 WannaCry ransomware outbreak, and linked to the Lazarus Group through the Chosun Expo front company (background summary). He has never been arrested, so the charges have not been tested in court.

For the 2026 Binance hack, the public record names a unit, not a person. The FBI alert as reported by CoinDesk and CNBC attributes the theft to North Korea and TraderTraitor, and none of the sources we reviewed — Chainalysis, Elliptic, TRM Labs via Forbes, CoinDesk, CNBC — names any individual. Treat posts that say "Park Jin Hyok hacked Binance" as unverified.

Binance Hack Stolen Token Conversion: Freezes, ETH Swaps and Laundering

The first move was a race against the freeze button. Stablecoins such as USDT and USDC can be frozen by their issuers, so the attacker tried to swap them into assets nobody can freeze. Chainalysis watched about $500 million in stablecoins move into a swap wallet; over nearly 20 minutes it swapped $325 million in stablecoins for $285 million in ETH, and about ten minutes later sent the remaining $175 million to stopover wallets.

Elliptic's tally of the "binance hack stolen token conversion" before freezes landed:

• About $786 million of stablecoins converted to ETH and TRX.
• 434 million USDT swapped for 160,451 ETH through Uniswap, 1inch and market makers, at an implied loss of 12% to 26%, the price of speed.
• 234 million USDT swapped for 638 million TRX on SunSwap.
• A wallet borrowed 19,762 ETH from Aave against 59.9 million USDT of collateral.
• 18,270 BTC split across 19 addresses.
• Some Tron-side funds laundered alongside proceeds of the September 2026 Bitget exploit.

The freezes were fast. Elliptic reports that Tether froze a wallet holding 1.18 billion USDT 37 minutes after the USDT arrived, and Circle froze 823 million USDC in the same wallet three minutes later. Ripple, World Liberty Financial, Paxos and First Digital froze further stablecoins, Binance froze WBETH, and Arbitrum and Optimism governance secured stolen assets on their chains. By Elliptic's November 1 update, $2.85 billion was frozen or seized, 44% of the theft, with stablecoins making up 94% of the frozen funds. Chainalysis counted about $2.8 billion as of November 3.

What remains is the hard part of any "binance hack recovery". Elliptic estimates the attacker still controls about $3.25 billion that no issuer can freeze, spread over more than 800 addresses: roughly 584,000 ETH (about $1.32 billion), 18,327 BTC (about $1.42 billion) and 233 million XRP. The FBI expects the thieves to keep converting assets, mostly into ETH, ahead of "further laundering stages" (CNBC).

Binance Hack Crypto Price Drop: BNB, Bitcoin and Crypto Stocks

The market reaction was sharp but short of panic. By 10:00 p.m. ET on October 29, The Block recorded BNB down 7.1% to $698.65, bitcoin down 4.5% over 24 hours to $76,664 and ether down 5.2% to $2,190, with $1.55 billion of liquidations across 246,482 traders, $1.34 billion of them longs. Cointelegraph's snapshot a few hours later had BNB near $693, down about 8.2%, and the Bitcoin Fear and Greed Index at 30, its lowest since August 14. Laevitas' Rick Maeda called the reaction "fairly contained" for what may be the largest exchange theft ever (The Block).

US markets had already closed when the theft began at 4:05 p.m. ET, so October 30 was the first session to price it. Gemral Edge end-of-day price records show the move in listed crypto names from the October 29 close:

Read the table carefully. Exchange and stablecoin equities fell roughly twice as far as the bitcoin ETF on October 30: Coinbase -10.6% and Circle -9.3% against IBIT -5.1%. That gap is consistent with investors repricing custody and exchange risk rather than bitcoin itself. It is not proof of cause. October 30 also carried a broader crypto sell-off, and the declines after November 4 sit outside the hack window and likely reflect other drivers. The Edge table records what moved; it does not claim the hack was the only reason. For the derivatives side of Binance specifically, see our Binance funding rate history explainer.

Largest Crypto Hacks in History: Binance vs Bybit and Ronin

One theft now outweighs the next eight on the list combined. Using the amounts reported in the Anadolu Agency factbox (October 30, 2026), Elliptic for Bybit and CNBC for Bitget:

Ranks 2 to 9 add up to roughly $5 billion, still about $1.3 billion short of Binance alone. Elliptic offers a non-crypto benchmark: before Bybit, the largest theft on record was the roughly $1 billion taken from the Central Bank of Iraq in 2003, and Binance is more than six times that. The shared thread between the top two is method, not code: both were operations against people and signing processes, not bugs in a smart contract.

Was Your Binance Account Hacked? What Users Should Do Now

Short answer: the October 29 theft hit Binance's corporate hot wallets, not customer logins. Binance said "Binance will absorb the financial impact of these stolen funds, not our users", that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were "fully backed 100%", and that it was drawing on its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury to replace the rest (CNBC, October 31). Binance also said it found "no evidence of any wallet private key leak" (CNBC, October 29).

Big hacks still create a second wave of risk for ordinary users, because scammers borrow the headline. A practical checklist, based on standard account-security practice rather than anything specific to this incident:

1. Ignore "refund" and "compensation" messages. Binance's coverage is applied at the exchange level. Any DM, email or ad asking you to connect a wallet or share a code to "claim" losses is a phishing attempt.
2. Use phishing-resistant sign-in. Switch to passkeys or a hardware security key and an authenticator app; turn off SMS codes where you can.
3. Turn on a withdrawal address whitelist and an anti-phishing code so only addresses you approved can receive funds and genuine emails carry your code.
4. Review active devices, sessions and API keys. Delete API keys you do not use and remove withdrawal permission from trading bots that do not need it.
5. Keep long-term holdings off exchanges in a wallet you control, and move only what you trade.
6. If you think your own account was compromised, contact Binance support only through the official app or website, freeze the account from there, and report fraud to the FBI's Internet Crime Complaint Center (IC3) if you are in the US. Never pay a "recovery service".

If you work in crypto or any company that holds keys, the job-interview vector is the part to take personally. Run take-home coding tests only in a disposable virtual machine, never on a work laptop; verify a recruiter's company independently; and treat any request to install software during a hiring process as a red flag. Chainalysis counted at least $14.3 million lost to the same playbook before it was used on Binance.

How Gemral Edge Reads a Market Shock Like the Binance Hack

An event like this has three clocks: the on-chain clock (minutes), the price clock (hours) and the equity clock (the next US session). The Edge table above lines up the third clock against the first two using end-of-day records for 5 listed names. Retail traders who want the same discipline on charts can use the Gemral Crypto Pattern Scanner to see whether a move like BNB's 7.1% drop broke a pattern or stayed inside its range. Research teams that need point-in-time, cross-source datasets can review alternative data for hedge funds and the Edge methodology.

Methodology and limits: amounts, times and attributions come from the sources linked in each section and are reported as those sources state them; where they disagree we show the range. Price changes for COIN, CRCL, MSTR, HOOD and IBIT are computed from Gemral Edge end-of-day closes (October 29 to November 6, 2026). This page will be updated if Binance, the FBI or the analytics firms publish new findings. Public data · not investment advice. Nothing here is a recommendation to buy or sell any asset.