Elon Musk

Secret

World Liberty Financial

Bitcoin

Binance has suffered the largest crypto theft on record.
Attackers moved about $6.36 billion out of the exchange's hot wallets - the internet-connected wallets used to pay out customer withdrawals - across ten blockchains late Thursday, most of it in about 20 minutes, according to <a href="https://www.trmlabs.com/resources/blog/north-korea-has-stolen-usd-128-billion-in-crypto-usd-74-billion-of-it-in-2026" rel="noopener noreferrer nofollow">TRM Labs</a>.
Bitcoin sold off as the news spread. Hourly CoinGecko figures show it traded near $80,769 at 4 p.m. ET Thursday, minutes before the first outflows, slid about 2.5% within the hour, fell to about $76,700 by 10 p.m. ET, recovered toward $78,500 overnight, then drifted back to about $76,400 by mid-afternoon Friday ($76,472 at the 3:28 p.m. ET capture) - a net drop of roughly 5% from the pre-theft price.
Binance co-founder Changpeng "CZ" Zhao argues the headline number is misleading.&nbsp;
The theft is the biggest ever in dollar terms, he wrote, but not in Bitcoin terms. The on-chain data shows what he means.
<figure><img src="https://www.thestreet.com/.image/c_fit%2Ch_675%2Cw_1200/MjI3Mjg1OTgxMjY5NTk5MjYz/f7a98fb2-da3a-40af-9ce0-895a101912ee.png" height="675" width="1200">
</figure>
<h3 id="read-our-full-binance-hack-coverage">Read our full Binance hack coverage</h3>
<ul>
 <li><a href="https://www.thestreet.com/crypto/markets/binance-cites-1b-spacex-stake-after-elon-musk-mocks-hack" rel="noopener noreferrer nofollow">Binance cites $1B SpaceX stake after Elon Musk mocks hack</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/coinbase-microstrategy-robinhood-tumble-after-largest-crypto-hack-ever-" rel="noopener noreferrer nofollow">Coinbase, MicroStrategy, Robinhood tumble after largest crypto hack ever</a></li>
 <li><a href="https://www.thestreet.com/crypto/markets/standard-chartered-sees-new-winner-after-binance-hack" rel="noopener noreferrer nofollow">Standard Chartered sees new winner after Binance hack</a></li>
 <li>Op-ed: <a href="https://www.thestreet.com/crypto/markets/im-with-elon-musk-on-binances-hack" rel="noopener noreferrer nofollow">I'm with Elon Musk on Binance's hack</a></li>
</ul>
<h2 id="what-happened">What happened</h2>
The first unauthorized transfers left Binance hot wallets at 4:05 p.m. ET Thursday, per TRM Labs. <a href="https://www.chainalysis.com/blog/binance-exploit-latest-findings-and-response/" rel="noopener noreferrer nofollow">Chainalysis</a> puts the start at about 4:20 p.m. ET.
On <a href="https://www.thestreet.com/crypto/ethereum" rel="noopener noreferrer nofollow">Ethereum</a>, the attacker abused a new feature called EIP-7702, which lets a wallet temporarily run another program's code, using 50 authorizations signed in advance, TRM said.&nbsp;
On the nine other affected chains, funds left through ordinary signed transfers. In TRM's assessment, that points to a compromise of Binance's hot-wallet signing infrastructure rather than a single stolen key.
Binance's preliminary finding is similar: a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals.&nbsp;
The exchange says it has found no evidence of a private-key leak.&nbsp;
Co-CEO Richard Teng later said investigators uncovered multiple breach points and called it "a complex attack.”
Withdrawals remain suspended while <a href="https://www.thestreet.com/crypto/tag/binance" rel="noopener noreferrer nofollow">Binance</a> rebuilds and tests its systems; deposits are unaffected.&nbsp;
Teng said the exchange aims to resume withdrawals by Sunday and will publish a Proof of Reserves report, a public attestation that customer balances are fully backed.
Valued at the time of transfer, the haul breaks down as $3.77 billion on Ethereum, $1.48 billion in bitcoin, $628 million on Tron, $300 million on the <a href="https://www.thestreet.com/crypto/tag/xrp-ledger" rel="noopener noreferrer nofollow">XRP Ledger</a> and $96 million on <a href="https://www.thestreet.com/crypto/tag/solana" rel="noopener noreferrer nofollow">Solana</a>, according to an on-chain tally.
<h2 id="big-in-dollars-small-in-bitcoin">Big in dollars, small in bitcoin</h2>
"$6.3 billion is the biggest in USD terms, but not in BTC terms," Zhao wrote in an <a href="https://x.com/cz_binance/status/2116198836729520420" rel="noopener noreferrer nofollow">X post</a>.&nbsp;
<blockquote>
 "MtGox was 650,000 BTC!"
</blockquote>
The stolen Bitcoin itself is precisely traceable. Binance's hot wallet sent 18,270 BTC, worth about $1.4 billion, to one address in 11 transactions confirmed in a single block; the attacker then split it across 19 wallets, where it sat unmoved as of early Friday, per mempool.space data and <a href="https://bitquery.io/investigations/binance-hack" rel="noopener noreferrer nofollow">analytics firm Bitquery</a>.
Measured against supply, the two thefts are different animals.
About 20.1 million Bitcoins are in circulation today (20,105,657, per <a href="https://www.kraken.com/prices/bitcoin" rel="noopener noreferrer nofollow">Kraken</a> on Oct. 30), so the Binance hacker's 18,270 BTC is about 0.09% of all coins. Mt. Gox's roughly 650,000 BTC, by contrast, was more than 5% of the Bitcoin in existence at the time - the <a href="https://www.thestreet.com/crypto/tag/justice-department" rel="noopener noreferrer nofollow">U.S. Justice Department</a> has tied about 647,000 BTC to that breach.
One clarification worth making: these were transfers of existing coins, not newly issued supply. The total number of bitcoins did not change. The stolen coins are simply parked in wallets the market can watch; as of early Friday, none had moved.
<figure><img src="https://www.thestreet.com/.image/c_fit%2Ch_675%2Cw_1200/MjI3Mjg1OTgxMjY5NjAwMTQy/8c6f86d2-973b-449a-8afd-c107b7a445fe.png" height="675" width="1200">
</figure>
A comparison table Zhao shared estimates the Mt. Gox bitcoin would be worth more than $50 billion at today's prices.
<figure><img src="https://www.thestreet.com/.image/c_fit%2Ch_675%2Cw_1200/MjI3Mjg1OTgxMjY5NjY1Njc4/394090d4-0c36-4080-8276-79fb58a6c6d9.png" height="675" width="1200">
</figure>
<h2 id="who-was-hit-and-who-pays">Who was hit, and who pays</h2>
At Mt. Gox, which collapsed in 2014, and at FTX, which failed in 2022, nearly all users and their assets were affected. In Binance's case, Zhao wrote, there is "only one victim" - the exchange itself.
Binance says it will cover all losses and has reserved more than $6.34 billion in company resources, including $5 billion already held in the exact tokens affected, with the remainder being bought on public markets and over the counter.&nbsp;
Its Secure Asset Fund for Users, an emergency reserve created in 2018, holds roughly $1 billion in Bitcoin.
Zhao did not play the hack down. "Obviously, still a major disaster for the industry, Binance (and me)," he wrote. "It hurts, but we survive. Most importantly, we protect our users."
The market's relatively measured reaction was captured early Friday by Bitcoin investor <a href="https://x.com/APompliano" rel="noopener noreferrer nofollow">Anthony Pompliano</a>:&nbsp;
<blockquote>
 "One of the largest crypto exchanges gets hacked for $6 billion and Bitcoin sold off less than 5%? Bullish."&nbsp;
</blockquote>
At the time of his post, Bitcoin had pared its losses to under 5%; by mid-afternoon Friday it had slipped to fresh lows near $76,400 (3:00-3:28 p.m. ET captures).
<h2 id="frozen-is-not-the-same-as-recovered">Frozen is not the same as recovered</h2>
The fastest counterattack came from <a href="https://www.thestreet.com/crypto/stablecoins" rel="noopener noreferrer nofollow">stablecoin</a> issuers - the companies behind dollar-pegged tokens, which can freeze their own tokens at specific <a href="https://www.thestreet.com/crypto/tag/blockchain" rel="noopener noreferrer nofollow">blockchain</a> addresses.&nbsp;
Binance says partners have frozen about $3 billion of the stolen funds.
<ul>
 <li><a href="https://www.thestreet.com/crypto/tag/tether" rel="noopener noreferrer nofollow">Tether</a> froze about $1.77 billion in USDT,</li>
 <li>Circle about $825 million in USDC,</li>
 <li>Ripple $40.5 million in RLUSD</li>
 <li><a href="https://www.thestreet.com/crypto/tag/world-liberty-financial" rel="noopener noreferrer nofollow">World Liberty Financial</a> $27.8 million in USD1</li>
 <li>Arbitrum's Security Council froze about $30 million in ETH and ARB.</li>
</ul>
But frozen does not mean returned.
"A freeze stops the money from moving, and recovery follows through legal process," Ari Redbord, global head of policy at TRM Labs, told <a href="https://www.cnbc.com/2026/10/30/billions-in-crypto-frozen-in-binance-hack-heres-what-happens-next-.html" rel="noopener noreferrer nofollow">CNBC</a> - typically a court order or seizure warrant before issuers reissue tokens to victims.&nbsp;
Stablecoins are the most recoverable asset class in crypto because the issuer controls the contract. Bitcoin and ether have no issuer; they can be traced but not frozen.
<h2 id="who-did-it">Who did it</h2>
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, citing on-chain and off-chain intelligence.
The preparation - small withdrawals through Tornado Cash, a crypto mixing service, funding an operator wallet at least 36 hours before the theft, signatures obtained in advance and executed in one burst - matches the earlier Bybit and KelpDAO heists, TRM said.
Chainalysis reached the same conclusion, noting that funds stolen from Binance commingled on-chain with proceeds of last month's Bitget theft, also attributed to North Korea. No government has formally attributed the attack.
The FBI has said it is aware of the incident, and the U.S. Secret Service says it is working "around the clock" to identify, freeze, trace and recover the funds, per the <a href="https://www.bbc.com/news/live/cqrmynd3042gt" rel="noopener noreferrer nofollow">BBC</a>.
North Korea has stolen about $12.8 billion in crypto across 100 incidents since 2017, including $7.4 billion in 2026 alone, TRM estimates.
<a href="https://www.thestreet.com/crypto/markets/how-much-of-binances-emergency-fund-is-available" rel="noopener noreferrer nofollow">Related: How much of Binance's emergency fund is available?</a>

Why Bitcoin shrugged off the largest crypto hack ever

Table of Contents

TheStreet Roundtable

Other articles published on Oct 31, 2026

Join our free newsletter for daily crypto updates!