Binance's $6.36B Theft Put Company Funds on the Line

TRM Labs said attackers drained roughly $6.36 billion from crypto exchange Binance’s wallets across ten blockchains on or about October 29, 2026. Binance said its customers would bear no loss.

The FBI attributed the theft to North Korea’s TraderTraitor unit, which it had previously blamed for the approximately $1.5 billion Bybit hack in 2025. TRM Labs said most of the Binance outflow occurred within about twenty minutes.

The exchange still owed the assets after they moved

A customer who leaves assets with an exchange lets it control the wallets but expects to retrieve what the account shows. A blockchain can settle a stolen transfer while the exchange still owes those tokens to its customer.

Binance’s follow-up investigation found additional points of breach beyond a possibly compromised laptop. Securing the custody control plane could help prevent another unauthorized transfer; it could not replace tokens already removed.

Binance put its own inventory behind customer claims

Binance said it had reserved more than $6.34 billion in company funds, including $5 billion already held in impacted token assets. It initially said it had covered 90% of hack losses; the remaining portion involved less-liquid tokens. The aggregate dollar figure did not settle whether Binance had the particular assets customers would seek to withdraw.

Binance later said it had replenished approximately 95% of impacted assets and begun reopening withdrawals in phases. That is Binance’s reported progress, not an independently established final accounting of what the theft cost the company.

WazirX offered a different loss-allocation rule in 2024. After a breach of roughly $230 million, the exchange proposed spreading losses across its customers. Binance, facing a reported theft more than 25 times as large, said the company would cover theirs. Both were promises about who would carry a shortfall, though neither proposal nor pledge alone established the final cost to customers.

Withdrawals tested the promise to customers

Binance temporarily suspended deposits and withdrawals while it investigated and worked with law enforcement. The pause gave it room to verify what remained and what it could return. For customers, a displayed balance was not immediately withdrawable. Phased reopening put Binance’s replenishment claim in contact with requests for actual tokens.

Tether froze more than 1.5 billion USDT and Circle froze more than 800 million USDC after the incident. Those issuer interventions could restrict movement of the stablecoins they controlled, but a freeze could not refill every affected customer account. Binance needed its own inventory alongside the stablecoin issuers’ authority.

The ten blockchains recorded most of the outflow in about twenty minutes. Binance still had to put tokens back behind the withdrawal button.