Binance faced one of the largest security breaches in cryptocurrency history after attackers stole over $6 billion in digital assets on October 29, 2026. The FBI attributed the incident to the North Korean-linked group TraderTraitor and announced that the investigation is underway alongside the U.S. Secret Service and IRS Criminal Investigation. Following the breach, Binance reported that affected assets remained fully backed and restored withdrawals, but the hack triggered a wave of customer outflows and wider market repercussions.
Attack details and FBI attribution
Investigators said more than $6 billion in crypto assets were stolen from Binance in an attack that spanned approximately 20 minutes over 10 blockchains. Decrypt reported the total haul at around $6.4 billion, with most funds funneled into ether. The attack involved 50 pre-signed Ethereum authorizations, allowing the compromise of a Binance hot wallet, which then rapidly drained the funds. Reports referenced the possible initial breach of a DevOps engineer’s computer, though Binance later identified additional points of entry.
The FBI stated that TraderTraitor, a group associated with previous North Korean cyber operations, was behind the incident. The bureau urged crypto companies and service providers to block interactions with related wallet addresses. Circle, the issuer of USDC, reportedly froze over $1.1 billion in USDC connected to the hack, but most of the stolen funds continued to be converted into ether.
Circle reportedly froze over $1.1 billion in USDC tied to the incident, but investigators said the majority of stolen assets were still being converted to ether as law enforcement pursued avenues to recover the funds.
Binance withdrawals and platform response
Following the security breach, Binance suspended withdrawals as a precaution while conducting security checks and risk assessments. The exchange re-enabled withdrawals in phases starting November 1. Binance stated all affected balances in BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were fully backed and that the platform would reimburse the entire stolen amount.
Customer outflows accelerated after withdrawals resumed. The Block reported net withdrawals of approximately $3.64 billion in the first nine and a half hours. Reuters later cited net withdrawals totaling $4.72 billion since reopening, which Binance said represented 2.8% of its total assets.
Despite these outflows, Binance emphasized that it was able to meet all withdrawal requests. The platform’s proof-of-reserves statement allowed users to verify asset backing, though independent review of the claim remains ongoing.
The FBI said it is working with public and private partners to assess the full scope of the incident and coordinate investigative efforts in response to the breach attributed to TraderTraitor.
Market impact and security policy discussion
The hack and subsequent turmoil came alongside significant outflows from major crypto funds. Spot Bitcoin ETFs lost $643.3 million on October 30, marking the largest daily outflow of the month, while Ether ETFs recorded $1.61 billion in withdrawals over October, their worst month since inception. Reuters also reported that more than $1.3 billion in leveraged crypto positions were liquidated during the session.
Major crypto tokens tracked lower after the breach. At 17:13 UTC on November 2, Bitcoin traded at $77,284, down 0.95% over 24 hours, while Ethereum stood at $2,261.97, dipping 0.13%. The broader Crypto Fear & Greed Index remained in the ‘Fear’ zone at 37.
The incident has drawn renewed attention from regulators. CFTC Chairman Michael Selig pointed to the Binance breach as evidence supporting calls for stricter oversight of offshore crypto platforms and new options for U.S. regulatory registration, especially regarding cybersecurity controls.
Ongoing risks and investigation status
While Binance claimed full backing of affected assets, the extent to which stolen funds can be recovered remains unclear. The FBI continues its investigation, collaborating with partners to determine how the attackers gained access and to freeze additional assets where possible. Precise details on the mechanisms exploited in the hack and the collaborators involved, if any, have not yet been made public.
Market participants continue to watch for new developments on potential asset recovery and future platform safeguards. Withdrawal figures, asset prices, and ETF flows reflect both immediate market responses and longer-term concerns about exchange security.
With substantial withdrawals and volatile price action, tools that help track large transactions and coin movements have become essential for market participants. During events like the Binance hack, CryptoAppsy’s real-time charts and smart price alerts can keep users informed as outflows develop and asset values fluctuate, enabling closer tracking of potential risks and opportunities in rapidly changing conditions.
