The largest theft in crypto history took roughly 20 minutes to execute and less than 72 hours to reimburse. That contrast — a state-linked unit moving billions across ten blockchains, and an exchange covering almost all of it from its own balance sheet — defines the week that closed October 2026. The market, however, did not wait for the refund before repricing risk.
Anatomy of a record loss
Blockchain intelligence firm TRM Labs told the Associated Press that about $6.36 billion left Binance wallets on Thursday 29 October, spread across ten blockchains. Binance itself put the loss near $6.3 billion. Jonathan Levin, co-founder and chief executive of Chainalysis, estimated $6.4 billion, CoinDesk reported. All three figures point to the same conclusion.
For scale, Nextgov/FCW noted the sum is more than four times the roughly $1.5 billion stolen from Bybit in February 2025. TRM Labs' initial breakdown placed about $3.79 billion of the haul in Ethereum and $1.47 billion in bitcoin, according to ITPro. CoinDesk counted 18,270 BTC moved, citing on-chain records from mempool.space.
The numbers at a glance
| Item | Figure |
|---|---|
| Total drained (TRM Labs) | about $6.36 billion |
| Ethereum share | about $3.79 billion |
| Bitcoin share | about $1.47 billion (18,270 BTC) |
| Assets frozen | about $3 billion |
| Replaced by Sunday 1 November | about 95% |
| Net outflow, first 9.5 hours | $3.64 billion |
| Bitcoin, 31 October close | $77,434.75 |
How the attacker got inside
Binance's preliminary investigation, summarised by Nextgov/FCW, traced the breach to a compromised laptop belonging to an engineer working on the exchange's software and operations. From there the attacker reached an internal service and submitted withdrawals without authorisation from wallets handling assets across several networks.
A later review uncovered additional "points of breach", Binance said, according to AP. The exchange stated it found no evidence that wallet private keys had leaked. That distinction matters: a leaked key implies compromised custody architecture, whereas an abused internal service points to process and access controls.
Washington names TraderTraitor
TRM Labs attributed the attack "with high confidence" to TraderTraitor, a North Korean state-backed unit, AP reported, and Levin of Chainalysis said the hack was likely the same group's work. On Friday 30 October the FBI said only that it was coordinating with public and private partners, without naming anyone.
That changed a day later. On Saturday 31 October the FBI, the US Secret Service and IRS Criminal Investigation formally attributed the theft to TraderTraitor and asked node operators, instant exchanges, DeFi services and other virtual asset providers to block laundering-linked transactions. The list covered more than 600 Ethereum addresses, just under 20 bitcoin addresses and one Solana address.
TraderTraitor is the same unit blamed for the Bybit theft in 2025. US intelligence assessed in 2026 that Pyongyang nets at least $1 billion a year from crypto heists and other financial crimes, Nextgov/FCW reported.
Who pays: SAFU, company funds and frozen stablecoins
By Saturday 31 October Binance said it had set aside more than $6.34 billion, including $5 billion already held in the affected cryptocurrencies, CoinDesk reported. It replaced 90% of the stolen assets that day and about 95% by Sunday 1 November, drawing on company funds and the Secure Asset Fund for Users, its emergency reserve.
The outstanding 5% sits in less liquid tokens, which Binance said it was acquiring through market and over-the-counter channels. Separately, about $3 billion of the stolen assets has been frozen, mostly stablecoins such as USDT and USDC that issuers can block. CoinDesk put stablecoin freezes above $2.4 billion. Bitcoin and ether cannot be frozen that way.
Analyst Ruslan Averin argues the headline loss matters less to ordinary holders than the speed of replacement: a reimbursed user faces no credit loss, while an unreimbursed one would.
The withdrawal stress test
Withdrawals were suspended on Friday 30 October, with deposits unaffected, AP reported. The pause lasted about 45 hours. Phase one reopened at 06:00 UTC on Sunday 1 November for bitcoin, ether, USDT, USDC, BNB and XRP, a Binance spokesperson told CoinDesk.
In the first 9.5 hours the exchange processed $4.65 billion of withdrawals against $1.01 billion of deposits — a net outflow of $3.64 billion. DefiLlama showed more than $6 billion leaving Binance-linked wallets over 24 hours, a figure that can include internal transfers. Against the $171 billion in assets reported before the attack, $6 billion is about 3.6%.
Binance also said balances in ten assets, including BTC, ETH and USDT, are fully backed, and promised a full proof-of-reserves report. No date was given.
Bitcoin's red October
Bitcoin closed Saturday 31 October at $77,434.75, down 7.3% from its 30 September close of $83,553.85, per CoinMarketCap data published on Yahoo Finance. That is the weakest October since 2014, when the same series shows a 12.7% loss, and the second consecutive losing October after a 3.9% decline in 2025.
It is not the worst month of the year — bitcoin lost 20.4% in June 2026 — but October is historically the strongest, which makes two red Octobers in a row notable. The hack day did most of the damage: $81,267.59 on Wednesday 28 October, $77,775.11 on Thursday 29 October, a 4.3% drop. Sunday 1 November closed at $78,248.45.
ETF flows turn negative
US spot bitcoin ETFs shed a net $643.3 million on Friday 30 October, the largest single-day outflow since 25 June, CoinDesk reported citing SoSoValue. BlackRock's IBIT accounted for $233.7 million and Fidelity's FBTC for $201.4 million of that total.
Across October the funds recorded $515 million of net outflows, ending a two-month inflow streak. According to analyst Ruslan Averin, whether that single Friday was an isolated reaction or the start of a pattern is the cleanest read on institutional sentiment available in daily data.
Security settings worth reviewing
These are configuration points for holders using centralised exchanges, not trading advice.
- Two-factor authentication. An authenticator app, hardware security key or passkey beats SMS codes, which SIM swaps can intercept.
- Withdrawal whitelist. Most large venues, Binance included, allow withdrawals only to pre-approved addresses.
- Anti-phishing code and API hygiene. Set a code so genuine emails carry it; delete unused API keys and never grant a bot withdrawal rights.
- Ignore "compensation" offers. Binance is covering losses itself, so any link asking users to log in or "verify" a wallet is phishing.
- Self-custody basics. A hardware wallet keeps keys off the exchange; the recovery phrase belongs on paper or metal, offline. Send a small test transaction first.
- Records. Keep withdrawal and deposit histories. Ukraine still has no dedicated crypto tax regime, which is not the same as no tax.
Self-custody removes exchange risk but adds personal risk: a lost recovery phrase cannot be restored by anyone.
The near-term calendar
Remaining withdrawal phases reopen only as each network passes security checks, with no timetable published. The promised proof-of-reserves report should reveal how much of the $6.34 billion came from SAFU versus company funds.
Macro and policy events crowd the same week: US midterm elections on Tuesday 3 November, which shape crypto market-structure legislation, and the US October jobs report on Friday 6 November. Meanwhile, FBI address lists and stablecoin freezes will determine how much of the roughly half of the loot still unfrozen can be intercepted.