Billions Left in 40 Minutes. How Did That Happen? Can the world's largest crypto exchange lose billions in under an hour? On October 29, 2026, Binance did. It puts the total impact at about $
Can the world's largest crypto exchange lose billions in under an hour? On October 29, 2026, Binance did. It puts the total impact at about $6.3 billion. If that holds, it's the biggest crypto theft on record.
This binance hack explained guide covers the timeline, the likely attack path and the freeze that stopped nearly half the money. It also sets the case beside Mt. Gox, FTX and Bybit. Think of it as the binance hack explained for first-time readers. Some facts are confirmed. Others aren't. We label each one.
Here is the binance hack explained in six points:
Binance's hot wallets, the internet-connected ones that pay out withdrawals, were drained across about ten blockchains, including Ethereum, Bitcoin and Tron.
Most transfers happened between roughly 20:24 and 21:04 UTC. That's about 40 minutes.
Early on-chain tallies ranged from about $2 billion to $5.8 billion. Binance later estimated the total impact at around $6.3 billion.
Tether, Circle and other partners froze assets. Binance says the verified frozen total is about $3 billion.
Binance paused deposits and withdrawals. It says user funds are safe and that it will cover all losses from its SAFU fund and company funds.
Its first findings point to a compromised DevOps engineer's laptop. It says it found no evidence of a wallet private key leak.
Two blockchain analytics firms say, with high confidence, that North Korea's Lazarus Group group is behind it. Officials haven't confirmed that.
Deposits are running normally. Binance expects to begin resuming withdrawals within 48 hours of its October 30 update.
Founder Changpeng Zhao, who no longer runs the exchange, said the activity "does look like a hack." Binance's own posts say "security incident." We use "hack" because the money left through unauthorized withdrawals.
Here's the binance hack explained minute by minute, with all times in UTC.
Time
What happened
Oct 29, 20:24
A hot wallet labelled Binance 14 sends out billions in one transaction; outflows spread across about ten blockchains until roughly 21:04
Just after midnight
All deposits and withdrawals suspended; Binance pledges to cover losses
Oct 30, 00:52
Binance says about $3 billion is frozen
Early Oct 30
Binance estimates total impact at about $6.3 billion
Around 04:17
Binance's co-CEO says deposits run normally and withdrawals should resume within 48 hours
The speed is the part that stands out. Forty minutes is half a football match. Markets slid too.
A crypto wallet is a system that stores private keys. A private key is a secret code that proves you can spend certain coins. Whoever can sign with that key can move the money.
Exchanges split their funds into two groups, and that split is central to the binance hack explained.
Feature
Hot wallet
Cold wallet
Internet connection
Yes
No, kept offline
Speed
Fast withdrawals
Slower, manual approvals
Main risk
Remote attack
Process or human failure
Typical use
Daily customer withdrawals
Bulk storage
Think of a shop. The hot wallet is the till. The cold wallet is the back-room safe. A till has to stay open for customers. That's the trade-off, and it's why a hot wallet compromise can empty a lot of money fast.
For scale in this binance hack explained, Binance's year-end 2025 proof of reserves listed roughly $163 billion in user assets. Against that, $6.3 billion is about 4%.
Binance hasn't published its full post-mortem. This part of the binance hack explained keeps official statements and outside analysis apart.
Binance says its first findings point to a compromised laptop belonging to a DevOps engineer. That's someone who builds and runs the exchange's servers and software. The attacker then reached a service container, which is a packaged program running inside those servers. From there, the attacker submitted unauthorized withdrawals.
Binance also says it found no evidence of a wallet private key leak.
Our read on the binance hack explained so far: those two statements can both be true. If an internal system can sign payments on its own, an attacker who controls it doesn't need the key file. They can ask the system to sign. Binance hasn't confirmed this, so treat it as interpretation, not fact.
Security researchers flagged an Ethereum feature called EIP-7702. It came with the Pectra upgrade. It lets a normal wallet hand temporary control to a smart contract, which is a program that lives on the blockchain.
Researchers said the attack transaction carried 50 of these delegations, all aimed at one Binance hot wallet. Only one matched the wallet's nonce, the running count of its transactions. The wallet was busy, so the attacker couldn't know the exact number. Sending 50 guesses covered that gap.
Minutes later, the wallet sent out about 167,000 ETH, roughly $1.6 billion in USDT and more than 60 other tokens in a single transaction.
Here's the open question in this binance hack explained story. Each delegation needs a valid signature from the wallet. So someone could produce signatures. How they gained that ability is what the post-mortem has to explain.
Status
Detail
Stated by Binance
Security incident; deposits and withdrawals paused; about $6.3B impact; about $3B frozen; losses to be covered
Binance's early finding
Compromised DevOps laptop; service container access; no evidence of a private key leak
Outside analysis
EIP-7702 delegations; 50 authorizations in one transaction; North Korean attribution with high confidence
Still unknown
Official confirmation of who did it; how signatures were produced; the final loss; the exact date withdrawals reopen
On attribution, in this binance hack explained story, two blockchain analytics firms say, with high confidence, that North Korea's Lazarus Group group, is responsible. They point to similarities with the Bybit attack, including preparation well before the theft. That's an analyst assessment, not a formal government attribution. Binance hasn't named anyone.
The freeze is the better half of this binance hack explained story.
Tether and Circle issue the stablecoins USDT and USDC. A stablecoin is a token built to track a currency, usually the US dollar. Issuers control the token's smart contract, so they can block specific addresses. Blocked coins can't move.
Tether said it froze more than 1.5 billion USDT. Circle froze over 800 million USDC in the same receiving wallet. Other service providers added more. Binance's verified total climbed from $2.54 billion to about $3 billion in roughly 90 minutes. Some outside tallies run lower, nearer $2.7 billion, so treat $3 billion as Binance's figure and expect it to move.
That is asset freezing at its fastest. It worked because much of the stolen value sat in stablecoins. In short, here's the binance hack explained for freezes: stablecoins can be stopped, Bitcoin and Ether can't.
That's the gap. Binance's two official numbers are about $6.3 billion in impact and about $3 billion frozen. As of October 30, 2026, roughly half is still unlocked.
A freeze isn't a recovery. Frozen funds still need legal or issuer steps before they return to the rightful owner. Binance says it will cover losses either way.
Not every big crypto disaster is a hack. Here's the binance hack explained next to three older cases.
Case
Year
What happened
Size
Outcome
Mt. Gox
2014
About 850,000 BTC went missing; exchange went bankrupt
About $450M then
Creditors waited roughly a decade; repayments began in 2024
FTX
2022
Collapse tied to misused customer funds; a separate $477M was drained on bankruptcy night
About $8B customer shortfall
Bankruptcy; founder convicted of fraud
Bybit
2025
Cold wallet drained after the signing process was tampered with
About $1.5B
Attributed to North Korea's Lazarus Group; about 5.3% frozen or recovered
Binance
2026
Hot wallets drained through unauthorized withdrawals
About $6.3B (Binance estimate)
About $3B frozen; full cover promised
Two differences stand out. FTX wasn't a hack. Customer money was misused.
Binance promised full cover from day one. Its SAFU fund was roughly $1 billion in Bitcoin as of a January 2026 update. That can't cover $6.3 billion alone, so company funds matter.
Bybit is the closest match, and Binance's figure is about four times larger. One caution on this crypto exchange hack comparison: dollar values come from each event's date, so don't read them like for like.
Stolen crypto tends to follow a pattern, and the binance hack explained so far fits it.
Spread. Funds get split across many addresses.
Swap. Coins that can be frozen, like stablecoins, get swapped for ones that can't.
Bridge or mix. Cross-chain swaps and mixers blur the trail.
Cash out. Exchanges and over-the-counter desks turn it into cash.
Bybit shows how this goes, and it's useful context for the binance hack explained so far. Court records unsealed by August 2026 showed only about 5.3% of its stolen funds, around $75.5 million, was frozen or recovered. More than 90% had gone dark, meaning it couldn't be traced.
Onchain forensics is the work of following those moves. Analysts link addresses and alert exchanges. Every move is visible on a public blockchain. Visible doesn't mean reversible.
Binance's case differs on one count. Close to half was frozen within hours, well above Bybit's single-digit share. Freezes work best early.
Bitcoin and Ether outside the freezes can still be traced, even if they can't be switched off.
You don't need to panic. Here's the binance hack explained as practical lessons.
Know what an exchange balance is. The binance hack explained in one lesson: custody is trust. Coins on an exchange are held by the exchange. You trust its security and its promises.
Watch how a platform behaves in a crisis. Clear statements, proof-of-reserves updates and a real post-mortem are good signs. Binance has promised the last two.
Lock down your account. Use an authenticator app or passkey, turn on withdrawal address whitelisting, and set an anti-phishing code.
Expect scams. Fake refund and recovery messages spread after big incidents. Use only official channels. Never share a seed phrase.
Think about where long-term coins sit. Many users keep only trading balances on exchanges and use a hardware wallet for the rest. Self-custody has its own risk: a lost seed phrase can't be recovered.
This binance hack explained recap comes down to four facts. Hot wallets were drained in about 40 minutes. Binance estimates the impact at $6.3 billion. Stablecoin issuers and partners froze around $3 billion. Binance says it will cover all losses.
Plenty remains open in the binance hack explained so far. We don't know how the attacker gained signing ability, what the final loss is, whether officials will confirm the North Korea link, or exactly when withdrawals return. Watch for the post-mortem, the updated proof of reserves and a reopening date on Binance'sofficial announcements page.
Disclaimer: This article is for information only and isn't financial, legal or investment advice. Crypto assets are volatile and high risk, and details of this incident are still developing. Do your own research and rely on official sources before making decisions.
