Binance Loses $6.3 Billion in a 20-Minute Hack
Hackers drained $6.3 billion from the crypto exchange Binance, Bloomberg reported. Binance dated the security incident to October 30, 2026.
Reuters reported that the theft unfolded in about 20 minutes.
That speed matters for anyone trying to reconstruct how the exchange's controls responded. A drain that finishes before most human operators can step in points to automated or pre-staged transfers, meaning transfers set up in advance and triggered in a burst. It does not look like a slow intrusion that was caught partway through.
Binance's own Security Incident Update gives two concrete points. The exchange said approximately $3 billion had been frozen on-chain following the incident. "On-chain" means recorded on the public blockchain, the shared ledger that tracks every crypto transfer, so a freeze there can stop funds from moving. The exchange also said losses from the incident would be covered by SAFU, its user-protection fund. The same update referenced a suspected compromised engineer laptop as part of the incident.
In my view, the laptop detail is the most useful part of the disclosure for security teams. A single endpoint in the engineering environment was the reported point of compromise. That raises obvious questions about privileged access, device management, and how signing authority, the permission to approve a transfer, was separated from everything else.
Attribution is less settled. NPR reported that a North Korean hacking unit is widely believed to be behind the theft. Bloomberg reported that U.S. law enforcement had joined the hunt for the hackers.
Neither report, as published, amounts to a formal charge. The trail across on-chain wallets is the thread investigators will pull.
On the customer side, Bloomberg reported on November 1, 2026 that Binance planned to resume customer withdrawals in phases after the hack. The same report cited a net outflow of $3.6 billion in cryptoassets after customer withdrawals were restored.
A phased reopening is a deliberate way to meter liquidity while the exchange confirms that its wallets and internal systems are clean. Net outflow measures how much capital left the platform on balance, and that is the number to watch. It will shape how much trust, and how much liquidity, the exchange has to rebuild.
The New York Times reported that the Bybit hack, which stole $1.5 billion, had been the largest crypto heist before this one. At $6.3 billion, the Binance loss is more than four times that figure.
Market participants will weigh how much of the loss SAFU covers and how much is frozen, and the two numbers answer different questions. The $3 billion frozen on-chain is less than half of the $6.3 billion siphoned. Whether the rest can be recovered is not something a freeze figure alone can settle.
The Wall Street Journal reported that the heist sparked reaction among chief information security officers, many of whom regard digital currencies as the financial engine of ransomware.
The practical consequence reaches beyond crypto. A theft of this size, traced to an engineer's device, gives security leaders at firms outside the sector a concrete case for treating developer endpoints and signing infrastructure as high-value targets, whatever those firms hold.
For ordinary users, the questions are narrower and more immediate: whether withdrawals resume on schedule, how SAFU coverage is applied, and what the final loss figure becomes once frozen assets are counted. The next disclosures on those points will matter most.
