GeopoliticsMarket noteFriday 30 October 2026, 09:22
The Binance hack took about $6.3bn, most of it in 20 minutes: four times the Bybit theft. About $2.7bn is frozen; Binance says it will cover every loss.
The Binance hack is the largest theft in the history of crypto. On the evening of 29 October 2026, an attacker drained wallets of Binance, the world’s biggest crypto exchange, on ten blockchains, most of it in about 20 minutes from 20:05 UTC. Binance puts the loss at about $6.3bn, its update of 30 October says, and it says it will cover all of it from its own funds.
The blockchain analysts at TRM Labs count $6.36bn, about four times the $1.5bn taken from the exchange Bybit in February 2025, the record until now. They blame North Korea, with what they call high confidence, TRM’s report says. The attribution is TRM’s own; Binance has not named the attacker.
The theft began on the XRP Ledger, where five Binance wallets sent 233.46 million XRP to one address between 20:05 and 20:09 UTC, TRM says. Wallets on Solana, Bitcoin, Tron and Ethereum followed within minutes. On Ethereum, the attacker used a feature added in 2025 that lets a wallet hand control to a piece of code: with pre-signed permissions, it turned one of Binance’s best-known hot wallets, the internet-connected wallets that pay out customer withdrawals, into a sweeper it controlled. That wallet kept sweeping new deposits until almost midnight.
Binance’s own account is short. Its first findings point to a compromised laptop of a DevOps engineer, which let the attacker reach a service and submit withdrawals the exchange had not authorised. It has found no sign that a wallet’s private key leaked, and it will publish a technical post-mortem. TRM, for its part, says wallets on ten chains with different signing systems all produced valid signatures within about half an hour, which points to Binance’s signing system as a whole.
Binance suspended deposits and withdrawals while it checks its systems. It says user funds are safe, and that it will pay for the losses from SAFU, its emergency fund for users, and from company money. It will publish new proof of its reserves once the work is done.
Most of the money was on Ethereum, in ether and in dollar stablecoins, TRM’s count shows.
The Bitcoin part alone was 18,270 BTC, about $1.47bn, sent from a single hot wallet at 20:20 UTC and split at once into round pieces of 1,000 and 100 BTC to make it harder to follow.
Stablecoins can be frozen by the companies that issue them, and they were. About $2.7bn was frozen on-chain by 00:30 UTC on 30 October, TRM counts:
Binance puts the frozen total at about $3bn. The attacker raced the freezes. It sold about 325m USDT to market makers for about 122,300 ether at a discount of more than 10%, and borrowed ether against stablecoins on the lending service Aave. It still holds more than 420,000 ether and the 18,270 bitcoin, about $2.4bn that no issuer can freeze.
TRM names TraderTraitor, the North Korean hacking unit that the FBI held responsible for the Bybit theft. It points to the same habits: small withdrawals from Tornado Cash, a service that hides where crypto comes from, to fund the operation; preparation that began at least 36 hours earlier, with rehearsals on test wallets; and signatures gathered in advance, then used in one burst.
The next stage, TRM expects, is laundering through cross-chain bridges, swap services and over-the-counter brokers. That puts the burden on the firms that handle the money. Regulated firms that miss suspect payments pay for it, as we reported this month on Bank of America’s fine and American Express’s. TRM asks exchanges and trading firms to screen deposits against the attacker’s addresses.
The sell-off was broad but not a crash. At 09:17 UTC on 30 October, bitcoin was at $77,766, down 3.0% in 24 hours, ether at $2,222.68, down 4.2%, and BNB, Binance’s own token, at $703.66, down 6.4%, CoinGecko’s prices show. The value of all crypto fell from $2.70tn to $2.63tn between its daily readings of 29 and 30 October.
This is analysis and opinion, not investment advice.
ContactWrite to the Notebook
Spotted an error, or a source this piece should cite? Want your own research linked or featured? Tell us. We read every message.
Our research · 52 min read
The lek has not bought so many euros since at least 1995, when Eurostat's records begin. In September 2026 a euro cost 91.85 lek on average, the lowest monthly figure in those records. In 2019 it cost 123.01. Put the other way round, the lek now buys 33.9% more euros than it did in 2019, and 37.7% more dollars.
Continue reading the story