Binance Hack: The Largest Crypto Heist in History — and What It Means for Custody (2026)

Last updated: 30 October 2026, 14:00 GMT · Developing story · Reading time: about 9 minutes

What is confirmed, reported, and unknown

The most useful thing this post can do — and the thing most coverage of a fast-moving story skips — is separate what is established from what is still being reported, and from what nobody knows yet.

Confirmed by Binance or multiple major outlets

Reported but not yet confirmed by Binance or law enforcement

• Attribution to North Korea. TRM Labs, a blockchain analytics firm, has said a North Korean state-sponsored group appears to be behind the attack. The FBI has not formally confirmed this at the time of writing. Attribution in crypto investigations usually firms up over weeks, not hours.
• The technical attack vector. One community analysis reports that the attacker used EIP-7702, an Ethereum feature introduced with the Pectra upgrade in May 2025, which allows a wallet to delegate control to a contract with a single signature. That is plausible and consistent with the pattern of the attack, but Binance has not confirmed the mechanism. Treat it as reported, not established.
• Whether customer balances are fully covered. "We will cover all hacking losses" is a statement of intent. The mechanism — Binance's balance sheet, its SAFU emergency fund, or insurance — has not been specified. Those are different things, and the distinction matters.

Unknown

• Whether the remaining ~$3.3 billion is recoverable.
• Whether any customer funds are permanently lost, or whether Binance's coverage commitment means customers are made whole regardless.
• How long deposits and withdrawals will remain suspended.
• Whether regulators in any jurisdiction will impose conditions or restrictions as a result.

What actually happened

According to the reports, an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, most of it within about twenty minutes. That speed is the detail worth sitting with: this was not a slow drain over days. It was a coordinated withdrawal across multiple chains in a single window, which suggests the attacker had prepared the infrastructure in advance and knew exactly which wallets to target.

The composition reported so far includes roughly $1.45 billion in Bitcoin and around $875 million in ETH, with the remainder spread across other assets and stablecoins.

Binance's response has been to suspend deposits and withdrawals while the investigation proceeds, and to work with partners to freeze affected assets. Around $3 billion has been located so far. Tether and Circle — the issuers behind the two largest stablecoins — blocked roughly $2.4 billion of the total, which is the single largest lever available in a crypto theft: stablecoin issuers can freeze tokens at the contract level in a way that no one can freeze Bitcoin.

Yi He, Binance co-founder, said the company would cover "all hacking losses". That is a stronger commitment than Bybit made in 2025 — and Bybit did in fact cover its customers — but it is a commitment, not yet a completed process.

Why the attacks are getting bigger, not more frequent

This is the pattern that most coverage misses, and it's the one that actually tells you something about where the risk sits.

According to Chainalysis, around $3.4 billion in crypto was stolen in 2025, of which roughly $2 billion was taken by groups attributed to North Korea. The number of North Korean-attributed attacks fell over that period, while the average value per attack rose. Fewer attempts, much larger thefts.

Four structural reasons explain why:

• Hot wallets hold billions. An exchange has to keep enough crypto online to pay withdrawals instantly. The bigger the exchange, the more it holds in a hot wallet at any given moment — and hot wallets are, by definition, connected to the internet.
• The attackers are professional. Groups like Lazarus operate more like intelligence services than criminal gangs. They prepare for months, apply for jobs at crypto firms under false identities, and attack through employees and service providers rather than through the blockchain itself.
• New attack surfaces keep appearing. The reported use of EIP-7702 in this case is an example: a feature added to Ethereum in May 2025 to make wallets more programmable also creates a new way for a single compromised signature to hand over control of a wallet. Every protocol upgrade is a new feature and a new attack surface.
• The entry point is usually a person, not a machine. The 2025 Bybit hack reportedly began with a developer's computer, not the exchange's own infrastructure. Social engineering scales better than cryptography breaks.

The consequence for anyone holding crypto is uncomfortable but simple: the largest, best-resourced exchange in the world is not immune, and its size is part of why it is a target rather than a defence.

The custody question nobody asks until now

Here is the part that connects this story to everything else on this site about fintech, and it is the part that matters most.

When you hold crypto on an exchange, you do not hold crypto. You hold a claim against the exchange — an entry in their database saying they owe you a certain amount of a certain asset. The exchange holds the actual assets. That is custodial custody, and it is structurally the same arrangement as a bank account, with one critical difference: none of the protections that apply to a bank account apply to it.

This is the same structural point as our guide to where your money actually sits — the brand on the app is not the entity holding your money, and what protects you depends on which category that entity falls into. For an e-money institution, the protection is safeguarding and a claim on a pool. For a crypto exchange, there is no equivalent statutory protection at all.

Binance saying it will cover losses is genuinely reassuring, and it is more than many exchanges would offer. But it is a commercial commitment, not a legal right. If the company's position changed, or if the loss exceeded what it could absorb, customers would have a contractual claim and no compensation scheme behind it.

What protection you actually have — and don't

If you hold crypto, it is worth knowing exactly which protections apply to which part of your holdings. They are not uniform, and the difference is large.

None of those rows is "safe." They are different risk profiles. The exchange row carries counterparty risk. The self-custody row carries operational risk. The staked row carries both plus smart-contract risk. Choosing between them is choosing which risk you are better equipped to manage — which is the same framing as our comparison of which failure mode a firm can absorb, applied to your own holdings.

If you hold crypto on an exchange

Practical steps, in order. None of these is financial advice — they are the operational questions worth answering for yourself.

1. Do not panic-withdraw into an unfamiliar wallet. The most common way people lose crypto during an exchange incident is by moving it hastily to a wallet they have not tested, or by falling for a phishing site promising to "help you withdraw".
2. Check the exchange's official status page — not social media, not a Telegram group. Binance's own announcements are the authoritative source on whether withdrawals are open and what the current position is.
3. If you do move to self-custody, test first. Send a small amount, confirm it arrives, confirm you can move it again. Only then move the rest. Seed-phrase mistakes are irreversible.
4. Understand what you are giving up. Self-custody removes counterparty risk and adds the risk that you lose access permanently. For most people the honest answer is that both risks are real and the choice is about which one they can manage.
5. Keep records. If the exchange does freeze assets or restructure, transaction records and account statements may matter for tax and for any eventual claim.
6. Be sceptical of anyone offering to recover your funds. Recovery scams follow every major hack. No legitimate firm will contact you unprompted offering to retrieve crypto for an upfront fee.

For the broader question of how payments and custody work in conventional finance — where the protections above do apply — see our guide to how digital payments actually work.

Frequently asked questions

How much was stolen in the Binance hack?

Reuters reported an estimated $6.3 billion impact on 30 October 2026, the largest crypto heist on record. Early estimates on 29 October were around $2.8 billion; the figure was revised upward as the investigation progressed. Binance says around $3 billion has been located with partners so far.

Is my crypto safe on Binance?

That depends on what "safe" means to you. Binance has said it will cover all hacking losses, which is a meaningful commercial commitment. But an exchange balance is not a bank deposit: there is no FSCS protection, no Section 75, and no statutory compensation scheme. You are an unsecured creditor of the exchange, and the protection you have is whatever the exchange's balance sheet and its commitments provide.

Was the Binance hack carried out by North Korea?

TRM Labs has attributed the attack to a North Korean state-sponsored group. The FBI has not formally confirmed that attribution at the time of writing. Attribution in crypto investigations typically takes weeks to firm up, so treat it as reported rather than established.

Is my crypto covered by FSCS if an exchange fails?

No. The Financial Services Compensation Scheme covers bank deposits, certain insurance products and certain investments. It does not cover crypto assets held on an exchange. If an exchange fails, customers are unsecured creditors in the insolvency.

What does "not your keys, not your coins" mean?

It means that crypto held on an exchange is a claim against the exchange, not direct ownership of the asset. Only self-custody — where you control the private keys — removes counterparty risk. It introduces a different risk instead: losing access to the keys, or being phished into approving a malicious transaction.

Can stolen crypto be recovered?

Sometimes, partially. Stablecoin issuers like Tether and Circle can freeze tokens at the contract level, which is how roughly $2.4 billion was blocked in this case. Bitcoin and other assets that cannot be frozen are harder, and recovery depends on tracing and on exchanges blocking deposit addresses. Historically, recovery rates have been low.

Should I move my crypto off an exchange?

That is a personal risk decision, not a recommendation this site can make. The honest framing is that exchange custody and self-custody carry different risks: counterparty risk on one side, operational and irreversible-mistake risk on the other. Which is worse depends on your circumstances. What matters is making the choice deliberately rather than by default.

Will this affect crypto prices?

Markets typically react to exchange breaches with a short-term sell-off, particularly when withdrawals are suspended. This post does not make price predictions. What is more useful to watch is whether other exchanges tighten custody practices and whether regulators respond — those have longer-term effects than the immediate price move.

Related reading on Dedon Tech: fintech vs traditional banking: where your money actually sits · how digital payments actually work · full site map