The Binance Heist: When Money Cannot Be Called Back

On the evening of 29 October 2026, Binance, the world’s largest cryptocurrency exchange, suffered the biggest theft in the history of digital assets. Binance estimates the total impact at around $6.3 billion. Blockchain intelligence firm TRM Labs puts the figure at $6.36 billion, valued at the moment each asset left the exchange, and calls it the largest crypto theft on record. The previous record, the roughly $1.5 billion taken from the exchange Bybit in February 2025, has been overtaken about fourfold.

The final number will move as investigators finish their work, and Binance has yet to publish its promised post-mortem. The shape of the event is already clear, however, and it says more about the crypto industry as a whole than about any single company. The feature crypto’s advocates prize most, a payment system that no bank, court or government can stop, is the same feature that made this theft so quick to execute and so hard to undo.

Twenty Minutes, Six Billion Dollars

According to TRM Labs, most of the money moved in about twenty minutes from 20:05 UTC. It left Binance’s “hot wallets”, the internet-connected accounts an exchange keeps funded to process customers’ everyday withdrawals, across ten separate blockchains, including Bitcoin, Ethereum, Tron, Solana and the XRP Ledger. The haul included about 18,270 bitcoin, worth roughly $1.47 billion, and several billion dollars in stablecoins, the digital tokens pegged to the US dollar.

Binance suspended withdrawals, said user funds were “safe” and pledged to cover all losses from its emergency insurance fund and its own company funds. The sum is large but not existential: DefiLlama data cited by CoinDesk put Binance’s holdings at about $144 billion before the attack, making the loss roughly 4 percent. Bitcoin fell about 5 percent to below $77,000, ether fell 5.7 percent and BNB, the token most closely tied to the exchange, dropped 8 percent, according to CoinDesk. At the time of writing withdrawals remained paused, with Binance saying it expected to restore them within 48 hours.

A Human Failure, Not a Mathematical One

The attack did not break the cryptography that protects bitcoin or ether. Binance’s initial investigation points to a compromised laptop belonging to one of its engineers, which it says allowed an attacker to reach part of its internal systems and submit unauthorised withdrawals. The exchange says it has found no evidence that any wallet private key was leaked. TRM’s assessment is that the attacker gained the ability to make Binance’s own signing system approve transactions of the attacker’s choosing.

That distinction matters. The blockchains performed exactly as designed. Every transfer was valid on the system’s own terms and was recorded permanently. The weakness was the one that undermines banks, governments and defence contractors alike: people, their devices and the internal processes that connect them. The Bybit theft followed a similar pattern, with attackers compromising the systems of a third-party wallet provider rather than the blockchain itself. Crypto has not removed human risk from finance. It has removed most of the safety nets that catch human error after the fact.

Finality Cuts Both Ways

In the legacy system, a payment is the start of a process rather than the end of one. Card payments can be charged back. Bank transfers pass through institutions that can query, delay or block them. In the United Kingdom, mandatory reimbursement rules for authorised push payment fraud have applied since October 2024, with a cap of £85,000 per claim, and the Payment Systems Regulator reported that 88 percent of the money lost to such scams was returned to victims in the first year.

A blockchain offers none of this. Once a transaction is confirmed there is no central authority able to reverse it, no call centre, no ombudsman and no court with power over the ledger itself. Advocates call this finality, and for honest users it is a genuine virtue: a seller knows that payment received is payment kept. For a thief it is the perfect getaway. The instructive comparison is the 2016 raid on Bangladesh Bank, in which hackers sent 35 fraudulent payment orders through the SWIFT banking network in an attempt to move close to $1 billion out of the bank’s account at the Federal Reserve Bank of New York. Thirty of those orders were blocked, and the thieves escaped with $81 million. The US Justice Department later charged a North Korean programmer it said belonged to the Lazarus Group. A decade on, attackers that TRM links to the same state apparatus moved billions in minutes, because there was nobody in the middle to say no.

The Irony of the Freeze

The most revealing detail of the Binance heist is which money was recovered. Binance says about $3 billion has been frozen, and most of it came from the parts of the crypto system that are not decentralised at all. Tether froze more than $1.5 billion of its USDT stablecoin and Circle more than $800 million of USDC, according to CoinDesk, while Ripple and World Liberty Financial froze smaller sums of their own dollar tokens. These issuers are companies, and they retain the technical ability to block tokens they have issued. TRM also reports that the council that governs Arbitrum, a network built on top of Ethereum, froze about $30 million.

What could not be frozen was the genuinely decentralised money. By TRM’s count early on 30 October, the attacker still controlled more than 420,000 ether and 18,270 bitcoin, worth about $2.4 billion. No company can freeze bitcoin; that is the point of bitcoin. Bybit’s experience shows how such stories usually end. In March 2025 its chief executive, Ben Zhou, reported that only 3 percent of the stolen funds had been frozen and 20 percent had “gone dark”.

The lesson is uncomfortable for purists. The partial rescue at Binance happened because the industry’s largest dollar tokens behave more like a bank than a blockchain. Washington has drawn the same conclusion. The GENIUS Act, the US stablecoin law passed in 2025, requires permitted issuers to have the technical capability to comply with lawful orders to seize, freeze or block their tokens. Where crypto is becoming mainstream, it is doing so by importing the very controls it was invented to escape.

The State Behind the Keyboard

TRM Labs attributes the attack, with what it calls “high confidence”, to TraderTraitor, a North Korean hacking unit. The FBI attributed the Bybit theft to the same group. Binance has not yet named a culprit. If the attribution holds, the theft is less a corporate loss than a transfer of strategic resources to a sanctioned nuclear state. “When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity,” Ari Redbord, TRM’s global head of policy, told Al Jazeera.

This is the realpolitik case against treating crypto as a neutral technology. A financial system without chokepoints is a financial system in which sanctions are hard to enforce. For a regime cut off from the dollar system, irreversible digital rails are not a curiosity but a revenue line. TRM’s 2026 crypto crime report found that hackers stole $2.87 billion across nearly 150 incidents in 2025. One night at Binance produced more than double that full-year total. In our assessment, Western governments will increasingly treat exchange security as a national security question rather than a consumer protection one, and they will be right to.

What Crypto Does Well

None of this means crypto lacks merit. Its core achievements are real. Blockchains settle around the clock, every day of the year, across borders, without waiting for banks to open or intermediaries to clear. Dollar stablecoins, now a market of roughly $300 billion, give households and businesses in countries with weak currencies or unreliable banks a practical way to hold and move dollars. Cross-border payments remain expensive in the legacy system: the World Bank’s global average cost of sending $200 stood at 6.49 percent in early 2025, more than double the United Nations target of 3 percent by 2030. Digital rails put pressure on those margins. The public ledger is also a forensic asset. Investigators watched the Binance funds move in real time, which is far harder when money travels as cash or through shell companies.

An Addition, Not a Replacement

The sensible conclusion is neither crypto’s triumph nor its demise. Crypto works best as an addition to the legacy financial system rather than a replacement for it. Its speed, openness and reach complement banks; its irreversibility makes it a poor foundation for the savings of ordinary people, who need someone to call when things go wrong. Balances held at an exchange are not insured in the way bank deposits are, and compensation after a hack depends on the exchange’s willingness and ability to pay. Binance can absorb a loss of $6 billion. A smaller exchange could not.

Some academics, including Sean Foley of Macquarie University, suggest the attack may push traders towards decentralised alternatives that do not hold customer funds at all. That would trade one risk for another: no exchange to hack, but no exchange to make anyone whole either. The more likely direction of travel is already visible. The freezable stablecoins that made up most of the recovered funds are regulated and answerable to courts, and the exchanges that endure will look more like banks, with the compliance and controls that implies. In our assessment, the future of the industry lies in being a faster, more open layer built alongside a system that can still say no. The thieves of 29 October have just made the case for that system more persuasively than any regulator could.

Read our full Report Disclaimer.