ECONOMY · CRYPTO
Key Facts
- The company Binance, one of the world’s largest crypto exchanges, says hackers took about US$6.3 billion.
- What happened Thursday 29 October 2026: most of the money left Binance wallets within about 20 minutes.
- The suspect Two blockchain analysis firms blame North Korea’s hacking unit; Binance names no one.
- The status About US$3 billion is frozen, and withdrawals stay paused for roughly two more days.
- Prediction markets Polymarket gives a 4.4% chance that a major crypto exchange becomes insolvent in 2026 (30 October, 3:16 p.m. ET).
Binance, one of the world’s largest cryptocurrency exchanges, said hackers stole about US$6.3 billion from its wallets on Thursday 29 October 2026. It is the largest crypto theft on record, and Binance has paused withdrawals while it investigates.
For US readers this matters because bitcoin fell about 5% to around US$77,000 on Friday, and shares of US-listed crypto companies fell sharply. For savers in Latin America, where many people hold dollar-linked tokens on exchanges like Binance, the question is whether their balances are safe.
What Happened
Blockchain analysis firm TRM Labs, a company that traces crypto transfers on public blockchains, says the outflows began at 20:05 UTC on Thursday, or 4:05 p.m. in New York. It counts about US$6.36 billion moved out across ten blockchains, most of it within about 20 minutes.
Binance put its own estimate of the total impact at about US$6.3 billion and said it stopped withdrawals on several networks as a precaution. A second wave of transfers reached Binance wallets on two smaller networks, Avalanche and Polygon, around 23:05 UTC.
The previous record was the theft of about US$1.5 billion from the exchange Bybit in February 2025, which the FBI attributed to North Korea. The Binance theft is more than four times larger.
How the Theft Happened
Binance says its first findings point to a compromised laptop belonging to an engineer who runs its software systems. Through that laptop, an attacker may have reached a service container and ordered withdrawals nobody had approved.
The company says it has found no evidence that any wallet private key, the secret code that controls a crypto wallet, leaked. Later work found further points of entry, and Binance calls the attack complex and says it is working with law enforcement.
TRM Labs says the evidence points to a breach of the system that signs Binance’s withdrawals, and notes that Binance has not yet published a root cause. The attackers began preparing on 28 October, the day before the theft, according to TRM.
Live Market IntelligenceCrypto — Live Market Board
Rio Times · Live Market Intelligence
Crypto — Live Market Board
+0.67%
| Instrument | Last | Change | YoY | Prev. | High | Low | Volume |
|---|---|---|---|---|---|---|---|
| BTC | 80,543 | +0.67% | -29.41% | 80,007 | 80,550 | 79,380 | 21,816,416,256 |
| ETH | 2,348 | +1.18% | -43.00% | 2,320 | 2,349 | 2,295 | 8,316,267,520 |
| SOL | 100.98 | +0.22% | -49.19% | 100.75 | 101.04 | 99.17 | 2,110,777,984 |
| XRP | 1.32 | +1.04% | -49.89% | 1.31 | 1.32 | 1.29 | 1,574,615,552 |
| BNB | 750.98 | +1.29% | -34.10% | 741.42 | 751.10 | 733.56 | 1,470,316,160 |
| ADA | 0.21 | -0.30% | -69.21% | 0.21 | 0.21 | 0.20 | 190,120,672 |
| DOGE | 0.08 | +0.78% | -60.98% | 0.08 | 0.08 | 0.08 | 441,746,112 |
| AVAX | 8.84 | -1.36% | -56.54% | 8.96 | 8.96 | 8.67 | 289,961,824 |
| LINK | 11.47 | +0.80% | -37.04% | 11.38 | 11.47 | 11.23 | 248,509,440 |
| DOT | 0.99 | -2.05% | -68.52% | 1.01 | 1.01 | 0.98 | 109,918,912 |
| LTC | 56.59 | -0.13% | -43.06% | 56.66 | 56.87 | 55.70 | 169,852,160 |
| BCH | 290.36 | +3.57% | -47.81% | 280.36 | 292.52 | 277.47 | 195,939,216 |
| TRX | 0.33 | -0.51% | +9.69% | 0.33 | 0.33 | 0.33 | 371,519,040 |
| XLM | 0.17 | +0.21% | -47.60% | 0.17 | 0.17 | 0.17 | 107,134,680 |
| HBAR | 0.08 | -1.56% | -58.82% | 0.08 | 0.08 | 0.08 | 55,674,584 |
| NEAR | 4.62 | +2.60% | +97.50% | 4.50 | 4.64 | 4.39 | 630,712,192 |
| ATOM | 1.61 | -1.48% | -49.28% | 1.64 | 1.64 | 1.60 | 30,012,314 |
| AAVE | 132.37 | -2.36% | -43.78% | 135.57 | 135.87 | 129.56 | 246,790,448 |
Who Is Blamed
TRM Labs attributes the theft to TraderTraitor, a hacking unit that works for North Korea and that analysts link to the better-known Lazarus Group. It says it makes this judgment “with high confidence”, and the FBI blamed the same unit for the Bybit theft.
A second blockchain analysis firm also links the theft to North Korean hackers. Binance’s co-chief executive Richard Teng called it a complex attack, and Binance has named no suspect.
North Korea has long denied such accusations, and we found no statement from the FBI or the US Justice Department about this case. Until a government confirms the link, the blame remains an assessment by private analysts.
Frozen Funds and the Cover Plan
Binance says about US$3 billion has been frozen on the blockchain with help from partners. TRM counted about US$2.7 billion frozen as of 00:30 UTC on Friday, mostly stablecoins, tokens pegged to the US dollar, frozen by their issuers Tether, Circle, Ripple and World Liberty Financial, the firms behind the USDT, USDC, RLUSD and USD1 tokens.
TRM estimates that the attackers still hold about US$2.4 billion in assets that no issuer can freeze. Binance has not said what happened to the rest of the money.
Binance says it will cover all losses with company money and its SAFU fund, the Secure Asset Fund for Users that Binance keeps as an emergency reserve. It also plans to publish a new Proof of Reserves, a public check of customer balances, once repairs are complete.
What Prediction Markets Say
Polymarket, a US-based prediction market, shows a 4.4% chance that a major crypto exchange becomes insolvent in 2026, with US$139,257 traded as of 3:16 p.m. ET on Friday 30 October. That is a low probability, though the market asks about any major exchange failing, not only Binance.
Why we show this: prediction markets turn real-money bets into a live probability that moves within minutes of the news, which is why investors, campaigns and newsrooms in the United States now follow them closely. We show them next to polls and official results, never instead of them.
What It Means for You
If you hold crypto on Binance, withdrawals are paused, and co-chief executive Yi He said they should resume by Sunday 1 November. Binance says user funds are safe, but you should expect delays and treat any message asking for your password or a “recovery fee” as a scam.
If you own bitcoin through US funds or shares, the price move is the main effect so far. Bitcoin fell about 5% to around US$77,000 and ether, the second-largest cryptocurrency, fell about 4% to around US$2,200, while Coinbase, a US-listed exchange, and Strategy, a US company that holds large amounts of bitcoin, were among crypto stocks that fell 8% to 14%.
In Latin America, many savers use stablecoins to protect money from local currency swings, and exchanges are the easiest place to hold them. Keep a record of your balances and wait for Binance’s Proof of Reserves before moving large sums, because a rush to withdraw is what pushes exchanges into trouble.
A safer habit is to hold only what you plan to trade on any exchange, and keep long-term savings in a wallet you control. No regulator has said that ordinary users will lose money in this case.
What Is Not Known
Binance has not published a final cause, a list of the affected wallets or the number of customers who were hit. It is not known how many of its Latin American users are affected, because the company has given no breakdown by country.
It is not clear where the remaining stolen funds went, or whether the attackers can move the roughly US$2.4 billion that cannot be frozen. The restart time for withdrawals is only an estimate, and Binance has not published a final cause.
More: Latin America news in English, every day from The Rio Times.
Frequently Asked Questions
How Much Did Hackers Steal From Binance?
Binance estimates the total impact at about US$6.3 billion, and TRM Labs counts about US$6.36 billion. It is the largest crypto theft on record, and it happened on Thursday 29 October 2026.
Is My Money Safe on Binance?
Binance says user funds are safe and that it will cover losses with its SAFU fund and company money. Withdrawals are paused for now, and the company expects to reopen them within about two days.
Who Is Behind the Binance Hack?
Two blockchain analysis firms point to TraderTraitor, a North Korean hacking unit, but Binance has not named anyone. North Korea has denied such accusations, and no government has confirmed the link in this case.
Sources: TRM Labs, analysis of the Binance theft (updated 30 October 2026, 00:30 UTC); FBI Internet Crime Complaint Center, attribution of the February 2025 Bybit theft; Polymarket, market “Major CEX insolvent in 2026?”.
This article was produced by The Rio Times’ automated newsroom system. How we use AI · Report an error · Editorial responsibility: Matthias Camenzind, Editor-in-Chief