What Happened to Binance After the 2026 Hack — and Who Did It?
Updated: November 11, 2026
Binance, the world’s largest cryptocurrency exchange, suffered a major security breach on October 29, 2026. Attackers moved approximately $6.34 billion in digital assets from Binance-controlled hot wallets, making it one of the largest financial thefts ever reported and apparently the biggest crypto theft on record. The U.S. Federal Bureau of Investigation (FBI) attributed the attack to TraderTraitor, a North Korea-linked cybercrime operation.
The most important point for Binance customers is that the company says it—not its users—will absorb the loss. Binance reported that it had replenished 98% of the affected token assets by October 31 and had set aside more than enough money to cover the remaining shortfall.
How the attack happened
The breach was not simply a stolen password or a single employee clicking one bad link. Binance’s preliminary investigation describes a multi-stage operation that began months before the final theft.
In June, an engineer downloaded a tampered installation package while trying to install a popular AI coding tool. Binance detected suspicious activity and replaced the device, but the attackers appear to have learned information about the engineer and the wallet infrastructure team.
In September, another engineer was approached through a legitimate job-search platform by people posing as recruiters. After a convincing video interview and a second interview conducted through a chat application, the engineer was told to download a programming assignment. The assignment contained malware that replaced part of a legitimate developer tool, communicated with an attacker-controlled server and concealed evidence of the compromise.
The attackers then used the compromised environment to move laterally inside Binance. Binance says they took advantage of an internal AI tool, obtained access to additional engineers’ systems and discovered credentials and permissions connected to wallet operations.
On October 29, the attackers used unauthorized access to an internal wallet-signing service. That service approved transactions outside Binance’s normal withdrawal process. Within minutes, five Binance hot wallets sent about 233.46 million XRP to an attacker-controlled address. Other transfers included approximately 970,500 SOL, 44.2 million OP and 18,270 BTC. The attack affected several blockchains and unfolded particularly quickly during a roughly 20-minute period.
A further complication involved Ethereum’s EIP-7702 authorization mechanism. The attackers used it to give a malicious smart contract partial execution rights over a Binance hot wallet. This meant that suspending ordinary withdrawals did not immediately cancel every authorization already recorded on the blockchain. Binance had to issue additional transactions to revoke those permissions.
The final unauthorized transfer, involving about 2,961.9 ETH, finalized at 23:56 UTC on October 29. Binance says no further unauthorized transfers were observed after it cleared the malicious delegation at 00:10 UTC on October 30.
What happened to Binance afterward?
Binance temporarily suspended withdrawals while it investigated and contained the incident. The company then restored withdrawals in stages after security checks and coordination with law enforcement, blockchain-monitoring firms, token issuers and other exchanges.
The company says it froze or intercepted approximately $2.85 billion in affected digital assets as of November 3. It also said that 98% of the impacted token assets had been replenished and that it was purchasing the remaining, less liquid assets. Binance has repeatedly promised to make customers whole using its corporate treasury, its emergency reserve and other company funds.
The incident still caused a major confidence shock. After withdrawals reopened, customers initially withdrew billions of dollars. Reuters reported net outflows of about $4.72 billion from Binance, although the figure represented roughly 3% of the assets held on the platform. Binance also reported about $2.7 billion in customer inflows after reopening, and said withdrawal activity was stabilizing.
Earlier reporting recorded a net outflow of about $3.64 billion on November 1 alone. That figure reflected $4.649 billion in withdrawals against $1.01 billion in deposits during the reported period.
The withdrawals did not produce a collapse like the failure of FTX in 2022. Binance remained operational, and the company said customer assets were safe and that it would cover the stolen amount. Binance.US, the separate U.S.-focused platform, said it was not affected by this incident.
The attack nevertheless damaged confidence in centralized exchanges. Crypto prices fell at first, and analysts warned that institutions may reassess the risks of leaving assets with a single exchange. The incident also raised questions about internal access controls, hot-wallet design, employee security and the use of AI tools inside sensitive financial infrastructure.
Who did it?
The strongest public attribution comes from the U.S. government. On October 31, the FBI said that North Korea was responsible for the theft and referred to the specific activity as TraderTraitor. The FBI published a list of blockchain addresses connected to the operation and asked crypto businesses, DeFi services, node operators and exchanges to block transactions involving the stolen funds.
TraderTraitor is the name used for a North Korea-linked cybercrime cluster that has also been associated with the group commonly called Lazarus Group. The group has previously been blamed for major cryptocurrency thefts, including the $1.5 billion Bybit hack in 2025. Blockchain-analysis companies said the Binance attack resembled earlier North Korea-linked operations in its planning, use of compromised employees and rapid movement of funds across multiple chains.
The attribution is therefore more specific than simply saying “North Korean hackers”: the U.S. government says the operation was carried out by the North Korean state-linked TraderTraitor activity. However, no individual hackers have been publicly identified or charged in connection with the Binance theft. Binance itself has described the evidence as part of an ongoing investigation and has not independently named particular people.
North Korea denies responsibility for cyberattacks of this kind. The country is widely accused by U.S., South Korean and international investigators of using cyber theft to generate foreign currency despite sanctions. Investigators have warned that stolen crypto can ultimately support the regime’s weapons programs, although it is not yet possible to say how much of the Binance money North Korea will successfully convert into usable funds.
What happened to the stolen money?
The money did not simply disappear. Cryptocurrency transactions are recorded on public blockchains, which allowed investigators and private tracing companies to follow the funds. Token issuers and exchanges froze a substantial portion of the assets, but the attackers continued to move the remainder through thousands of wallets and across multiple blockchains.
The FBI said TraderTraitor actors were converting stolen assets primarily into Ether and were expected to use decentralized-finance services and instant-swap platforms for further laundering. Binance and blockchain investigators have described the laundering process as automated and highly complex.
This creates a race between the attackers and the crypto industry. The longer funds remain identifiable and connected to the theft, the more likely exchanges and token issuers are to freeze them. Once the money is converted, fragmented, moved through multiple services or exchanged for fiat currency, recovery becomes more difficult.
Bottom line
Binance survived the hack operationally and says customers will not bear the financial loss. It reopened withdrawals, replenished most affected assets and froze billions of dollars in stolen tokens. But it suffered a serious reputational and security setback, and customers withdrew billions while testing whether the exchange could meet its promise.
The best-supported answer to “who did it?” is TraderTraitor, a North Korea-linked cybercrime operation that the FBI says carried out the attack. That is an attribution to an organized state-linked hacking campaign, not a public identification of specific people. The investigation and the effort to trace or freeze the remaining funds are still continuing