Hackers who stole approximately $6.3 billion from Binance on October 29, 2026, had been inside the exchange's systems for eight weeks before executing the heist. The theft itself was swift, taking roughly 20 minutes, but the preparation was extensive. The attackers moved across more than ten blockchains, including Ethereum, Bitcoin, and Solana, indicating a highly coordinated effort.
The breach began as early as June 2026, with specific testing occurring around October 20. The attackers used social engineering tactics, including fake job interviews and tampered software development tools, to gain access. Notably, they bypassed the need to compromise private keys, which are typically considered the most secure aspect of exchange security.
The attack has been attributed to TraderTraitor, a North Korean state-sponsored hacking group linked to previous high-profile thefts, such as the $1.5 billion theft from Bybit in February 2025. Binance paused withdrawals immediately after the theft but later resumed them in phases. The exchange allocated $6.34 billion from corporate resources to cover the losses, with about 98% of the stolen assets replenished by October 31.
Stablecoin issuers and partners played a crucial role in mitigating the damage, freezing or intercepting roughly $2.85 billion to $3 billion of the stolen funds. Binance also commissioned an independent security review to analyze the breach and strengthen its defenses. The incident highlights the vulnerabilities in hot wallet security and the importance of internal system protections.