Attackers drained about $6.3bn from Binance's hot wallets on the evening of 29 October 2026, the largest crypto theft on record. Binance paused withdrawals, says users will not bear the loss, and blockchain analytics firms tie the attack to North Korea's TraderTraitor group.
For a bank or neobank that offers crypto, the Binance hack is a lesson about keys. Binance says no private key leaked. The attackers did not need one: on TRM's reading, they made Binance's own signing system approve their withdrawals. Whoever can make your signing system sign controls your clients' assets, wherever those assets sit.
All figures below are as of 30 October 2026, around 12:00 UTC. They change through the day, and we mark where sources disagree.
Key moments
In short
- About $6.3bn left Binance hot wallets on ten blockchains, starting around 20:05 UTC on 29 October. Roughly $2.7bn to $3bn has been frozen, mostly USDT by Tether and USDC by Circle.
- Binance points to a compromised engineer's laptop and later found more breach points. It reports no private key leak; TRM's analysis points to its signing system being made to sign.
- The main drained wallet was listed in Binance's proof of reserves as backing customer balances. A reserve report shows balances, not who can move them.
- Banks should know who holds the keys, who approves a transfer and who can freeze it. Exchanges belong in execution, not in long-term custody of client assets.
What happened in the Binance hack of October 2026?#
Attackers emptied Binance hot wallets on ten blockchains in about 20 minutes on 29 October 2026, taking roughly $6.3bn. A hot wallet is a wallet kept online so an exchange can process withdrawals quickly.
Estimates of the loss differ slightly because prices moved during the theft. Binance puts the "estimated impact" at $6.3bn. TRM Labs counts about $6.36bn at the time the funds were taken (published 30 October, 02:10 UTC). Chainalysis says about $6.4bn (30 October), and Elliptic $6.43bn (update of 30 October, 08:00 UTC).
The largest single slice was on Ethereum: about $3.79bn, including 200,630 ETH, 1.875bn USDT and 823m USDC, according to TRM. Another 18,270 BTC, worth about $1.47bn, left on Bitcoin.
For scale, the previous record was the Bybit theft of February 2025. The FBI put it at "approximately $1.5 billion" and also attributed it to TraderTraitor. Elliptic calls the Binance theft more than four times larger. Before the hack, Binance held about $144bn in assets, according to DefiLlama data cited by CoinDesk on 29 October.
Binance hack timeline in UTC: the first 16 hours#
The theft took minutes; the response is still running. Binance has not published the exact time it paused withdrawals, so that line below is marked "night of 29 to 30 Oct".
| Time (UTC) | Event | Source |
|---|---|---|
| 29 Oct, about 20:05 | First outflows, on the XRP Ledger | TRM Labs |
| 29 Oct, 20:20 | 18,270 BTC leave; the Ethereum hot wallet is taken over; most funds gone within about 20 minutes | TRM Labs |
| 29 Oct, about 20:24 | Ethereum balance swept, 3 min 24 s after takeover; 167,464 ETH leave the hot wallet labelled Binance 14 | TRM Labs, CoinDesk |
| 29 Oct, 21:01 | Tether freezes 971.1m USDT in the main receiving wallet | TRM Labs |
| 29 Oct, 21:04 | Circle freezes 823m USDC | TRM Labs |
| Night of 29 to 30 Oct | Binance suspends deposits and withdrawals; names a compromised engineer's laptop as a possible entry point | Binance, via CoinDesk |
| 29 Oct, 23:35 | Binance confirms $2.54bn frozen | TRM Labs |
| 30 Oct, 00:08 | Arbitrum Security Council freezes 8,426 ETH and 74.6m ARB | TRM Labs |
| 30 Oct, 02:10 | TRM attributes the attack to TraderTraitor "with high confidence" | TRM Labs |
| 30 Oct, about 04:30 | Chainalysis names TraderTraitor | Chainalysis |
| 30 Oct, 08:00 | Elliptic: $6.43bn stolen, $2.84bn (44%) frozen | Elliptic |
| 30 Oct, morning | Binance reports more breach points; deposits normal; withdrawals expected back in 45 to 48 hours | Binance, via Reuters and OkayNews |
How much was stolen, and how much is frozen?#
About $6.3bn was stolen and roughly $2.7bn to $3bn of it is frozen. Binance says about $3bn, Chainalysis about $2.8bn, TRM about $2.7bn, and Elliptic $2.84bn, which it puts at 44% of the total.
Most of the frozen money is stablecoins, because their issuers can block tokens at a given address:
- Tether froze 971.1m USDT at 21:01 UTC, according to TRM; Tether CEO Paolo Ardoino later said "more than 1.567 billion USDT", as quoted by CoinDesk on 30 October. TRM's running total was about 1.77bn USDT as of 00:30 UTC.
- Circle froze about 823m USDC at 21:04 UTC. Circle can freeze only USDC, its own token. One early report said Circle froze "Tether"; that is wrong.
- Ripple, World Liberty Financial and the Arbitrum Security Council froze smaller amounts in RLUSD, USD1, ETH and ARB.
Bitcoin cannot be frozen by any issuer. Elliptic says the 18,270 BTC were split across 19 addresses, most holding 1,000 BTC, and had not reached any exchange or service, according to Elliptic's 08:00 UTC update. TRM estimates (as of 00:30 UTC on 30 October) that the attacker still controls about $2.4bn that no issuer can freeze; Elliptic's 08:00 UTC update counts about $3.33bn in assets no issuer can freeze.
Who is behind the Binance hack?#
Three analytics firms point to North Korea; no government has confirmed it. TRM Labs names TraderTraitor, which it calls "North Korea's premier hacking unit", and adds: "We make this judgment with high confidence." Chainalysis reached the same view after seeing Binance funds mixed in real time with funds from an earlier exploit it attributes to North Korea.
Elliptic also attributes the theft to North Korea, but notes: "No government or law enforcement agency has confirmed attribution." Binance co-CEO Richard Teng told Reuters: "Our investigation has not attributed responsibility to any individual."
How did the attackers get into Binance's hot wallets?#
Binance's first statement named a laptop. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in a statement, as quoted by CoinDesk. It added: "We have found no evidence of any wallet private key leak."
On 30 October Binance said its "subsequent investigation has uncovered additional points of breach" and that the incident "stems from multiple factors". It has not said what those points are, and it has not published a root cause.
TRM's on-chain analysis fits that picture. The most likely explanation, in TRM's view, is that the attacker got Binance's hot wallet signing system to sign transactions on all ten chains. On Ethereum the attacker used a recent account feature (EIP-7702) to hand control of the hot wallet to its own contract; the whole balance left 3 minutes 24 seconds later. TRM also found preparation from 28 October, including test runs on two wallets.
For a risk team, the lesson is narrow. By Binance's account the keys did not leak, and the wallets were still emptied, because the service allowed to request a signature was taken over.
Why didn't proof of reserves protect Binance customers?#
Proof of reserves shows what an exchange holds on a given day; it says nothing about who can move it. Binance's 1 October report listed the Binance 14 hot wallet as backing customer balances, according to CoinDesk. At that snapshot it held about 89,475 ETH and 1.26bn USDT across 37 assets.
CoinDesk estimates that the theft took Binance's ETH backing from exactly 100% to "near 94%", about 6% short, until Binance tops it up. Binance says it will publish an updated proof of reserves once remediation is complete; the next regular snapshot is due on 1 November.
So the report was accurate, and it still did not protect anyone. It confirmed the coins were there, but it could not show how many people or systems could send them elsewhere, or how fast. For a bank, a reserve attestation from a counterparty is a balance check, not a control. The questions that matter in crypto custody are about signing: how many approvals, from whom, with what limits.
Are Binance withdrawals suspended, and is Binance safe?#
Yes, Binance withdrawals are suspended as of 30 October. Binance says deposits work normally and withdrawals should resume within about 45 to 48 hours, after it rebuilds its withdrawal service and related addresses.
Binance says it will cover all losses. "Users will not bear the financial impact of this incident. Binance will cover all losses," a spokesperson told Fox Business. Binance says the money will come from SAFU, its emergency fund, and company funds; co-CEO Yi He said it would cover "all hacking losses". CoinDesk reported on 30 October that SAFU holds about $1bn in bitcoin, far less than the loss.
Prices fell within hours. Bitcoin fell below $77,000 and traded at $76,664 at 02:00 UTC on 30 October, down 4.5% over 24 hours, according to The Block. Leveraged positions worth $1.55bn were force-closed in the 24 hours to that time, per CoinGlass data cited by The Block. CoinDesk, citing people familiar with the matter, reports that institutional investors are pulling assets from centralised exchanges in general, not only from Binance.
Whether Binance is "safe" now depends on what you need from it. Its promise to repay is credible only if its company funds and the frozen money cover the gap.
Three causes behind the hack that matter to a bank#
Three design choices made the loss possible, and a bank can check each of them in its own setup.
Large balances in hot wallets. Binance kept billions in online wallets that processed withdrawals; Binance 14 alone held about 89,475 ETH and 1.26bn USDT on 1 October. Hot wallets are necessary for speed, but every coin in them is reachable by whoever controls the signing path.
One compromised machine reached the withdrawal path. On Binance's own account, a single engineer's laptop led to a service that could submit withdrawals. If one person's device can start a chain that ends in a signed transfer, the approval design is too thin.
The exchange as a single point of failure. Everyone who keeps assets on the exchange, or routes payments through it, stops when it stops. Traders, merchants and any bank built on top all wait for the same withdrawal button to come back.
How banks and neobanks hold client crypto: three cases#
Crypto custody for neobanks and banks today follows three broad models. None of them is linked to the Binance incident; we use them to show where the risk sits.
Revolut: three wallet types, published in its policy#
Revolut Digital Assets Europe (RDAEL) publishes its client asset safeguarding policy. It names three places where client crypto can sit:
- Self custody wallets on Fireblocks, a Multi Party Computation (MPC) wallet "where RDAEL holds the majority of the components of the private keys". MPC splits one key into shares held by different parties, so no single share can sign. Revolut uses this mainly for transfers between exchanges and cold storage.
- Hot wallets at third-party exchanges, where RDAEL "does not own the private keys". These are used to execute clients' buy and sell orders.
- Cold wallets at a third-party custodian, offline. "The majority of client crypto assets are kept on cold wallets."
The policy's version history shows the direction. Version 3.0, dated August 2025, brought in bilateral agreements with exchanges "and the increased control over Fireblocks". Changes to its Fireblocks signing policy need sign-off from RDAEL's CEO and at least two approvals.
The policy also states that "Revolut does not segregate clients' crypto-assets": they sit in omnibus wallets at partner exchanges or at Fireblocks, while cold storage is kept separate from other entities. Exchanges handle execution, most assets sit in cold storage, and Revolut has taken more control over its Fireblocks setup.
A bank whose crypto acceptance runs on an exchange payment product#
Picture a bank whose merchants accept crypto through an exchange's payment product, such as Binance Pay, with funds held in the exchange's wallets. This setup is quick to launch. The exchange holds the keys, runs the wallets and settles the payments.
On 29 October that bank would have had nothing to decide. Withdrawals stopped at the exchange, so the bank could not move merchant funds, and its merchants could not be paid out until the exchange reopened. The bank's own systems were fine; its payment channel was not. A dependency on one exchange is a concentration risk that sits outside the bank's risk register.
A bank under MiCA Article 60 with its own custody#
In the EU, a credit institution can offer crypto custody without a separate CASP licence. Under MiCA Article 60, it must notify its home regulator "at least 40 working days before providing those services for the first time". We cover the full route in crypto custody for banks under MiCA.
The obligations follow the bank. Article 75 requires a custody policy that minimises the risk of loss from "fraud, cyber threats or negligence", legal and operational segregation of client assets from the bank's own, and liability for losses attributable to the bank, capped at the market value of the lost asset at the time of loss. A bank that runs custody in its own perimeter keeps control of signing and freezing, and carries the full duty if it fails.
Self-custody vs exchange custody: who can stop your funds?#
The model you choose decides who holds the keys, who can stop a withdrawal and who answers to your clients after a hack.
| Model | Who holds the keys | Who can stop withdrawals | If that party is hacked | Verdict for client assets |
|---|---|---|---|---|
| Exchange account (hot wallet) | The exchange | The exchange | You wait for the exchange to pause, rebuild and repay | No |
| Third-party custodian (cold) | The custodian | The custodian, under contract | Assets mostly offline; you rely on its controls and its insolvency rules | Depends |
| MPC provider, bank holds majority of shares | Split; the bank holds the majority | The bank, through its own approval rules | Attacker needs the bank's shares and approvals | Works |
| Bank's own perimeter (own servers and key storage) | The bank | The bank | The bank's own controls decide; no third party can pause you | Works |
The table compares control, not quality. A good third-party custodian can be safer than a weak in-house setup. What changes is who you depend on when something breaks.
What is self-custody, in plain terms?#
Self-custody means you hold the keys that move the assets, so no one else can move them or block you. For a person, that is a hardware wallet. For a bank, it means keys generated and stored in its own hardware or held as a majority of MPC shares, with signing rules the bank sets and audits.
Exchange custody is the opposite: you hold a claim on the exchange, and the exchange holds the keys. On a bad day that claim is worth whatever the exchange can repay, whenever it reopens. Our guide to digital asset custody explains the main custody arrangements in more detail.
What self-custody must include to stop a Binance-style attack
- Binance held the keys to its own hot wallets. The attackers did not need to steal them: they got the signing system to approve their withdrawals. Holding keys is half of the defence; the other half is what must agree before anything is signed.
- A signing policy that runs apart from everyday systems: limits per transfer and per day, allow-listed destination addresses, and a second approver on a separate device for large amounts. One compromised laptop should not be enough.
- A small hot wallet and most assets in cold storage, so a single breached service cannot reach the bulk of client funds.
- Self-custody moves the duty to the bank: under MiCA Article 75 the bank is liable for losses attributable to it, and it needs people, key ceremonies, monitoring and audits.
- Execution still needs liquidity. Most banks will keep a balance at exchanges or brokers, sized to the orders they fill.
What should a bank check this week?#
Start with exposure, then signing, then contracts. A short list for the head of digital assets and the risk team:
- List every exchange, broker and payment product that holds client or bank crypto, with balances as of today.
- Check whether any of them depends on Binance for liquidity or settlement, even indirectly.
- Move balances above what you need for a day of execution to cold storage or to keys you control.
- Map the signing path: which systems can request a signature, and can one compromised laptop or account reach it?
- Require at least two independent approvals and daily limits for every withdrawal from a hot wallet.
- Read your custody contracts for pause rights, loss coverage, insolvency treatment and notice periods.
- Test the stablecoin freeze route: who calls Tether or Circle, and how fast, if your addresses are drained.
Keep keys and logs inside your perimeter#
If you want to offer crypto without handing your keys to an exchange, ItisPay installs inside the bank's own perimeter. Data, keys and logs do not leave it, and the bank receives the source code and the data schema. A separate policy layer holds limits, roles, second approval and allow-listed beneficiaries, so no transfer is signed outside the bank's own rules. Banks that would rather not run custody themselves can keep client assets with our EU-licensed CASP + Payment Institution partner, with ItisPay as the software layer on top.
This article is for informational purposes only and does not constitute legal or regulatory advice.
