The $6.3 billion Binance theft is the largest crypto hack on record. How exchange hacks happen, who is behind them, and what holders and businesses can check

Late on October 29, 2026, attackers drained about $6.3 billion in digital assets from Binance in a theft that took roughly 20 minutes for the bulk of the transfers, Reuters reported in a story carried by the Honolulu Star-Advertiser. On October 31 the FBI said North Korea was responsible, CBS News reported. Binance reopened withdrawals in phases on November 1 and says it will cover customer losses from its own funds; our news brief has the latest on that.

This explainer steps back from the day-to-day story. It covers how a theft of this size happens at a large, well-funded exchange, how it compares with earlier attacks, where stolen crypto goes, and why money held at an exchange is protected very differently from money in a bank. Nothing here is investment advice; it describes how the system works and points to official guidance.

How did the Binance theft happen?

Binance co-chief executive Richard Teng described a "complex attack" that involved a compromised laptop and malware designed to delete evidence, according to the Reuters report. The attackers did not need to break the cryptography that protects the blockchain. Instead they manipulated the internal system Binance uses to approve transactions, which let them move money out of a hot wallet without passing the normal approval controls. The blockchain analytics firm TRM Labs said the attackers effectively ordered Binance's wallets to empty themselves into wallets the hackers controlled, a method it compared with the 2025 Bybit theft.

That detail is the most useful lesson in the story. A hot wallet is one that is connected to the internet so it can send funds quickly. The Securities and Exchange Commission's investor bulletin on crypto custody notes that hot wallets are convenient but expose assets to cyberthreats, while cold wallets kept offline are harder to attack but can be lost, damaged or stolen. Exchanges keep part of their holdings hot so customers can withdraw on demand. Any system that can authorize transfers from those wallets, including the people and laptops that operate it, becomes the target. In both the Binance and Bybit cases, the reported weak point was the approval process around the wallets rather than the blockchain itself.

Who is behind the biggest thefts?

The FBI says the same North Korean operation, which it calls TraderTraitor, was behind both Binance and Bybit. In a public service announcement dated February 26, 2025, the bureau said North Korea was responsible for the theft of about $1.5 billion in virtual assets from Bybit on or about February 21, 2025. Three years earlier, the FBI tied the $620 million theft from the Ronin bridge used by the game Axie Infinity to the Lazarus Group and APT38, which it describes as cyber actors associated with North Korea, BleepingComputer reported in April 2022.

The amounts have grown sharply. The blockchain analysis firm Chainalysis estimated that more than $3.4 billion in crypto was stolen in 2025 and that North Korea accounted for roughly $2 billion of it, about 59%, Fortune reported. Estimates differ by firm: TRM Labs counted $2.9 billion stolen across nearly 150 attacks last year, according to Reuters, and Chainalysis put the Bybit loss at $1.4 billion rather than the FBI's $1.5 billion. Either way, a single October 2026 theft at Binance is larger than all crypto stolen in 2025 by either count. Chainalysis also found that more than two-thirds of 2025's stolen funds came from just three hacks, which means a handful of very large attacks now drive the totals.

The Binance theft by the numbers

Source: Reuters report carried by the Honolulu Star-Advertiser, October 30, 2026; Euronews, November 2, 2026.

Where does stolen crypto go?

Because blockchains are public, investigators can watch stolen funds move. The difficulty is stopping them. In the Bybit case, the FBI said TraderTraitor actors were moving quickly, converting some assets to bitcoin and other currencies and spreading them across thousands of addresses on multiple blockchains, with the expectation that the funds would eventually be turned into regular currency. For Binance, the FBI said it had watched the stolen assets being converted into ether and expected further laundering through decentralized finance platforms and instant-swap services.

The FBI's main request in both cases was the same: it asked exchanges, bridges, blockchain analytics firms and other service providers to block transactions with, or derived from, the addresses the hackers were using. The Bybit announcement listed 51 Ethereum addresses. That approach depends on cooperation from the companies that sit between crypto and the regular financial system.

Stablecoins have become a large part of that picture. Stablecoins are tokens designed to hold a steady dollar value, and their issuers can freeze tokens at specific addresses. After the Binance theft, Tether froze nearly $1.57 billion and Circle froze more than $800 million, and stablecoin issuers together froze about half of the stolen assets, according to Reuters. Assets that are not stablecoins, or that have already been swapped, are much harder to stop.

Is crypto at an exchange protected like a bank deposit?

No. The Federal Trade Commission's consumer guidance, "Crypto companies touting FDIC insurance? Not so fast", contrasts the two. A deposit at an FDIC-insured bank is protected up to $250,000 if the bank fails, but money held with a crypto company is not FDIC insured or protected if that company goes under, and the government may have no obligation to help get it back. The FTC cites Voyager Digital, which falsely implied that deposits in its app were FDIC insured; when it went bankrupt, customers were locked out and lost money.

Colorado regulators have made the same point. The state's Department of Regulatory Agencies warned in 2023 that crypto held in online wallets is not insured by the government the way bank deposits are, and that crypto payments typically cannot be reversed.

What protects an exchange's customers after a hack, then, is mostly the exchange itself: whether it has the money to make customers whole and chooses to do so. Binance said it would cover the losses and pointed to its reserves, including a $1 billion bitcoin fund meant to protect customers against security breaches, according to Reuters. That is a company commitment, not a legal guarantee of the kind that backs a bank account.

What is the difference between holding crypto yourself and at an exchange?

The SEC bulletin frames it as a trade-off. With self-custody, the owner controls the private keys and carries full responsibility; if the wallet is lost, stolen, damaged or hacked, the assets may be gone for good, and a lost private key cannot be replaced. With third-party custody, such as an exchange, a provider manages the keys, but if that custodian is hacked, shuts down or goes bankrupt, customers may lose access.

The bulletin also flags two practices that customers often do not know about. Some custodians use deposited assets for their own purposes, such as lending, which it says is sometimes called rehypothecation. Others commingle customer assets in pooled wallets rather than keeping each customer's holdings separate. Both affect what happens to customers if something goes wrong.

What should crypto holders and businesses check?

For a small business that accepts crypto payments, keeps a crypto balance, or lets a payment processor hold funds before converting them, the Binance theft is a reason to review where those assets actually sit. The SEC staff bulletin suggests asking any custodian:

1. How is it regulated, and what is its track record? Search its name with words like complaint or scam.
2. What happens if it fails, and does it insure against loss or theft?
3. Where and how are assets and keys stored, which wallet types does it use, and is storage subcontracted?
4. Does it lend out, rehypothecate or commingle customer assets, and does it need your consent to do so?
5. How does it protect personal and trading data, and does it sell that data?
6. What fees apply, including fees to transfer assets out or close the account?

The bulletin's general advice is simple: never share private keys or seed phrases, keep holdings private, watch for phishing, and use strong passwords with multi-factor authentication.

After a large hack, scams follow. Colorado's regulators warn that recovery scams are common after exchange failures, with people posing as government agencies or companies and offering to get lost money back for an upfront fee. Their guidance is that nobody legitimate will contact people with that kind of offer. Crypto fraud can be reported to the FTC at ReportFraud.ftc.gov.

What to watch next

Three things will show how this episode ends. First, whether Binance finishes replacing the last 10% of stolen assets, which it says are less liquid and will take longer to source. Second, how quickly withdrawals return for the remaining coins and networks after the first phase restored bitcoin, ether, BNB, XRP and several others. Third, how much of the stolen value investigators and stablecoin issuers can keep frozen or recover as the funds are laundered.

The broader lesson is about concentration. Exchanges hold enormous pools of assets in a small number of systems, and the largest thefts now come from compromising the people and processes that approve transfers. For individuals and businesses, the practical question is not whether a blockchain can be hacked but who holds the keys to their assets, and what happens if that party is the next target.