Table of Contents
Well, this was one way to make Halloween even scarier!
Last week, on October 29, Binance suffered what is now the biggest crypto hack in history, with approximately $6.34 billion worth of crypto stolen in about just half an hour… OUCH!
So, how did hackers pull this off, and what’s the current situation?
Billions stolen but billions frozen
The attack affected Binance wallets across 10 blockchains, including Bitcoin, Ethereum, Solana and Tron, stealing 18,270 BTC, nearly 200,000 ETH and billions in stablecoins.
This made it quite broad, but the crypto ecosystem didn’t just sit back and watch it happen. Tether, Circle, Ripple and other industry players quickly acted and started freezing assets they had issued or could help intercept, accounting for about $2.85 billion of the stolen funds.
As transactions are publicly visible on the blockchain, investigators can follow the money and identify suspicious wallets. So when a centralised issuer has the ability to freeze tokens, it may stop stolen funds from moving further. That’s exactly what happens.
However, the remaining funds are much harder to intercept, as hackers have been moving them through thousands of wallets and more than 40,000 transactions to cover their tracks.
According to blockchain investigators, this massive money-laundering operation could take months, if not years, and there’s no guarantee the money will ever be completely recovered.
How did it happen?
Well, probably not how you think…
Hackers didn’t steal Binance’s private keys, but actually got the systems to approve their fraudulent transactions. How? Huuuh… they tricked some employees from the company into giving them access to its systems (not on purpose of course).
They prepared their coup for quite some time. According to Binance’s initial findings, it started months earlier, in June, when the hackers compromised an engineer’s computer through a malicious software disguised as a legitimate developer tool. The company detected suspicious activity, replaced the device and changed credentials, but the attackers already had a step in.
Then, they went further in September by using fake job interviews and coding assignments, containing malicious software again, to infect another employee’s computer. By October 20, they had managed to use their access to move deeper into Binance’s internal systems.
That was the bingo! On October 29, the attackers exploited this access and managed to get the systems to approve transactions worth billions… Here comes the money!
This approach is a great example of hackers relying on social engineering to gain access and steal funds. And there are signs that can reveal such attempts, which is why companies need to train employees to recognise suspicious requests and keep their devices and software secure.
Who’s behind it?
Sorry, we’re not going to be original here, as all fingers, and even the FBI, point to North Korea once again, attributing the attack to the infamous TraderTraitor hacking group (linked to the Lazarus Group).
As we shared a few weeks ago, the group has also been linked to the $1.5 billion Bybit hack in February 2025, which, by the way, was the previous biggest crypto hack in history. It seems like they appreciate breaking their own records.
The FBI confirmed North Korea’s responsibility on October 31, warning that the stolen assets were being converted mainly into Ethereum, with further laundering expected through decentralised finance (DeFi) services and swap platforms.
And yes, as you can imagine, stolen crypto appears to be a major source of funding for the North Korean regime, as the Cybercrime became a way to generate money while bypassing international sanctions...
What’s the situation now?
Despite the crazy, enormous, gigantic, monstrous (I’ll stop here) damage, Binance has promised to cover all losses using its own resources, through its SAFU emergency fund, which was specifically created to protect users in situations like this.
According to Binance’s November 3 update, 98% of the affected assets had already been replenished as of October 31, with the remaining and harder-to-source assets being purchased. The company also said it had set aside more than enough funds to cover the losses, so users wouldn’t bear the financial impact.
As shared publicly by its Co-CEO, Binance has also rebuilt affected systems, strengthened its security measures, and brought in independent cybersecurity experts.
Binance Co-CEO Richard Teng: “We now are operating, we are protecting every user, and we are extremely thankful for our users’ confidence and trust”
— Binance (@binance) November 3, 2026
Speaking with @DarrenBotelho on @FoxBusiness, Richard explained how Binance is protecting users and replenishing impacted assets,… pic.twitter.com/ivryx12eHl
On the bright side of things, this incident showed once again how quickly the industry can come together when things go south and how important it is for serious companies to be prepared for such situations.
In any case, hackers are getting smarter, but the ecosystem is keeping up!
This is one of the reasons why strict regulations are being implemented, such as MiCA in the European Union, which, among many other things, aims to improve security and protection for the end users.
As of today, Binance still hasn’t obtained its MiCA licence, after withdrawing its application in Greece and announcing plans to pursue authorisation elsewhere in the EU… But Venga did (just saying)!
Hacks Are Not a Crypto Thing
This Binance hack, has taken first place among the biggest crypto heists in history, and by quite a margin. However, if you think hacks are reserved for the crypto industry, you’d be wrong, as the traditional banking system is also a target for hackers.
The International Monetary Fund (IMF) found that almost 20% of reported cyber incidents over the past two decades affected the financial sector, during which banks were the most frequent targets, followed by insurers and asset managers.
And we just got a fresh example this week with Crédit Mutuel Arkéa in France, which confirmed on Wednesday that a cyberattack involving a service provider allowed hackers to access an account belonging to the bank and execute fraudulent transactions. The bank assured that customers were not affected.
According to the bank, the attackers gained control over part of its euro funds, transferred them to external platforms, where they converted the money into crypto assets.
This large movement of funds attracted the attention of ZachXBT (yes, our Crypto Sherlock again), who investigated the transactions over several days and identified Crédit Mutuel Arkéa as the victim of a theft estimated at more than $133 million. Ouch again!
This figure comes from ZachXBT’s own on-chain investigation, which he shared on his Telegram channel. However, the bank has not officially confirmed that exact amount, and even ZachXBT also suspects the final figure is larger once over-the-counter (OTC) trades are counted.
The “fun” fact about this attack (if there can be one) is that the movement and conversion of the funds into crypto allowed them to be noticed and traced by the crypto community, with investigators raising the alarm days before the bank confirmed the incident.
In any case, the increasing number of recent hacks and overall cyberattacks is a global and general issue. It’s not reserved for a specific sector.
Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.