Binance lost $6.3 billion in a day. Getting it back is the hard part

What Binance is

Binance is the world's largest cryptocurrency exchange, a company where people and firms buy, sell and store digital money. Its 2025 annual report put the assets it held for customers at about $162.8 billion.

That size is why a break-in matters. Cristiano Ventricelli, a vice president for digital assets at Moody's Ratings, a credit rating agency, says scale can amplify the impact of a breach. He adds that the wider credit effects depend on the final losses and on asset recovery.

What happened on October 29th

TRM Labs, a firm that traces stolen crypto on public blockchains, says the first Binance transfers left at 20:05 Coordinated Universal Time on October 29th, 2026. Most of the money was gone in about 20 minutes.

Estimates of the loss differ. TRM puts it at about $6.36 billion. Chainalysis, another tracing firm, confirmed at least $5.912 billion that evening, and its chief executive later said $6.4 billion. Binance has not published its own breakdown.

Binance says an engineer's laptop may have been the start. It also says it found more points of breach. TRM says the evidence points to a compromise of Binance's wallet signing system across several blockchains. Binance has promised a technical post-mortem. Until it arrives, the cause is open.

Frozen is not the same as recovered

Tether and Circle, which issue stablecoins, froze large amounts that night. Reuters reports Tether froze nearly $1.57 billion and Circle more than $800 million. Binance says it has located about $3 billion.

Bitcoin and ether have no issuer who can freeze them. TRM says the attacker now holds about $2.4 billion that no issuer can reach. Investigators must trace it and catch it at exchanges that cooperate.

Eric Jardine, head of research at Chainalysis, says a technical freeze may happen quickly while returning funds can take months or years. TRM's Ari Redbord says officials typically get a court order or seizure warrant before working with stablecoin issuers to return assets.

Binance says it will cover all losses. Its secure asset fund holds about $1 billion in bitcoin, according to its website. Binance has given no update on the remaining $3.3 billion.

Who is blamed

TRM and Chainalysis both blame TraderTraitor, a North Korean state hacking unit that investigators link to the Lazarus Group. They say they are highly confident. North Korea routinely denies state hacking.

Binance has not named an attacker. Richard Teng, co-chief executive of Binance, says its investigation has not attributed responsibility to any individual. The attribution is the analysts' judgment. It is not a government finding.

Changpeng Zhao, the founder and largest shareholder, no longer runs the company. He said the incident looked like a hack and that he expects all user funds to be fully covered. Both men are pictured below.

Richard Teng

Co-chief executive, Binance

Says Binance is covering every loss and that its investigation has not attributed responsibility to any individual.

Changpeng Zhao

Founder and largest shareholder, Binance

No longer runs the company. Said the incident looked like a hack and that he expects all user funds to be fully covered.

A second hack the same day

Polymarket, a prediction market platform, lost far less the same day. The Block reports $2.65 million was taken from users. Polymarket says one of its third-party providers was compromised, and that affected traders will be made whole.

Hackers used code hosted by DebugBear, a website performance-monitoring service, to hijack logged-in trading sessions. No source we read ties the two hacks to one operation.

What to watch

Three tests have dates. Vektora's forecast asks whether Binance announces that deposits and withdrawals have resumed by November 13th, 2026. It asks whether Binance publishes its promised post-mortem by December 15th, 2026. It asks whether the US Federal Bureau of Investigation publicly attributes the theft to North Korea by December 31st, 2026.

Analysts also watch the unfrozen bitcoin and ether. TRM expects the attacker to move it through bridges, swap services and over-the-counter desks in the coming days.