Binance hack 2026: About $6.3 billion drained from exchange wallets

The Binance hack 2026 involved roughly $6.3 billion in crypto drained from wallets the exchange uses to process transactions on Thursday, according to Binance and blockchain-record analysis reported by Reuters. The reported theft is the largest crypto theft on record by the gross value moved without authorization, but that figure is not the same as Binance’s final loss or the amount attackers can ultimately convert.

For customers, the immediate issue is whether Binance can carry out its pledge to cover losses. The exchange paused withdrawals during its security review and said customer losses would be paid with company resources and its Secure Asset Fund for Users, or SAFU, an emergency reserve. Binance said it had set aside about $6.34 billion for that purpose, according to Reuters and CNBC. That is a company commitment, not confirmation that customers have already been repaid.

What happened in the Binance hack?

The bulk of the transfers occurred in about 20 minutes, beginning shortly after 2000 GMT on Thursday, Reuters reported. Estimates differ slightly: Binance put the amount at about $6.3 billion, TRM Labs estimated $6.36 billion, and Chainalysis estimated roughly $6.4 billion. Those are gross unauthorized transfers, before assets are frozen, recovered or returned.

The scale exceeds the roughly $1.5 billion stolen from Bybit in 2025. Binance said its initial investigation pointed to a compromised laptop, then said it had identified additional breach points. Richard Teng, Binance’s co-CEO, described the incident as a more complex attack than misuse of one employee’s access, Reuters reported.

TRM Labs said attackers compromised Binance’s signing infrastructure, the systems that authorize transactions. In plain terms, that would allow unauthorized instructions to be approved and sent from affected wallets. Binance said it found no evidence that the private keys controlling the wallets were leaked. The available accounts point to a failure in Binance-controlled transaction systems, rather than a flaw in Bitcoin, Ethereum or other underlying blockchains.

TRM also said an Ethereum feature called EIP-7702 was used in part of the attack. The feature lets an ordinary Ethereum wallet temporarily run smart-contract code. According to TRM, attackers used 50 pre-signed authorizations to make a Binance hot wallet, an internet-connected wallet used for transactions, act as a contract that swept out assets.

How much of the stolen crypto has been stopped?

About half of the stolen assets were stablecoins that issuers froze, Reuters reported. Stablecoins are tokens designed to track a currency such as the U.S. dollar and are issued by companies that can blacklist certain addresses. Tether froze nearly $1.57 billion tied to the incident, while Circle froze more than $800 million, Reuters reported.

A freeze can stop funds from moving, but it does not automatically return them to Binance. Bitcoin and ether work differently: no central issuer can remotely freeze them. TRM estimated that about $2.4 billion in bitcoin and ether was beyond reach, Reuters reported.

Who is suspected of carrying out the attack?

TRM Labs said it was highly confident that a North Korea-linked group was responsible, based on similarities to the 2025 Bybit theft, and Chainalysis also identified links to prior North Korea-attributed activity. Binance had not identified the attackers, Reuters reported. North Korea routinely denies involvement in cyberattacks and crypto thefts.

The breach also illustrates the custody risk of keeping crypto on an exchange. Customers rely on that company’s security controls and its financial capacity to absorb a loss. Reuters reported that crypto prices fell after the incident as authorities and industry partners worked to trace and freeze funds.

This story draws on original reporting from Decrypt.