Binance Hack: How $6.36 Billion (₹60,384 Crore) Was Taken, What Has Been Frozen, and Whether Users Get Their Money Back

Between 1:35 am and about 1:55 am India time on 30 October 2026, wallets belonging to Binance, the world's largest crypto exchange, sent almost everything they held to one attacker. Wallets on eight blockchains emptied within minutes of each other, and two more followed before dawn. TRM Labs, a firm that traces blockchain payments, counts $6.36 billion taken, or about ₹60,384 crore; Binance's own estimate is about $6.3 billion. No crypto theft has been larger. The previous record, North Korea's $1.5 billion raid on Bybit in February 2025, was a quarter of this. Below is how it was done, where the money is now, what Binance has promised its users, and what an Indian holder should do this week.

Written on 30 October 2026, while the story is still moving. Amounts are from TRM Labs' trace of on-chain data up to 6:00 am India time (00:30 UTC) on 30 October and from Binance's own notice of 30 October. Dollar figures are converted at FBIL's reference rate of ₹94.9432 a dollar, its latest openly published rate (23 October 2026); crypto prices and the rupee both move, so the rupee figures are a guide. Times are India time, with UTC in brackets where it helps. The figures will change as more is frozen or recovered.

What was taken, chain by chain

The money left from Binance's hot wallets. An exchange keeps most of its customers' crypto in offline "cold" storage and a working float online, in hot wallets, so that withdrawals can be paid out in minutes. It was this working float, spread over ten blockchains, that the attacker emptied. TRM values each transfer at the price of the coin at the moment it left:

At prices a few hours later the same coins were worth about $6.23 billion (₹59,150 crore), because the theft itself pushed the market down. Binance's notice gives the total impact as "around $6.3B" and warns that the number may still change.

How the hack was done, step by step

Binance has not yet published its technical report. What follows combines the two accounts available on 30 October: Binance's own explanation and TRM's reading of the transactions, which anyone can inspect on the public blockchains. Where they differ, both are given.

1. Preparation began a day and a half earlier

On the morning of 28 October (UTC), a fresh "operator" wallet received three small amounts from Tornado Cash, a service that hides where crypto came from. That gave the attacker money for transaction fees with no trail back. Early on 29 October the operator put a small piece of attack code on a blockchain and tried it on two wallets of its own. Later the same day it ran a full rehearsal on a third wallet and pulled the test money back. About four hours after the rehearsal, the same code appeared on a Binance hot wallet.

2. The way in: an engineer's laptop

Binance's first explanation, in its notice of 30 October, is that a laptop belonging to one of its DevOps engineers (the staff who run its servers and deployment systems) was compromised. From that laptop the attacker reached a "service container", one of the small packaged programs that make up Binance's back-end, and used it to submit withdrawal transactions that Binance had not authorised. Binance said it had found no sign that the private keys of its wallets had leaked. Later the same day it said further investigation had uncovered "additional points of breach" and called it a complex attack (as reported by AFP).

Binance has not said how the laptop was compromised. The pattern is a familiar one, though. In 2022 the US cybersecurity agency CISA, with the FBI and the US Treasury, described a North Korean campaign it called TraderTraitor: messages to staff at crypto companies, often system administrators and DevOps engineers, that pose as recruiters offering well-paid jobs and persuade the target to install a booby-trapped crypto application. Whether that is what happened here is not known.

3. Twenty minutes on ten blockchains

Once the attacker could get transactions signed, it moved fast. In India time:

• 1:35 to 1:39 am (20:05–20:09 UTC): five Binance wallets on the XRP Ledger sent 233.46 million XRP to one attacker address, each left with only the minimum balance a wallet must keep.
• Just after 1:40 am: Binance wallets on Solana and Optimism were drained.
• 1:50 am (20:20 UTC): a Binance bitcoin hot wallet sent 18,270 bitcoin to the attacker, who began splitting it into round lots of 1,000 and 100 in the same block. This is a peel chain, a way of breaking a big sum into many smaller trails.
• Within two minutes: a Binance wallet on Tron sent 612.7 million USDT and 46.4 million TRX.
• About 1:53 am: the largest single transfer. Binance's best-known Ethereum hot wallet sent its whole balance, 167,464 ether and 63 tokens including 1.615 billion USDT, to the attacker.

The Ethereum wallet kept being emptied as fresh money arrived in it: TRM counts further sweeps at 2:11, 2:29, 2:34, 3:14, 4:09 and 5:26 am. A second wave, around 4:35 am, reached Binance wallets on Avalanche and Polygon.

4. The trick on Ethereum: fifty instructions signed in advance

The Ethereum theft used a feature called EIP-7702, added to Ethereum in its May 2025 upgrade. It lets an ordinary wallet hand control of its behaviour to a piece of code, simply by signing a permission. Once that permission is in place, anything sent to the wallet runs the code, until the wallet signs a new permission.

The attacker's code was a "sweeper" that obeys only the attacker. The difficulty was timing. Every wallet keeps a running count of the transactions it has sent, and a permission of this kind works only at one exact count. A busy exchange wallet's count moves forward every few seconds as withdrawals go out. So the attacker came with fifty permissions, all signed by the Binance wallet in advance, one for each of the next fifty counts, and submitted them together at 1:50 am. One of the fifty matched. Three minutes and 24 seconds later the operator told the wallet, now running the sweeper, to send everything it held to the attacker.

The same wallet also controlled a separate Binance smart account, which is how the attacker reached the 823 million USDC that Circle later froze.

5. Why the tracers point to Binance's signing system

At first the Ethereum transactions looked as if the attacker had tricked someone into signing those fifty permissions. That explanation does not cover the other chains. On the XRP Ledger, Bitcoin, Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon there was no delegation at all; Binance's wallets simply sent ordinary, validly signed transfers to the attacker. A second Binance Ethereum hot wallet sent 28,006 ether, 55.7 million USDT and 25.9 million RLUSD the same plain way.

These wallets use different chains, key types and signing methods, yet all produced valid signatures for the attacker within about half an hour. TRM's assessment is that the attacker gained the ability to make Binance's hot-wallet signing system sign whatever it asked, across chains. The batch of fifty pre-signed permissions suggests that access was limited in time, or that signatures had to be requested through a system rather than taken directly. That would also square with Binance's statement that no private key leaked: the keys may never have left the signing system; the attacker made the system use them.

Who is behind it

Binance has not named anyone and says it is working with law enforcement to identify those responsible. TRM attributes the attack, with high confidence, to TraderTraitor, the North Korean state hacking unit, citing on-chain and off-chain intelligence. The FBI named the same group for the $1.5 billion Bybit theft in February 2025. TRM points to features shared with Bybit and with the KelpDAO hack of April 2026: small Tornado Cash withdrawals to fund an operator wallet, preparation well before the theft, and signatures collected in advance and used in one burst. Investigators link TraderTraitor to the wider Lazarus Group. The US Department of Justice and the FBI had not responded to requests for comment when AFP reported on 30 October.

Where the money is now: frozen, sold, or still moving

Much of what was taken was in stablecoins, dollar-linked tokens issued by companies that can freeze tokens sitting at a given address. That is what saved a large part of the loot. Through the night the issuers froze the attacker's balances one by one:

By TRM's count that is about $2.7 billion (₹25,635 crore) out of the attacker's hands. Binance said at 5:05 am that frozen assets it had verified had reached $2.54 billion (₹24,116 crore), and its later notice puts the figure at about $3 billion (₹28,483 crore). The two counts differ by what had been confirmed when each was taken.

The attacker raced the freezes and paid heavily to do so. About 325 million USDT (₹3,086 crore) was sold to professional market makers for about 122,300 ether, a price more than 10% worse than the market. Another 60 million USDT was put into the lending protocol Aave as security for a loan of about 19,760 ether, before Aave froze those markets; on Tron, 300 million USDT went into the JustLend lending protocol. About 48 million RLUSD was sold on decentralised exchanges in the twenty minutes before Ripple's freeze.

What remains is the hard part. The attacker holds more than 420,000 ether and the 18,270 bitcoin, about $2.4 billion (₹22,786 crore) by TRM's count, which no issuer can freeze. The 233.46 million XRP has not moved. Based on earlier thefts, TRM expects the next stage to run through bridges between blockchains, swap services and over-the-counter brokers, and is watching the peel chain and the wallets where the ether has been gathered. If the pattern of earlier North Korean thefts holds, the window for catching that money is the next few days, when it reaches an exchange or a broker that can stop it.

One caution on the word "frozen". A frozen token is locked where it sits, at the attacker's address. It is not yet back with Binance. Getting it back depends on the issuers and on law enforcement; Circle has said it is coordinating with the authorities. Until that happens, Binance is carrying the whole loss on its own books.

What Binance is doing

Binance's notice of 30 October, and its statements to the press, add up to the following:

• Withdrawals paused. Binance suspended withdrawals while its security checks run. Its notice was later corrected to say that deposits are unaffected and working normally. On the morning of 30 October (UTC) it said it was on track to resume withdrawals in about 45 hours, which would be around Sunday 1 November, India time, if that holds.
• The door closed. It revoked the compromised address authorisation, the EIP-7702 permission that let the attacker keep sweeping the Ethereum hot wallet.
• Tracing and recovery. It is working with law enforcement, stablecoin issuers and blockchain-intelligence firms to trace and freeze more, and says the totals may rise.
• Who pays. Binance says it will cover all losses from its SAFU fund and the company's own funds, and that user funds are safe. Changpeng Zhao, Binance's founder and largest shareholder, said he expects all user funds to be fully covered.
• Proof. It promises an updated proof of reserves, its public statement that customer balances are backed one-for-one, once the clean-up is done, and a detailed technical report when the investigation is complete.

Can Binance afford it? SAFU, the Secure Asset Fund for Users, Binance's reserve for exactly this kind of event, was about $1 billion (₹9,494 crore) when Binance moved it from stablecoins into bitcoin in early 2026, with a promise to top it up if it fell below $800 million. Even the whole fund would cover only about a third of what is still missing. With about $2.7–3 billion frozen, the gap Binance must fill is roughly $3.3–3.7 billion (₹31,331–34,749 crore), most of which has to come from the company's own money. Customer assets on Binance run to about $155 billion (about ₹14.7 lakh crore), according to CoinMarketCap data cited by Al Jazeera, so the loss is large but a small share of what it holds. The updated proof of reserves will be the first hard test of whether customer balances remain fully backed.

The market's verdict on the first day: bitcoin fell about 5%, below $77,000 (about ₹73 lakh), ether nearly 6% and BNB, Binance's own token, nearly 10%.

Will users get their money back?

For an ordinary customer the answer, on what Binance has said, is that there is nothing to get back, because nothing was taken from your account. The attacker emptied Binance's hot wallets, not customers' individual balances, and Binance has said it will absorb the loss. Your balance on the exchange should look exactly as it did. What you cannot do for now is take it out.

In practice that means:

• No claim form, no application. Binance has not asked users to file anything. Treat anyone who asks you to "register a claim" as a fraudster unless the request appears inside the official Binance app.
• Withdrawals come back first. The first sign that the promise is being kept will be withdrawals resuming normally, then the updated proof of reserves.
• Price falls are not covered. Binance's promise is about the stolen assets. It has said nothing about losses from the price fall that followed, or from leveraged positions closed during it. Those remain your own risk.
• A promise is not insurance. No deposit insurance or investor-protection fund in India covers crypto kept on an exchange, and balances on Binance are not insured the way bank deposits are. The guarantee here is Binance's word and its balance sheet.

If you hold crypto on Binance from India: what to do now

Binance is a reporting entity in India under the Prevention of Money Laundering Act, as a virtual digital asset service provider. The Financial Intelligence Unit (FIU-IND) fined it ₹18.82 crore in June 2024 for serving Indian customers without meeting those duties, and directed it to comply. That makes Binance answerable to Indian anti-money-laundering rules. It does not make crypto a regulated deposit, and no Indian authority guarantees balances held on it.

1. Use only the official app and website. Binance itself warned users not to trust unofficial links, messages or requests for account details. In the days after a big hack, fake "Binance support" numbers, Telegram groups and recovery agents multiply. Binance will never need your password, your two-factor code or your recovery phrase.
2. Do not pay anyone to "recover" your crypto. There is nothing to recover from your account, and recovery fees are a standard fraud. If you have been cheated this way, call 1930 or report it on cybercrime.gov.in at once; money can be frozen only while it is still moving.
3. Record your balances. Take dated screenshots of your holdings and recent transactions. If anything looks different when withdrawals reopen, you will have your own record to put to Binance support.
4. Check your own security. Review the devices and API keys linked to your account and remove any you do not recognise. That protects you from the separate, everyday risk of your own account being taken over.
5. Know the tax before you sell in a hurry. Gains on crypto are taxed as income from a virtual digital asset at a flat 30%, with no deduction except the cost, and a loss on one coin cannot be set off against any other income or carried forward. That was section 115BBH of the 1961 Act; CBDT's own mapping places it in section 194 of the Income-tax Act, 2025, with the 1% TDS on a sale, the old section 194S, now in section 393. Selling at a loss in a falling market gives you no tax relief. This is not a view on whether to hold or sell; it is the arithmetic of doing so.
6. Wait for the technical report. How the attacker got in, and whether "additional points of breach" means more than one route, will matter more to your view of the exchange than the size of the loss.

How it compares

One night's theft from one exchange was more than twice the total stolen in every crypto hack of 2025 put together. The lesson an exchange user can act on is the old one: crypto left on any exchange is only as safe as that exchange's own security, and the bigger the exchange, the bigger the target.

What to watch next

• Withdrawals resuming, on time or not, and any limits that come with them.
• Binance's technical report: how the laptop was compromised, what the "additional points of breach" were, and how the signing system was made to sign.
• The updated proof of reserves, showing whether customer balances are still fully backed after the loss.
• Whether the frozen stablecoins come back to Binance, and how fast.
• The laundering of the ether and bitcoin through bridges and brokers, and whether exchanges catch it.
• Statements from the FBI and other authorities, including any formal attribution.

Frequently Asked Questions

How much money was stolen in the Binance hack? About $6.36 billion, or ₹60,384 crore, by TRM Labs' trace of the transfers, valued when each left Binance's wallets; Binance's own estimate is about $6.3 billion (₹59,814 crore). It is the largest crypto theft on record.

How was Binance hacked? Binance says a DevOps engineer's laptop was compromised, giving the attacker access to a service container from which it submitted unauthorised withdrawals, and that it found no leak of wallet private keys; it later said there were additional points of breach. TRM's reading of the transactions is that the attacker could make Binance's hot-wallet signing system sign transfers on ten blockchains, and used fifty pre-signed EIP-7702 permissions to take over its main Ethereum hot wallet.

Who hacked Binance? Binance has not said. TRM Labs attributes the attack, with high confidence, to TraderTraitor, the North Korean state hacking unit the FBI blamed for the $1.5 billion Bybit theft in 2025.

Is my money on Binance safe? Binance says user funds are safe and that it will cover all losses from its SAFU fund and its own money. The theft was from Binance's hot wallets, not from customers' individual balances. Withdrawals were paused on 30 October; Binance said it expected to resume them in about 45 hours.

Do I need to file a claim to get my crypto back? No. Binance has not asked users to file anything, because it says customer balances are unaffected. Treat anyone asking for a claim fee, your password or your recovery phrase as a fraudster.

How much of the stolen crypto has been frozen? About $3 billion (₹28,483 crore) by Binance's count, and about $2.7 billion (₹25,635 crore) by TRM's, mostly USDT frozen by Tether and USDC frozen by Circle. Frozen tokens are locked at the attacker's addresses; they are not yet back with Binance.

What is the SAFU fund? The Secure Asset Fund for Users, Binance's emergency reserve for its customers. It was about $1 billion (₹9,494 crore) when Binance moved it into bitcoin in early 2026. Binance says it will use SAFU and its own funds to cover the loss.

Is Binance legal in India? Binance is treated as a reporting entity under the Prevention of Money Laundering Act as a virtual digital asset service provider; FIU-IND fined it ₹18.82 crore in June 2024 for failing those duties earlier. Crypto in India is taxed, but it is not a regulated deposit, and no Indian authority guarantees balances held on an exchange.

What is the tax if I sell my crypto now? Gains are taxed at a flat 30%, with no deduction except cost, and losses cannot be set off against other income or carried forward; 1% TDS applies on the sale. These were sections 115BBH and 194S of the 1961 Act, mapped by CBDT to sections 194 and 393 of the Income-tax Act, 2025.

Where do I complain if I am cheated by a fake Binance recovery agent? Call 1930, the national cyber-fraud helpline, or file a complaint on cybercrime.gov.in, as quickly as possible, and inform Binance through its official app.

This article explains a news event and the rules around it. It is not investment advice and makes no recommendation to buy, hold or sell any crypto asset. Figures are as reported on 30 October 2026 and will change as the investigation continues.