Statements

The company said on X that an initial investigation suggested the incident may have involved a compromised laptop, but that a subsequent investigation uncovered additional "points of breach."

It said it will cover all losses.

The cryptocurrency exchange said deposits were unaffected, while withdrawals have been suspended and are expected to resume in the next day or two.

Binance said it worked with blockchain partners to freeze roughly $3 billion in affected assets.

Phil Larratt, a senior director at the consultancy, says the thieves will now try to convert the crypto into fiat money in a process that “takes weeks and months, if not years”.

“This incident is almost certainly the single largest known theft of any kind,” says Tom Robinson, the consultancy’s chief scientist. “Before Bybit, that record was held by Saddam Hussein, who took $1bn from the central bank of Iraq in Baghdad on the eve of the 2003 Iraq war. The Binance theft is more than six times larger.”

I don't think those people have the skills needed to elevate their initial access to a full binance compromise within a few hours.

The FBI has previously attributed the Bybit and DMM Bitcoin thefts to TraderTraitor.

The long preparation, the apparent targeting of staff and the use of Binance's own systems to sign transactions resemble earlier TraderTraitor thefts, including Bybit.

Elliptic has identified common service usage between those laundering the Binance funds and those behind three earlier thefts attributed to TraderTraitor, from BigONE, WOO X and AFX.

On October 29, 2026, $6.43 billion in cryptoassets were stolen from Binance, the world's largest cryptoasset exchange, according to Elliptic's analysis.

Elliptic's total excludes a further $169 million that left Binance after withdrawals were suspended.

The two sets of funds have now been combined in several wallets, and the amount has grown overnight. The link was first reported by ZachXBT.

Over the course of a few hours, the attacker drained Binance hot wallets across 11 blockchains.

Teng added that the attack "was not carried out by one person"

This closely resembles the Bybit theft, in which North Korean hackers compromised a developer's machine at the wallet provider Safe{Wallet} and manipulated the transaction that Bybit's signers approved.

Very few actors could coordinate an attack across 11 blockchains in around three hours.

The pattern of transactions suggests that much of the laundering was carried out by software rather than by hand.

Whether the automation involves AI agents, rather than conventional scripts, cannot be determined from the on-chain data.

At current prices, the attacker now controls around $3.25 billion of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32 billion), 18,327 BTC ($1.42 billion) and 233 million XRP.

The 18,270 BTC has been split through a short peel chain into 19 addresses, most holding 1,000 BTC each. None of it has yet been sent to a service.

On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap. On Ethereum, 48 million RLUSD was sold before Ripple froze the remainder, and around 150 other tokens were dumped for ETH on decentralized exchanges.

A second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH, before Aave froze the affected markets. The loan is still open and close to the point of liquidation.

On Ethereum, 434 million USDT was swapped for 160,451 ETH through Uniswap, 1inch and market makers' request-for-quote systems. The swaps implied a loss of 12% to 26% against the market price, suggesting the attacker was prioritizing speed over value.

Before the freezes landed, the attacker converted around $786 million of stablecoins into ETH and TRX.