Binance Hack: $6.3bn Stolen in the Largest Crypto Theft, and What It Means for UK Users

What happened at Binance

Binance says its hot wallets were compromised at about 20:05 UTC on 29 October 2026, resulting in a loss of approximately $6.3 billion of token assets. Hot wallets are the online wallets an exchange uses to process customer withdrawals.

TRM Labs estimates the theft at about $6.36 billion at the price of each asset when it was taken, and about $6.23 billion at prices on 30 October. Chainalysis puts the figure at about $6.4 billion and Elliptic at $6.43 billion. TRM Labs says most of the funds moved in about 20 minutes from 20:05 UTC, with a second wave around 23:05 UTC.

Assets were taken from Ethereum, Bitcoin, Tron, the XRP Ledger, Solana and several other blockchains; Ethereum accounted for about $3.79 billion and Bitcoin for 18,270 BTC worth about $1.47 billion. Elliptic says four assets, USDT on Ethereum, Bitcoin, USDC and USDT on Tron, made up 74% of the theft.

Source: Binance, TRM Labs, Chainalysis and Elliptic incident reports

Source: TRM Labs, figures as of 00:30 UTC on 30 October 2026

How the attackers got in

Binance's first update on 30 October said the breach may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container. Binance's second update, signed by co-chief executives Yi He and Richard Teng, says the investigation has found additional points of breach. Binance says it has found no evidence that wallet private keys were leaked.

TRM Labs assesses the cause as a compromise of Binance's hot wallet signing infrastructure and notes that Binance has yet to publish a root cause. TRM Labs says one transaction on Ethereum carried 50 pre-signed authorisations that turned a Binance hot wallet into a contract controlled by the attacker, using an Ethereum feature known as EIP-7702.

Chainalysis describes an operational wallet funded through Tornado Cash that submitted valid signed authorisations, while wallets on other chains sent funds by ordinary signed transfers.

Who is blamed

TRM Labs attributes the attack with high confidence to TraderTraitor, which it describes as North Korea's elite hacking unit. Chainalysis attributes the hack to TraderTraitor, a North Korean cybercrime group, citing on-chain links to funds from an earlier theft at the exchange Bitget. Elliptic assesses North Korea's TraderTraitor group as the probable perpetrator.

These are assessments by private blockchain analytics firms. Elliptic stated on 31 October that no government or law enforcement agency had confirmed attribution. Binance has not named a suspect in its updates.

In February 2025 the FBI publicly attributed the $1.5 billion theft from the exchange Bybit to North Korea, naming the activity TraderTraitor, and asked exchanges and other crypto services to block addresses used to launder the proceeds.

Source: Binance; TRM Labs; FBI

Frozen funds and who pays

Binance says approximately $3 billion has been frozen on-chain. TRM Labs counts about $2.7 billion frozen by 00:30 UTC on 30 October, led by about 1.77 billion USDT frozen by Tether and about $825 million USDC frozen by Circle in coordination with law enforcement. Elliptic counts $2.85 billion frozen or seized, 44% of the theft, and says stablecoins make up 94% of the frozen funds. Elliptic says around $3.21 billion of the stolen assets are of a type an issuer cannot freeze, such as Bitcoin and Ether. TRM Labs says the attacker still held more than 420,000 ETH and 18,270 BTC, about $2.4 billion.

Binance says it will absorb the financial impact of the stolen funds, not its users, through its SAFU fund and company funds. Binance says it has set aside more than $6.34 billion, including $5 billion held in the same tokens that were stolen, about 80% of the amount affected. Binance's SAFU fund held crypto assets worth about $1 billion as of February 2026, according to Binance. Binance says it will run a Proof of Reserves snapshot, with the result due on Monday 2 November 2026.

Source: TRM Labs; Binance Security Incident Update #2; Elliptic

How the theft compares

TRM Labs and Elliptic both describe the Binance theft as more than four times the size of the Bybit theft of February 2025. Chainalysis recorded $2.2 billion stolen in crypto hacks in 2024, of which North Korea took $1.34 billion, or 61%. Chainalysis recorded over $3.4 billion stolen from January to early December 2025, with North Korea taking at least $2.02 billion.

TRM Labs puts hack losses in 2026 to 29 October at $8.7 billion including Binance, with North Korea responsible for $7.4 billion, or 85%. TRM Labs estimates North Korea has stolen about $12.8 billion in crypto across 100 incidents since 2017.

Source: Chainalysis; TRM Labs

Binance's UK status and what protection applies

The FCA's consumer warning states that no entity in the Binance Group holds any form of UK authorisation. Binance Markets Limited's permissions were cancelled in June 2023, and the FCA says it is no longer authorised. Binance stopped accepting new UK users from 5pm on 16 October 2023 after its promotions approver withdrew approval; existing UK users kept access.

The FCA says crypto remains largely unregulated and high risk, that people who invest in crypto need to be prepared to lose all their money, and that they are unlikely to have access to the Financial Services Compensation Scheme. The FCA's InvestSmart guidance notes that hackers have successfully stolen from crypto exchanges.

FCA consumer research found 8% of UK adults held cryptoassets in 2025, down from 12% in 2024, and 73% of users bought through a centralised exchange. The Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 bring cryptoasset activities into FCA regulation in full from 25 October 2027, with an FCA application window from 30 September 2026 to 28 February 2027.

Source: FCA; Binance; legislation.gov.uk; HMRC

Safeguards for UK crypto holders

Binance says deposits and unaffected services continue to operate, while withdrawals are suspended until security checks are complete and will restart in phases. Binance publishes its incident updates on its official announcements page.

The FCA warns that recovery room fraudsters approach people who have been scammed or have lost money, claim to work with the government, police or a regulator, and ask for a fee before doing anything. Report Fraud says criminals re-contact fraud victims posing as police, legal professionals or recovery specialists, charge upfront fees and then disappear. Report Fraud recorded £879.8 million lost to investment fraud in 2025, about £2.4 million a day, from 34,673 reports.

Suspicious emails can be forwarded to report@phishing.gov.uk and suspicious texts to 7726; money lost to fraud is reported to Report Fraud online or on 0300 123 2040. HMRC's Cryptoassets Manual states that theft is not a disposal, because the owner keeps the right to recover the asset, so victims of theft cannot claim a loss for Capital Gains Tax. The manual sets out negligible value claims as a separate route, which treat tokens as sold and bought back at a stated value and produce a loss that is reported to HMRC.

Source: GOV.UK; Report Fraud; FCA

Frequently asked questions

How much was stolen from Binance?

Binance says approximately $6.3 billion of token assets was lost when hot wallets were compromised at about 20:05 UTC on 29 October 2026. TRM Labs estimates $6.36 billion, Chainalysis about $6.4 billion and Elliptic $6.43 billion.

Will Binance customers lose money?

Binance says it will absorb the financial impact through its SAFU fund and company funds, not its users, and has set aside more than $6.34 billion. Withdrawals are suspended and will restart in phases after security checks.

Who carried out the Binance hack?

TRM Labs, Chainalysis and Elliptic link the attack to TraderTraitor, a North Korean hacking group. These are private firms' assessments; Elliptic said on 31 October that no government or law enforcement agency had confirmed attribution.

Are UK Binance users covered by the FSCS?

The FCA states that no Binance company holds any form of UK authorisation, and its guidance says crypto investors are unlikely to have access to the Financial Services Compensation Scheme.

Can stolen crypto be claimed as a loss for tax?

HMRC's Cryptoassets Manual says theft is not a disposal, so victims of theft cannot claim a Capital Gains Tax loss. A negligible value claim is a separate route set out in the same manual.