A carefully planned cyberattack, a compromised employee laptop and a hijacked transaction-signing system reportedly enabled hackers to drain approximately $6.36 billion from Binance wallets across 10 blockchains. The bulk of the theft took place in just 20 minutes, investigators say preparations had begun at least 36 hours earlier.
In what is being described as the largest cryptocurrency theft in history, hackers stole around $6.36 billion worth of digital assets from Binance, the world’s largest cryptocurrency exchange, on October 29, 2026. The attack targeted wallets used by the exchange to process transactions and involved the unauthorised movement of cryptocurrencies across multiple blockchain networks.
Binance has said that customer losses will be covered through its reserves and company resources, the attack has drawn attention to vulnerabilities in the systems exchanges use to authorise and process transactions.
Investigators have also pointed towards possible links with North Korean cybercriminal groups, although the identity of the attackers has not been officially established.
According to blockchain intelligence firm TRM Labs, most of the money was transferred within approximately 20 minutes, beginning shortly after 8 pm UTC on Thursday. The incident has raised serious questions about the security of cryptocurrency exchanges, particularly their internal systems for authorising withdrawals and transferring customer assets.
Binance Crypto Heist: How The Attack Unfolded
At least 36 hours before the theft, on October 28, the attacker’s operational wallet received three small withdrawals from Tornado Cash, a cryptocurrency mixing service used to obscure the origin of funds. This helped prepare the infrastructure for the operation.
Next days, the attacker deployed the first version of the code and tested it on two wallets.
According to TRM Labs, the same code used during the rehearsal was installed on a Binance hot wallet. The attack began with five Binance wallets on the XRP Ledger transferring 233.46 million XRP, worth approximately $296 million.
A Binance Bitcoin hot wallet transferred 18,270 BTC, worth approximately $1.47 billion, to an attacker-controlled address. The stolen Bitcoin was immediately split into smaller batches of approximately 1,000 BTC and 100 BTC. A Binance hot wallet on the Tron network transferred approximately 612.7 million USDT and 46.4 million TRX, worth around $628 million combined, to the attackers.
A hot wallet is connected to the internet and is used to process deposits and withdrawals. It allows exchanges to facilitate transactions without having to move assets from offline storage every time a customer requests a withdrawal.
How much cryptocurrency was stolen
According to TRM Labs, the hackers moved approximately $6.36 billion worth of cryptocurrency across 10 blockchain networks.
Blockchain
Approximate value stolen
Ethereum
$3.79 billion
Bitcoin
$1.47 billion
Tron
$628 million
XRP Ledger
$296 million
Solana
$96 million
Arbitrum, Optimism and Base
$39 million
Avalanche
$28 million
Polygon
$10 million
Total
$6.36 billion
After receiving 18,270 BTC, the attackers divided the cryptocurrency into smaller batches. This technique, known as a peel chain, involves moving portions of funds through successive wallets to make the transaction trail more complicated.
