Binance suffered a large-scale hacker attack overnight on Oct. 30, 2026, the exchange said in an official statement, with preliminary losses estimated at $6.3 billion. The incident became the largest hack in the crypto industry’s history, surpassing the February 2025 attack on Bybit.

Binance temporarily suspended deposits and withdrawals and said it would cover all financial losses through its SAFU insurance fund and company funds. The final amount of unrecovered assets remained unknown as the investigation continued.

Attack spanned 10 blockchains

Analytics firm TRM Labs estimated that the attackers siphoned about $6.36 billion from Binance wallets across 10 blockchains, with most of the assets taken in roughly 20 minutes.

Ethereum accounted for the largest share of the losses at about $3.79 billion. Approximately $1.47 billion was taken in bitcoin and about $628 million on the Tron network. The attack also affected XRP Ledger, Solana, Arbitrum, Avalanche and other networks.

Most experts attributed the attack to North Korean hackers. Chainalysis said it had a high degree of confidence that North Korea was responsible after investigators observed assets stolen in Binance’s hack commingling with funds taken by North Korean hackers in the September Bitget exploit.

Compromised laptop investigated

Binance’s preliminary investigation indicated that a compromised laptop belonging to a DevOps engineer may have allowed an attacker to access a service container and submit unauthorized cryptocurrency withdrawal transactions. The exchange said it had found no evidence that wallet private keys were leaked.

Binance said the final cause had not been determined and that it would publish a detailed report after completing its investigation.

TRM Labs said the attackers used the EIP-7702 mechanism against one Ethereum hot wallet. The mechanism allows control of a wallet to be delegated to a smart contract through signed authorization.

According to the firm, the attacker prepared 50 authorizations and used them to reroute assets to controlled addresses. Similar unauthorized transfers occurred simultaneously on other blockchains, leading analysts to believe the attacker had gained access to Binance infrastructure responsible for signing transactions.

Assets frozen and converted

Binance revoked authorization for the affected address and contacted stablecoin issuers, analytics firms and law-enforcement agencies to track and freeze the stolen assets. Onchain analyst ZachXBT estimated that the industry’s joint efforts had frozen more than $2.83 billion at the time of writing.

The attackers also tried to exchange stolen stablecoins for crypto assets that could not be blocked by a centralized issuer. TRM Labs said they swapped about 325 million USDT through UniswapX and other services for approximately 122,300 ETH.

Another 60 million USDT was deposited into the Aave lending protocol as collateral, yielding about 19,760 ETH worth $44.6 million, according to TRM Labs.

In response, Aave temporarily froze its DAO-operated lending markets across V3 and V4, affecting hundreds of reserves on multiple blockchains and preventing new deposit and borrowing positions. In an Oct. 29 statement, Aave said its contracts were unaffected and positions remained overcollateralized.

Cryptocurrency prices fall

News of the attack triggered declines in digital-asset prices. Bitcoin fell about 3% over 24 hours and briefly reached $76,300, while Ethereum declined to $2,178, its lowest level in two months.

BNB fell as much as 8%, while other crypto assets, including AAVE, also recorded significant losses.

Source: Incrypted