Roughly $6.36 billion was drained from Binance hot wallets in about 20 minutes, with North Korea's TraderTraitor linked to the attack
Crypto has seen big hacks before. This one has blockchain analytics firm TRM Labs reaching for a broader comparison.
On October 29, 2026, approximately $6.36 billion in digital assets was drained from Binance’s hot wallets. TRM Labs’ Ari Redbord says this is no longer a crypto-sized story at all.
“This isn’t the largest hack in crypto history, it’s the largest bank robbery in human history.”
Twenty minutes, ten chains, billions gone
The speed is the first detail that stands out. Assets left Binance’s hot wallets within roughly 20 minutes, beginning at approximately 4:05 p.m. ET.
For context, hot wallets are the internet-connected wallets an exchange uses to process everyday withdrawals.
The drain spanned at least 10 blockchains. Estimates of the total loss sit in a range of $6.3–6.4 billion, with the approximately $6.36 billion figure landing in the middle.
The theft is roughly double the size of any previously recorded theft in crypto.
The usual suspects, with a rehearsal
The attack has been linked with high confidence to TraderTraitor, a North Korean state-sponsored hacking group.
This was not an improvised smash-and-grab. Preparation, including rehearsals, was observed at least 36 hours before the theft took place.
Cumulative North Korean crypto thefts are estimated at approximately $7.4 billion through late October 2026. The Binance theft is now the main driver of 2026’s overall hack losses, with prior annual records significantly surpassed.
The partial save
A calculated $2.4–2.8 billion of the stolen funds has been frozen by Tether, Circle, Ripple, and others.
Freezing is possible because some token issuers control the contracts behind their assets. When stolen stablecoins are flagged, an issuer can lock them in place, rendering them unusable for the thief.
The freeze highlights a tension crypto has never fully resolved. The industry prizes censorship resistance, yet the fastest response to a state-backed heist came from centralized issuers with an off switch.
What this means for exchanges and users
The multi-chain nature of the attack makes tracing harder. With assets scattered across at least 10 blockchains, investigators are following many trails at once rather than one.
Redbord’s comparison is deliberately provocative, but it is hard to argue with on the numbers. When a single theft roughly doubles the previous record and accounts for most of a year’s losses, calling it a crypto hack starts to undersell it.
