The morning after the largest crypto theft on record brought three answers and many open questions. On Friday, October 30, 2026, Binance said the attack likely began on a work laptop; blockchain analytics firm TRM Labs said the thief was almost certainly North Korea’s TraderTraitor unit; and Binance promised that its SAFU fund and company money would make users whole.
Meanwhile the market did what it does after a shock — it liquidated. About $1.5 billion of leveraged positions were wiped out in 24 hours.
Key facts
- Binance said its preliminary investigation points to “a compromised laptop belonging to a DevOps engineer”, through which the attacker reached a service container and submitted unauthorised withdrawals.
- Binance says it found no sign that its wallets’ private keys were taken.
- TRM Labs attributes the October 29 attack with high confidence to TraderTraitor, North Korea’s specialist hacking unit, and counts about $6.36 billion across ten blockchains.
- Co-CEO Yi He said Binance will cover all losses through the SAFU fund and company funds; no size or timetable was given.
- Binance puts verified frozen funds at $2.54 billion, more than $2.37 billion of it from Tether and Circle.
- About $1.5 billion in liquidations hit the market over 24 hours, per CoinGlass data reported by CoinCentral; Bitcoin traded near $77,563 on October 30.
How did hackers get into Binance?
Binance’s preliminary finding is that the attack started on a DevOps engineer’s compromised laptop. From there, the attacker reached a service container and submitted unauthorised withdrawals. Binance says it has found no evidence that the private keys of its wallets were stolen — the attacker made Binance’s own systems sign the transactions.
Binance announced the estimate of about $6.3 billion in a statement on X. That matches TRM’s reading: on Ethereum, a hot wallet was turned into a sweeper via EIP-7702; on nine other chains, ordinary signed transfers left Binance wallets — which TRM reads as compromised signing infrastructure, not a single leaked key.
The vault wasn’t cracked. Someone was handed the pen that signs the cheques.
Who is behind the Binance hack?
TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean state-backed hacking unit that the FBI also blamed for the February 2025 Bybit theft. Chainalysis CEO Jonathan Levin also named TraderTraitor as the likely perpetrator. Binance itself has not endorsed the attribution or named anyone.
According to TRM, the attack shares hallmarks with Bybit and the April 2026 KelpDAO hack: small Tornado Cash withdrawals to fund an operator wallet, staging well before the theft, and pre-signed actions executed in one burst. Laundering so far relies on large swaps through market makers and lending protocols rather than bridges. TRM expects the next stage to involve cross-chain bridges, swap services and OTC brokers.
Will Binance reimburse users after the hack?
Binance says it will cover all losses using the Secure Asset Fund for Users (SAFU) and company funds. SAFU was set up in 2018 and was used in 2019 to cover about 7,000 BTC stolen from Binance. Binance has not said how large SAFU is today or when reimbursement will be complete.
Withdrawals are being restarted coin by coin. As of October 30, Bitcoin and Ethereum withdrawals were being processed while Solana and XRP remained paused, with no date for full reopening. Binance said it expected to resume withdrawals within 48 hours.
Market fallout
On October 30, CoinGecko showed Bitcoin at $77,563 (−3.2% in 24 hours), Ether at $2,225.86 (−4.0%), BNB at $702.35 (−6.3%), Solana at $96.73 and XRP at $1.25. Liquidations of about $1.5 billion in 24 hours fell mostly on longs, according to CoinCentral. Paused deposits also meant some traders couldn’t add margin to positions in affected coins. This is not financial advice.
What this means for swap users
In the days after a hack this size, every compliance team tightens up. The FBI and analytics firms share attacker addresses, and swap providers, bridges and exchanges screen deposits against them. That’s good for recovery — and it means legitimate users may see more checks than usual. Use clean funds, keep transaction records, and expect that some routes may be slower.
If your funds are stuck on a paused exchange, there’s nothing to do but wait for it to reopen. Once they are out, consider holding them in a wallet you control and using a non-custodial service like SwapZilla when you need to convert. The how it works page explains the flow, and our AML policy explains why some swaps are reviewed.
Final thoughts
One compromised laptop, one signing system, ten chains, $6.3 billion. Binance can pay for it; most companies couldn’t. The attack is a reminder that exchange security is only as strong as the most exposed device with access to the signing path — and that users never get to audit that.