Binance: the $6.3bn exchange hack

What was reported on 30 October 2026

Binance said on 30 October 2026 that about $6.3bn (£4.7bn) of digital assets were affected by an attack. The BBC reported it may be the largest cryptocurrency theft on record, well above the roughly $1.5bn taken from the Bybit exchange in February 2025.

Binance’s preliminary explanation was that attackers may have gained access to a staff member’s laptop, allowing unauthorised withdrawals. Binance said it found no evidence of any wallet private key leak. ABC News reported that funds appeared to move out of several hot wallets, the internet-connected wallets an exchange uses for everyday withdrawals.

Crypto watchers cited by ABC News said 30 to 40 tokens were affected, including Bitcoin, Ethereum and the USDT and USDC stablecoins.

Binance temporarily suspended deposits and withdrawals while security checks were completed. Co-CEO Yi He said withdrawals would stay disabled until the environment was confirmed secure. Binance said it would cover all losses, had reserved more than $6.34bn of company funds, including $5bn in the affected tokens, and was working with law enforcement and blockchain intelligence firms to trace and recover funds.

Tether and Circle, which issue USDT and USDC, said they had frozen about $2.4bn between them: about $1.6bn according to Tether CEO Paolo Ardoino, and more than $800m according to Circle. ABC News reported about $3bn frozen in total. Binance.US and Coinbase said they were not affected.

Blockchain analytics firms TRM Labs and Chainalysis linked the attack to TraderTraitor, a North Korean hacking unit; Chainalysis said it had high confidence. TRM Labs’ Ari Redbord called the attack a watershed moment. Binance did not directly address the North Korea link.

What is not yet established

This case study was reviewed the day the incident was disclosed. Treat every figure as preliminary and check the cited sources for later developments.

• The final loss. Early figures describe assets affected or targeted; frozen and recovered amounts were still changing when this case study was reviewed.
• The full intrusion path. The laptop explanation was preliminary, and how access to one endpoint reached withdrawal capability had not been published.
• Attribution. The North Korea link comes from analytics firms, not from Binance or a government statement.
• Customer impact. Binance said user funds are safe and losses will be covered; that is the company’s statement, not an independent audit of its balances.

Why it matters to a small business

Few businesses run a cryptocurrency exchange, but most have a staff device that can move money. The lessons below are editorial planning guidance drawn from the reported sequence. They are not findings about Binance’s internal controls.

One staff device can hold the keys to the money.

The reported path runs from a single employee laptop to the systems that move funds. A small business has the same shape: the laptop that logs into online banking, the payment processor, payroll or the store admin can initiate payments. Treat those devices and accounts as payment infrastructure, not ordinary office equipment.

No leaked key does not mean no unauthorised payment.

Binance reported no evidence of a private key leak, yet funds still moved. An attacker using a legitimate session or approval workflow does not need to steal a password or key. Controls must check the transaction itself: limits, a second approver and alerts on new payees, not only login security.

Keep instantly movable balances small.

Hot wallets exist so an exchange can pay out quickly; that convenience is the exposure. The business equivalent is the account or payout balance that can leave in minutes. Hold an operating float there and keep reserves where moving them requires a slower, separately approved step.

Stopping payments is containment, and it has a cost.

Suspending withdrawals limited further loss but also stopped every customer from withdrawing. Decide in advance who may pause outgoing payments, how customers and staff are told, and what evidence allows a restart.

Recovery depended on other organisations moving fast.

Billions were frozen by stablecoin issuers and partners, not by Binance alone. For most businesses the equivalent is the bank or payment provider’s fraud team, where recall windows can be short. Keep their urgent contact routes somewhere you can reach without the compromised laptop.

Few businesses could absorb the loss themselves.

Binance said it could cover the loss from company funds. A smaller business usually cannot. Check whether insurance covers funds-transfer and social-engineering fraud, what the conditions are, and how much cash is needed to keep operating while a claim or recall is resolved.

What to do this week

• List every laptop and account that can send money, change payees or approve payouts, and name an owner for each.
• Require phishing-resistant sign-in, such as security keys or passkeys, for banking, payment, payroll and store-admin accounts.
• Turn on dual approval above a set amount and alerts for new payees, changed bank details and large or unusual payments.
• Set daily payment and payout limits that match normal trading, and keep reserves outside the accounts staff use day to day.
• Write a one-page pause-payments plan: who decides, what is paused, what customers are told and what must be verified before restarting.
• Save your bank’s and payment provider’s fraud contacts somewhere reachable from a different device.

If you hold funds on Binance

If you or your business holds funds on Binance, rely only on notices in the official app or website you already use. Do not follow links or contact details sent by message, even ones offering refunds or recovery help.

Record your balances and open orders as shown in the official account, and wait for Binance’s own instructions before acting. Binance’s statements that funds are safe and losses will be covered are company commitments; keep your own records in case you need to query a balance later.

Attribution to a state-backed group does not change what you need to do. Account security, verified communication routes and your own records matter either way.