Security
Binance Lost $6.3 Billion. Bitcoin Was Not Hacked.
November 1, 2026
TL;DR
- On October 29, attackers took about $6.3 billion from Binance, the largest crypto theft ever.
- About $3 billion in stablecoins was frozen. The 18,270 bitcoin and most of the ether are gone.
- Working theory: North Korea's Lazarus Group, with fingerprints like the 2025 Bybit hack. Our theory: a deepfake AI job interview gave an engineer a "coding test" with malicious code. Neither is confirmed.
- Binance says it will pay from its own pocket and make every user account whole; it has already replaced about 95% of the stolen funds. Withdrawals began reopening on November 1, 2026, in phases, starting with Bitcoin.
- Bitcoin was not hacked. Exchange software was. The lesson is self custody.
| Asset | Amount taken | Status |
|---|---|---|
| Bitcoin (BTC) | 18,270 BTC, about $1.5B | Stolen, not moved yet |
| Ether (ETH) | About 167,000 ETH | Stolen, being moved |
| Tether (USDT) | $612M on Tron, more on Ethereum | Over $1.5B frozen |
| USD Coin (USDC) | Not disclosed | $823M frozen |
| XRP | About $300M | Freeze reported |
| Arbitrum tokens | About $30M | Recovered |
| SOL, OP, AVAX, POL | Not disclosed | Unclear |
| Total | About $6.3B | About $3B frozen |
What happened
Exchanges keep most coins offline and only a little in online "hot" wallets. Binance's hot wallets held at least $6.3 billion; one alone gave up about $2.5 billion in a single transaction. Hot wallets should hold pocket money, not billions, so this was likely a costly mistake.
From 4:05 PM New York time, the attacker emptied hot wallets on about 10 blockchains, each transfer looking like a normal Binance withdrawal. Stablecoin companies, working with law enforcement, then froze about $3 billion, nearly half of what was stolen.
How did they get in?
Binance blamed a hacked engineer's laptop, plus other points of breach. The working theory is North Korea's Lazarus Group: the fingerprints match its $1.5 billion Bybit hack of 2025 (Tornado Cash seed money, quiet staging, approvals fired all at once). That week Binance had blocked North Korean fake job interviews and coding tests. Our theory: a deepfake AI interview delivered a test project with malicious code to that laptop. Binance says no link has been shown.
Bitcoin was not hacked
The Bitcoin network did its job: it accepted payments signed with valid keys. The exchange software failed. Nobody can freeze bitcoin, which protects your coins only if you hold the keys.