Findivoza

November 7, 2026

Findivoza

Bitcoin coins
Technology

Binance hit by $6.3 billion hack — the largest crypto theft in history

Faizan Altaf

In about twenty minutes, on a Thursday night, hackers moved roughly $6.3 billion worth of cryptocurrency out of Binance, the world’s largest crypto exchange. It is the biggest crypto theft ever recorded — more than four times larger than the previous record.

Binance says it will cover all customer losses from its own funds, and on Saturday, 31 October, it said it had already covered 90 percent of the amount stolen. But the attack raises hard questions: how could the world’s biggest exchange lose billions so fast, who did it, and what does it mean for people in Pakistan who use crypto?

At a glance: What happened / Why it matters / What happens next

What happened: On Thursday, 29 October 2026, at about 8:05pm UTC (1:05am Pakistan time on Friday, 30 October), attackers moved about $6.3 billion in crypto out of Binance’s wallets across ten blockchains, most of it in roughly twenty minutes. Binance suspended deposits and withdrawals and promised to cover all losses.

Why it matters: It is the largest cryptocurrency theft on record — more than four times the $1.5 billion stolen from the Bybit exchange in February 2025. For Pakistan, it matters directly: Binance is one of the most widely used crypto platforms in the country, and it holds a preliminary clearance — a No Objection Certificate — from Pakistan’s crypto regulator, the Pakistan Virtual Assets Regulatory Authority (PVARA).

What happens next: Binance has promised a full post-mortem once its investigation is complete. Rival exchanges are tightening their security, and industry leaders are calling for a shared, real-time alert system.

What happened on 29 October

Binance is the world’s largest cryptocurrency exchange, where people buy, sell and store digital currencies such as Bitcoin, Ether and its own token, BNB. On the evening of 29 October, about $6.36 billion was moved out of its wallets across ten blockchains, most of it in roughly twenty minutes from 20:05 UTC, according to the blockchain analysis firm TRM Labs. In Pakistan, that was 1:05am on Friday, 30 October — so most Pakistani users woke up to the news.

Binance confirmed a security incident the same day and suspended withdrawals. Its message to customers was short and repeated several times: user funds are safe, and Binance will cover all losses.

The exact figure depends on who is counting. Binance spoke of about $6.3 billion “impacted”. TRM Labs put the total moved at about $6.36 billion. Chainalysis put the amount stolen at about $5.912 billion at the time of the theft. These are different ways of measuring the same event, because crypto prices move every minute. What is not in doubt is the scale: the previous record was the $1.5 billion taken from Bybit in February 2025. TRM Labs’ Ari Redbord called this a “watershed moment” for the industry.

How did the hackers get in?

We do not yet have the full picture — Binance has not published its detailed post-mortem. But the company has shared its early findings.

Co-chief executive Richard Teng said on X that the attack “may have started with a compromised DevOps engineer’s laptop”. A DevOps engineer works on the systems that keep software running. According to Teng, the attacker used that laptop to reach a service container — a piece of the exchange’s internal system — and from there submitted unauthorised withdrawal transactions. In simple terms, the attacker did not steal ordinary users’ passwords. They got inside Binance’s own systems and told its wallets to pay them.

Teng stressed this was not a single click or a single mistake: the attacker “did not simply use one engineer’s permissions”. Binance later said it found additional points of breach beyond the laptop, and that software designed to erase traces of the attack had hampered the investigation. The company also said it found no evidence that any wallet private key had leaked. A private key is the secret code that controls a crypto wallet, like the master password for a vault. This was a planned attack on the systems that move money inside the exchange — and it worked in minutes.

Who is being blamed?

No government or law enforcement agency has confirmed who carried out the attack, and no group has claimed responsibility. But the analysts who track stolen crypto have pointed in one direction: North Korea.

TRM Labs said it attributed the attack “with high confidence” to TraderTraitor, a North Korean hacking unit. Chainalysis reached a similar conclusion. The FBI had already named the same group as responsible for the Bybit theft in February 2025. North Korea routinely denies involvement in cryptocurrency thefts, and its mission in Geneva did not respond to requests for comment, Reuters reported.

Be careful here: attribution is based on patterns — the tools used, the way money is moved, the wallets it passes through — not on a signed confession. It is an assessment by private firms, not a confirmed finding by a court or a government. The reason North Korea is suspected is its long record of large crypto thefts, and the fact that stolen crypto is hard to trace and freeze: it can be moved across borders in minutes, split into small pieces and swapped between coins.

How much has been recovered?

About half of the affected assets were frozen quickly, with help from other companies. Tether said it froze nearly $1.57 billion linked to the attack, and Circle said it froze $800 million. Stablecoins are crypto designed to hold a steady value, usually tied to the US dollar — and unlike Bitcoin or Ether, they can be frozen by the company that issues them. Freezing is not the same as recovering: frozen money is stopped, but it still has to be returned through legal and technical processes.

Then, on Saturday, 31 October, Binance said it had covered 90 percent of the amount stolen. The outstanding 10 percent consists of tokens that are less liquid — harder to buy in large amounts quickly — so they may take longer to source.

Note what that means. Binance is not saying it got 90 percent of the stolen coins back from the hackers. It is saying it has replaced 90 percent of the value from its own resources. In its 30 October update, Binance said it had set aside more than $6.34 billion from corporate resources, its Secure Asset Fund for Users (SAFU) and token holdings. SAFU is Binance’s emergency insurance fund, a reserve held in Bitcoin meant to cover losses in exactly this kind of event.

How did markets and the industry react?

Bitcoin fell more than 4 percent on Thursday, while Ether fell more than 5 percent, according to Reuters. Both recovered some ground on Friday. BNB, Binance’s own token, fell about 8 percent at one point. The reaction was calmer than many expected after a theft of this size, largely because of Binance’s promise to cover the losses and the speed of the freezes.

Other exchanges moved quickly. Coinbase, the largest crypto exchange in the United States, said it adjusted its systems that store cryptocurrency keys offline, “solely out of an abundance of caution”. Keeping keys offline — “cold storage” — means hackers cannot reach them over the internet. Kraken said it was monitoring industry incidents for lessons for its own defences.

On Friday, exchange executives called for a coordinated hack detection system. Star Xu, chief executive of OKX, wrote on X: “We need a real-time alert system that allows participants to share information immediately when a hack occurs, coordinate a rapid response, and temporarily freeze suspected stolen funds.” Chris Perkins, Franklin Templeton’s head of crypto, said: “For crypto to reach its full potential, the security situation must be addressed immediately.”

What does this mean for Pakistan?

For Pakistani users, the hack lands at a moment of big change. For years, crypto sat in a grey area in Pakistan. That changed with the Virtual Assets Act, 2026, which created PVARA as the country’s official crypto regulator. In April 2026, the State Bank of Pakistan also lifted its long-standing ban on banks servicing licensed crypto firms.

Binance is one of the most widely used crypto platforms in Pakistan. In December 2025, PVARA granted Binance a No Objection Certificate (NOC), alongside the HTX exchange. An NOC is a preliminary clearance — it lets a firm register with Pakistan’s anti-money-laundering system and set up a local company while it works toward a full licence. It is not a licence, and PVARA has said the NOCs do not amount to a full operating licence. As of October 2026, no crypto exchange holds a full PVARA licence.

That distinction matters now. An NOC gives users no licence-based protection in Pakistan. If something goes wrong on a foreign exchange, Pakistani users cannot rely on a local regulator to get their money back — they are relying on the exchange itself. Binance’s co-founder Changpeng Zhao is also an adviser to Pakistan’s National Crypto Council, and in December 2025 Pakistan signed an agreement with Binance to explore tokenising up to $2 billion of state assets. That is a government partnership, not a licence, and it does not protect individual users.

Neither Binance nor PVARA has published how many of Binance’s users are in Pakistan, or how much of the affected balance belonged to Pakistani customers. What Pakistani users should know is this: nothing in the reports so far suggests individual accounts were broken into. The attack hit Binance’s own wallets, not users’ passwords. Balances should still show in accounts, but withdrawals were suspended while Binance carried out security checks, and Binance said it aimed to resume them within about 48 hours.

How to protect yourself

No guide can make crypto risk-free, and this article is not financial advice. But the hack underlines a few basic steps.

Turn on two-factor authentication. A second check — usually a code from an app on your phone — on top of your password makes it much harder for someone to get into your account.

Use an anti-phishing code. Binance lets users set a code that appears in every genuine email from the exchange. If an email claiming to be from Binance does not show your code, it is fake.

Do not trust anyone who contacts you first. Binance has no WhatsApp or phone helpline. Real support is only through the app or the website chat. Anyone claiming to be a “Binance agent” who asks for your password or a code is a scammer.

Be careful with P2P deals. In Pakistan, most people who lose money on Binance lose it through peer-to-peer deals, bank freezes and scams, not through a hack of Binance itself. Trade only with verified merchants, refuse third-party payments, and never take a deal off the platform.

What happens next

First, Binance’s post-mortem. The company has promised a full report once the investigation is complete, explaining how the attackers got in and what it is changing. Until it arrives, much of what we know comes from the company’s early updates and outside analysts.

Second, withdrawals. Binance said it aimed to resume them within about 48 hours, after security checks. The 31 October update — 90 percent covered — suggests the company is moving toward normal service, but users should check the exchange’s own announcements rather than assuming a date.

Third, regulation in Pakistan. PVARA’s licensing rules were notified on 21 August 2026, and NOC holders are expected to apply for a full licence within about three months — around 21 November 2026, on one reading of the rules, though PVARA has not confirmed the date. The hack is likely to sharpen the questions regulators ask about security and customer-fund safeguards before any full licence is granted.

Finally, the hunt for the money. TRM Labs’ Ari Redbord told the BBC that the attacker still holds a very large amount, so efforts to trace and recover the funds are far from over. What matters for users is whether Binance keeps its promise to cover the losses — and so far, it says it has covered 90 percent of them.

Frequently asked questions

Was my Binance account hacked? Nothing in the reports so far suggests individual accounts were broken into. The attack hit Binance’s own wallets and withdrawal systems. Still, check that two-factor authentication is on.

Will I lose my money? Binance has said it will cover all losses from its own funds, and on 31 October it said it had covered 90 percent of the amount stolen. That is a promise from the company, not a guarantee from a regulator.

Is Binance banned in Pakistan? No. It holds a PVARA No Objection Certificate from December 2025. But it is not a licensed exchange in Pakistan yet — no exchange holds a full PVARA licence as of October 2026.

Was North Korea behind the hack? TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean hacking unit, and the FBI named the same group for the Bybit theft in 2025. No government or law enforcement agency has confirmed the attribution, and North Korea denies involvement in crypto thefts.

What was the biggest crypto hack before this one? The $1.5 billion stolen from the Bybit exchange in February 2025. The Binance theft, at about $6.3 billion, is more than four times larger.

Conclusion

The Binance hack is the largest crypto theft in history, and it happened in about twenty minutes, inside the systems of the world’s biggest exchange. It did not need stolen passwords or a leaked master key. It needed a compromised laptop, access to the systems that process withdrawals, and a plan to move billions before anyone could stop it.

For the crypto industry, it is a test. Binance says it can pay for the damage, and so far it says it has covered 90 percent of it. For Pakistan, it is a reminder that the country’s crypto future is being built on platforms it does not yet fully regulate. A No Objection Certificate is not a licence, and no exchange in Pakistan holds a full licence yet. Until that changes, Pakistani users are trusting the exchange itself — its security, its funds and its promises — more than any local safety net.

The full story will only be clear when Binance publishes its post-mortem. Until then, the numbers tell a simple story: $6.3 billion, twenty minutes, and an industry that now has to prove it can keep its users’ money safe.

This article is for general information and education only. It is not legal or financial advice.

Sources

Faizan Altaf

Faizan Altaf is the founder and author of findivoza.com, a news blog covering world, Pakistan, business, technology, health and sport in plain English. He writes for general readers who want clear, trustworthy news without jargon. His work focuses on explaining what happened, why it matters, and what to watch next.

One thought on “Binance hit by $6.3 billion hack — the largest crypto theft in history”

Leave a Reply

Your email address will not be published. Required fields are marked *