Binance froze withdrawals late on the evening of Thursday, October 29, 2026, after spotting unusual movements from its own wallets. Hours later the exchange put a number on it: $6.3 billion in digital assets moved out without authorization, the largest theft in the history of cryptocurrencies.

It took a laptop, an internal service environment, and about twenty minutes.

The previous record, the February 2025 hit on Bybit, was worth roughly $1.5 billion, less than a quarter as much. Binance says customer funds are safe and that it will cover every loss. The question millions of investors would rather not ask is urgent again: how well protected is money left sitting on an exchange?

An engineer’s laptop that emptied the wallets in 20 minutes

The attacker got in through the compromised laptop of a DevOps engineer, according to the company’s initial account. That is the role responsible for developing and managing IT infrastructure. From there the intruder reached a service container, an internal environment from which unauthorized withdrawal requests could be sent. There is so far no evidence that the wallets’ private keys were breached.

Co-CEO Richard Teng said the attacker did not simply exploit one employee’s permissions, and that this was not a “one-click” operation. Later checks turned up additional points of intrusion, still to be pinned down. The full technical report will come only once the investigation closes.

The hunt for the proceeds began at record speed. With help from stablecoin issuers and blockchain analytics firms, roughly $3 billion has been frozen: Tether blocked about $1.56 billion and Circle more than $800 million. Binance has revoked the permissions of the addresses involved and is working with law enforcement to trace the rest.

Is North Korea behind the attack?

Binance has not attributed the hit to any group. Two of the leading blockchain intelligence firms have. TRM Labs traced roughly $6.36 billion moved across 10 blockchains, largely within the space of about twenty minutes, and points to TraderTraitor, a hacking unit backed by the North Korean regime and also known as Lazarus Group or APT38. Chainalysis confirmed that lead with a high degree of confidence.

The name is familiar. It is the same group the FBI blamed for the Bybit theft. Ari Redbord, TRM’s global head of policy, argues that when Pyongyang steals on this scale the proceeds also finance weapons proliferation, turning crypto theft into a global security issue.

These are investigative attributions, not official conclusions by authorities. North Korea has consistently rejected accusations of this kind in the past.

What Binance is, and why the hit has the whole market shaking

Founded in July 2017 by Changpeng Zhao, known to everyone as CZ, Binance is the world’s largest centralized exchange by volume. As of late August it still controlled more than 45% of global spot trading. Users buy, sell, and hold Bitcoin, Ethereum, and hundreds of other cryptocurrencies on the platform, which also offers derivatives trading, staking, and yield products. Since 2023, after CZ’s departure and the $4.3 billion U.S. fine, the company has been run by co-CEOs Richard Teng and Yi He.

Everything turns on one word: centralized. Anyone who leaves crypto on Binance does not control the private keys. Custody, and with it security, sits in the exchange’s hands. That is the difference between an account at a centralized exchange and a personal wallet in self-custody, such as a hardware wallet.

When the giant stumbles, the whole sector pays. The day after the news, Bitcoin lost more than 4%, slipping to around $78,000.

Is the SAFU fund enough to cover $6.3 billion?

The safety net promised to users is called SAFU (Secure Asset Fund for Users), an emergency fund set up in 2018 and financed with a share of trading fees. It has worked once before. In 2019 it fully reimbursed users after the theft of roughly 7,000 Bitcoin, worth about $40 million at the time.

The problem this time is scale. In January 2026, Binance converted the fund from stablecoins to Bitcoin, pledging to top it back up to $1 billion should its value fall below $800 million. CNBC currently puts it at around $1.2 billion. Even assuming the frozen stablecoins are returned, that would cover roughly a third of the remaining losses. The rest will have to come from the company’s own coffers, as Teng confirmed.

Sean Farrell of Fundstrat Global Advisors does not see a threat to the exchange’s solvency. The real gauge will be how quickly withdrawals resume and whether outflows stay orderly. One point bears repeating: SAFU is a corporate commitment, not deposit insurance and not a public guarantee.

What’s at risk for users with funds on Binance (and what changes for Italian users)

No losses have been charged to customers so far, and no balances have been reduced. The concrete risk is temporarily losing access to your money. Co-founder and co-CEO Yi He indicated that withdrawals would resume gradually within 48 hours of her October 30, 2026 update, so roughly by Sunday, November 1, 2026, though without a firm date for a return to full operations.

For Italian users the picture is more delicate. Since July 1, 2026, after failing to obtain in time the European license required under MiCA, the European Union’s bloc-wide crypto regulation, Binance can no longer offer regulated services in Italy or open new accounts. MiCA requires exchanges to be licensed in a member state to serve customers across the EU.

Existing customers are left, in practice, with the ability to log in and move their funds elsewhere. The withdrawal freeze blocks precisely that one remaining way out. Binance is now seeking authorization through France’s AMF, the French markets regulator, but as of late October 2026 the green light has not come.

What to do now

No impulsive moves, but a few precautions are in order:

  • check your balance only through the official app or website;
  • lock down your account, reviewing two-factor authentication, linked devices, and active API keys;
  • be wary of anyone promising refunds: an incident on this scale attracts scammers posing as Binance staff, and passwords, 2FA codes, and recovery phrases should never be shared;
  • plan your transfer, once withdrawals reopen, to a MiCA-authorized exchange or a personal wallet, checking the destination network and address carefully.

For updates, rely only on the platform’s official channels, and ignore private messages and unverified links.

Editor’s note

This article was originally published in Italian on money.it by Emanuele Di Baldo on October 30, 2026 as «Binance hackerato, rubati 6,3 miliardi. Cosa rischia chi ha fondi sull’exchange?». It has been translated and adapted for an international audience by the Money.it International desk.