Ahsan Ansari
In late October 2026, the cryptocurrency world was shaken by what is now described as the biggest theft in its history. Binance, the world’s largest crypto exchange, says hackers stole about $6.3 billion. What makes the story even more shocking is the speed. Blockchain analysis firms TRM Labs and Chainalysis say most of the theft happened in about 20 minutes, starting late on Thursday, October 29. That means billions of dollars left the exchange in less time than a typical lunch break. The previous record belonged to the Bybit hack of February 2025, and the Binance theft is roughly four times larger than that $1.5 billion heist. Binance says $6.3bn stolen in the biggest crypto heist in history.
To understand what happened, it helps to know how an exchange works. Millions of people keep their coins on platforms like Binance instead of managing their own digital wallets, because it feels easier and safer. The exchange holds those coins in huge wallets, and special software “signs” each transaction to approve it, a bit like a digital signature on a bank transfer. If an attacker takes control of that signing process, they can order the exchange’s own wallets to send money wherever they want. TRM said the attackers ordered Binance’s wallets to empty into wallets they controlled, which mirrors the way the Bybit hack was carried out. The money was pulled from wallets on 10 different blockchains at the same time, which made the attack harder to stop.
This was not a sudden smash-and-grab. It was carefully planned. TRM Labs said preparation began at least 36 hours before the theft, and that the attacker gained the ability to make Binance’s hot wallet signing system produce valid signatures across multiple chains. Binance’s first explanation was that the breach may have started with a hacked laptop belonging to one of its engineers. Later, the company said its investigation had found additional points of breach. Binance also says it has found no evidence that any wallet’s private key leaked. However, Mark Karpeles, the former head of the collapsed Mt Gox exchange, told Reuters he believes the attackers probably accessed the keys for at least two Binance wallets. The full technical story is still being pieced together, so these details could change.
Investigators are pointing toward North Korea. TRM said it assessed with high confidence that the attack was carried out by TraderTraitor, a North Korean hacking unit linked to the Lazarus Group, and Chainalysis reached the same conclusion. The FBI also blamed the same unit for the Bybit hack in 2025. Binance itself is being more careful. Its co-CEO, Richard Teng, said the investigation has not blamed any individual, and North Korea routinely denies any involvement in hacking. It is important to remember that attribution in cybercrime is difficult, and these findings come from private analysis firms rather than a court ruling.
The motive, experts say, is simple: money. Crypto theft has become an important source of foreign currency for North Korea, and experts say it helps fund a nuclear weapons program that is under United Nations sanctions. The Lazarus Group has a long history in this area. Its crypto attacks go back to 2017, when it broke into four South Korean exchanges and stole about $200 million worth of bitcoin. That is why one TRM official told Al Jazeera this is a global security issue and not just a crypto crime. Every stolen dollar that is turned into cash can end up supporting activities that governments around the world are trying to stop.
Binance reacted quickly once the theft was discovered. It suspended deposits and withdrawals, promised to cover all losses, and told users their funds were safe. There is also some good news on recovery. About $3 billion has been frozen so far, including more than $2.3 billion frozen by the stablecoin issuers Tether and Circle. Stablecoins are crypto tokens tied to the value of a currency like the dollar, and their issuers have the power to block them, which is why so much could be stopped. Still, the rest is a worry. Binance has not said what happened to the remaining $3.3 billion, and it warned that the total stolen could still rise as it traces more assets. The company also said it was working with law enforcement and hoped to resume withdrawals within about 45 hours.
The hack also rattled the wider market. Bitcoin dropped to a six-week low of $76,368, Ether fell more than 3 percent to a two-month low, and shares in the exchange Coinbase fell 4.8 percent, even though Coinbase said it was not affected. Prices steadied after the first shock, but the timing was bad. Crypto was already under pressure from higher US interest rates and weaker demand from ETF buyers. The size of the theft is also hard to absorb for any company. It is more than six times Binance’s $1 billion emergency fund, which the company set up in 2018 to protect users after a breach, so Binance said company funds would also be used to cover losses.
The Bybit hack gives useful context. In February 2025, Bybit lost nearly $1.5 billion, mostly in Ethereum, taken from what was supposed to be a very secure offline “cold” wallet. The attacker quickly started selling, dumping around $200 million worth of staked ether on decentralized exchanges, which helped push the price of Ethereum down about 4 percent. Before that, the largest cases included the Poly Network hack of about $611 million in 2021 and the Coincheck theft of $530 million in 2018. Each time, the record was broken. This time it was broken by a huge margin, which suggests attackers are getting better at targeting the people and systems around the blockchain, not the blockchain itself.
There are several lessons from this event. First, big exchanges are tempting targets. As one expert from Macquarie University put it, assets held at a centralized exchange are only as safe as the exchange itself, and the bigger its holdings, the bigger the target. Second, insurance may not help much. Most crime and cyber insurance policies do not cover stolen cryptocurrency, and crypto-specific cover is a small niche business. Third, ordinary human and device security can be the weakest link, since one compromised laptop may be enough to start a chain of events that ends in billions vanishing. For everyday users, sensible habits include not keeping all your savings on one platform, turning on two-factor authentication, using hardware wallets for long-term holdings, and ignoring emails or messages that claim to be “recovery” offers after a hack, since scammers often take advantage of these moments.
Theft in crypto is also far from rare. TRM’s report found that hackers stole $2.87 billion across nearly 150 attacks in 2025, and the Binance hack alone is more than double that entire total. In the end, this event is a reminder that crypto’s promise of speed and freedom has a darker side, because money can move around the world in minutes and often cannot be pulled back. This is still a developing story, so the final amount stolen, the amount recovered, and the exact cause may change as investigators learn more.
The writer is a retired government officer who served in the Press Information Department (PID) and the Ministry of Information & Broadcasting.
