Binance, the world's largest crypto exchange, was hacked late Thursday night. Investigators call it the biggest crypto hack in history, with about $6.3 billion in funds impacted, Yahoo Finance reported. Roughly half of those assets have been frozen.
The size of the theft is the headline. The more interesting story is what happened in the hours after it, and what it says about how crypto really works today.
What we know so far
- Withdrawals are paused. Co-CEO Yi He said they should resume by Sunday. Co-CEO Richard Teng said the exchange is rebuilding the service and "we are not switching it back until it passes rigorous testing."
- Binance says it will pay. Teng said: "We are committed to covering all hacked losses through our company funds." The exchange also keeps a Secure Asset Fund for Users for extreme cases like this.
- The cause is still unfolding. Early findings pointed to a compromised laptop. A later review found broader breaches. Teng called it "a complex attack" and said the attacker used a self-destruct mechanism that wiped its tools and traces. Binance found no evidence that wallet passwords leaked.
How the attack appears to have worked
Analysts at TRM Labs and Elliptic say the attackers seem to have compromised Binance's wallet-signing infrastructure. That is the system that approves outgoing transactions.
A simple way to picture it: every withdrawal needs an approval stamp. If attackers get hold of the stamp, they do not have to break into each vault one by one. They approve the payments themselves. That would explain how funds left across several blockchains at once.
Notice what this means. The weak point was not Bitcoin's code or any blockchain. It was the systems and people around them: laptops, servers, access rights. In my view, that is where most big crypto thefts will keep happening.
The frozen funds: good news with a catch
Binance says about $3 billion has been frozen on-chain so far, including more than $2 billion in stablecoins.
- Tether froze more than $1.567 billion of USDT, said CEO Paolo Ardoino.
- Circle froze another $800 million, in coordination with law enforcement, as the second-largest stablecoin issuer.
- World Liberty Financial froze $27 million of its USD1 stablecoin, according to CEO Zach Witkoff.
For Binance and its customers, this is the best news of the day. Elliptic estimates that about 44% of the stolen assets were frozen, almost all of them stablecoins.
Here is the catch. Elliptic also says the attackers still control more than $3 billion that token issuers cannot directly freeze. Stablecoins have a company behind them with the power to lock coins. Many other assets do not. So the freeze shows both sides of crypto: a company can undo part of a theft, and that same company has the power to lock your coins. Whether you find that comforting or uncomfortable depends on why you own crypto in the first place.
Is Binance in danger?
Sean Farrell of Fundstrat said the hack "does not currently appear to be a solvency event for Binance," which "meaningfully reduces" the risk of a withdrawal-driven spiral of forced selling.
I think that is the right question to ask. A $6.3 billion loss is huge, but an exchange that can cover it is in a very different position from one that cannot. The real test is practical: do withdrawals restart on Sunday, and do they work without problems? An exchange is a promise that your money is there when you ask for it. Watch whether that promise holds.
A pattern from North Korea
TRM Labs attributed the theft "with high confidence" to TraderTraitor, a North Korean group it says was behind the 2025 Bybit hack. Elliptic also linked the attack to North Korean hackers. The Bybit hack stole $1.5 billion and held the record until now.
Chainalysis data cited in the report says North Korean hackers stole about $2 billion in 2025, and $6.75 billion since 2016. If the attribution holds, this single hack is close to that entire total. It suggests the largest targets are being chosen carefully, and the biggest exchanges are the biggest targets.
How the market reacted
- Bitcoin fell about 5% on Friday, to below $77,000.
- Ether dropped about 4% to around $2,200.
- BNB, Binance's own token, fell more than 6%.
- Coinbase dropped 14.24% to $137.72, and Robinhood slid about 9%. Circle and Strategy also fell.
My reading: a 5% move in Bitcoin is modest by crypto standards. The sharper drop in Coinbase suggests investors are worried about trust in exchanges more than about the price of Bitcoin itself. That is a different kind of risk.
What exchange users can check now
This is not financial advice, and I am not telling you to buy or sell anything. But the hack is a good reason to review a few basics:
- How much sits on exchanges? Coins on an exchange depend on that exchange's security. Coins in your own wallet depend on yours.
- Is your login protected? Use an authenticator app or a security key, not SMS codes.
- Do you use withdrawal whitelists? Many exchanges let you limit withdrawals to approved addresses.
- Do you know the exchange's reserve and compensation policies? Read what they promise before you need it.
What to watch next
- Whether withdrawals actually resume on Sunday.
- Whether investigators trace and freeze more of the roughly $3 billion still out there.
- Whether Binance's account of "a complex attack" holds up as more details come out.
I will update this article as the story develops. What do you think: does a hack this big change how you store your crypto? Tell me in the comments.
Updated October 30, 2026. This article is for information only and is not financial advice. Figures are as reported on that date and may change. Source: Ines Ferré and David Hollerith, Yahoo Finance.