Binance Hack Explained: What Happened and What Is Frozen

Billions Left in 40 Minutes. How Did That Happen?

Can the world's largest crypto exchange lose billions in under an hour? On October 29, 2026, Binance did. It puts the total impact at about $6.3 billion. If that holds, it's the biggest crypto theft on record.

This binance hack explained guide covers the timeline, the likely attack path and the freeze that stopped nearly half the money. It also sets the case beside Mt. Gox, FTX and Bybit. Think of it as the binance hack explained for first-time readers. Some facts are confirmed. Others aren't. We label each one.

The 10-Minute Version: Binance Hack Explained

Here is the binance hack explained in six points:

• Binance's hot wallets, the internet-connected ones that pay out withdrawals, were drained across about ten blockchains, including Ethereum, Bitcoin and Tron.

• Most transfers happened between roughly 20:24 and 21:04 UTC. That's about 40 minutes.

• Early on-chain tallies ranged from about $2 billion to $5.8 billion. Binance later estimated the total impact at around $6.3 billion.

• Tether, Circle and other partners froze assets. Binance says the verified frozen total is about $3 billion.

• Binance paused deposits and withdrawals. It says user funds are safe and that it will cover all losses from its SAFU fund and company funds.

• Its first findings point to a compromised DevOps engineer's laptop. It says it found no evidence of a wallet private key leak.

• Two blockchain analytics firms say, with high confidence, that North Korea's Lazarus Group group is behind it. Officials haven't confirmed that.

• Deposits are running normally. Binance expects to begin resuming withdrawals within 48 hours of its October 30 update.

Founder Changpeng Zhao, who no longer runs the exchange, said the activity "does look like a hack." Binance's own posts say "security incident." We use "hack" because the money left through unauthorized withdrawals.

Binance Hack Explained: Timeline in UTC

Here's the binance hack explained minute by minute, with all times in UTC.

The speed is the part that stands out. Forty minutes is half a football match. Markets slid too.

Hot Wallets vs Cold Wallets: Where the Money Lived

A crypto wallet is a system that stores private keys. A private key is a secret code that proves you can spend certain coins. Whoever can sign with that key can move the money.

Exchanges split their funds into two groups, and that split is central to the binance hack explained.

Think of a shop. The hot wallet is the till. The cold wallet is the back-room safe. A till has to stay open for customers. That's the trade-off, and it's why a hot wallet compromise can empty a lot of money fast.

For scale in this binance hack explained, Binance's year-end 2025 proof of reserves listed roughly $163 billion in user assets. Against that, $6.3 billion is about 4%.

Binance Hack Explained: How the Attack Likely Worked

Binance hasn't published its full post-mortem. This part of the binance hack explained keeps official statements and outside analysis apart.

Binance Hack Explained: What Binance Has Said

Binance says its first findings point to a compromised laptop belonging to a DevOps engineer. That's someone who builds and runs the exchange's servers and software. The attacker then reached a service container, which is a packaged program running inside those servers. From there, the attacker submitted unauthorized withdrawals.

Binance also says it found no evidence of a wallet private key leak.

Our read on the binance hack explained so far: those two statements can both be true. If an internal system can sign payments on its own, an attacker who controls it doesn't need the key file. They can ask the system to sign. Binance hasn't confirmed this, so treat it as interpretation, not fact.

Binance Hack Explained: What the Blockchain Shows

Security researchers flagged an Ethereum feature called EIP-7702. It came with the Pectra upgrade. It lets a normal wallet hand temporary control to a smart contract, which is a program that lives on the blockchain.

Researchers said the attack transaction carried 50 of these delegations, all aimed at one Binance hot wallet. Only one matched the wallet's nonce, the running count of its transactions. The wallet was busy, so the attacker couldn't know the exact number. Sending 50 guesses covered that gap.

Minutes later, the wallet sent out about 167,000 ETH, roughly $1.6 billion in USDT and more than 60 other tokens in a single transaction.

Here's the open question in this binance hack explained story. Each delegation needs a valid signature from the wallet. So someone could produce signatures. How they gained that ability is what the post-mortem has to explain.

Binance Hack Explained: Confirmed, Reported and Unknown

On attribution, in this binance hack explained story, two blockchain analytics firms say, with high confidence, that North Korea's Lazarus Group  group, is responsible. They point to similarities with the Bybit attack, including preparation well before the theft. That's an analyst assessment, not a formal government attribution. Binance hasn't named anyone.

Binance Hack Explained: The Freeze That Locked $3B

The freeze is the better half of this binance hack explained story.

Tether and Circle issue the stablecoins USDT and USDC. A stablecoin is a token built to track a currency, usually the US dollar. Issuers control the token's smart contract, so they can block specific addresses. Blocked coins can't move.

Tether said it froze more than 1.5 billion USDT. Circle froze over 800 million USDC in the same receiving wallet. Other service providers added more. Binance's verified total climbed from $2.54 billion to about $3 billion in roughly 90 minutes. Some outside tallies run lower, nearer $2.7 billion, so treat $3 billion as Binance's figure and expect it to move.

That is asset freezing at its fastest. It worked because much of the stolen value sat in stablecoins. In short, here's the binance hack explained for freezes: stablecoins can be stopped, Bitcoin and Ether can't.

That's the gap. Binance's two official numbers are about $6.3 billion in impact and about $3 billion frozen. As of October 30, 2026, roughly half is still unlocked.

A freeze isn't a recovery. Frozen funds still need legal or issuer steps before they return to the rightful owner. Binance says it will cover losses either way.

How This Compares to Mt. Gox, FTX and Bybit

Not every big crypto disaster is a hack. Here's the binance hack explained next to three older cases.

Two differences stand out. FTX wasn't a hack. Customer money was misused.

Binance promised full cover from day one. Its SAFU fund was roughly $1 billion in Bitcoin as of a January 2026 update. That can't cover $6.3 billion alone, so company funds matter.

Bybit is the closest match, and Binance's figure is about four times larger. One caution on this crypto exchange hack comparison: dollar values come from each event's date, so don't read them like for like.

What Happens to Stolen Crypto

Stolen crypto tends to follow a pattern, and the binance hack explained so far fits it.

1. Spread. Funds get split across many addresses.

2. Swap. Coins that can be frozen, like stablecoins, get swapped for ones that can't.

3. Bridge or mix. Cross-chain swaps and mixers blur the trail.

4. Cash out. Exchanges and over-the-counter desks turn it into cash.

Bybit shows how this goes, and it's useful context for the binance hack explained so far. Court records unsealed by August 2026 showed only about 5.3% of its stolen funds, around $75.5 million, was frozen or recovered. More than 90% had gone dark, meaning it couldn't be traced.

Onchain forensics is the work of following those moves. Analysts link addresses and alert exchanges. Every move is visible on a public blockchain. Visible doesn't mean reversible.

Binance's case differs on one count. Close to half was frozen within hours, well above Bybit's single-digit share. Freezes work best early.

Bitcoin and Ether outside the freezes can still be traced, even if they can't be switched off.

Lessons for Every Crypto User

You don't need to panic. Here's the binance hack explained as practical lessons.

• Know what an exchange balance is. The binance hack explained in one lesson: custody is trust. Coins on an exchange are held by the exchange. You trust its security and its promises.

• Watch how a platform behaves in a crisis. Clear statements, proof-of-reserves updates and a real post-mortem are good signs. Binance has promised the last two.

• Lock down your account. Use an authenticator app or passkey, turn on withdrawal address whitelisting, and set an anti-phishing code.

• Expect scams. Fake refund and recovery messages spread after big incidents. Use only official channels. Never share a seed phrase.

• Think about where long-term coins sit. Many users keep only trading balances on exchanges and use a hardware wallet for the rest. Self-custody has its own risk: a lost seed phrase can't be recovered.

Conclusion: What Stands Out and What Is Still Unknown

This binance hack explained recap comes down to four facts. Hot wallets were drained in about 40 minutes. Binance estimates the impact at $6.3 billion. Stablecoin issuers and partners froze around $3 billion. Binance says it will cover all losses.

Plenty remains open in the binance hack explained so far. We don't know how the attacker gained signing ability, what the final loss is, whether officials will confirm the North Korea link, or exactly when withdrawals return. Watch for the post-mortem, the updated proof of reserves and a reopening date on Binance's official announcements page.

Disclaimer: This article is for information only and isn't financial, legal or investment advice. Crypto assets are volatile and high risk, and details of this incident are still developing. Do your own research and rely on official sources before making decisions.