Twenty Minutes, $6.3 Billion Gone

Hackers took $6.3 billion from Binance in about twenty minutes — four times the biggest crypto heist before it. The exchange's insurance fund holds $1 billion.

Share this: X · Email · Copy link

6 min read

Twenty minutes is all it took.

On Thursday evening, starting around 8 PM London time, hackers drained about $6.36 billion from wallets belonging to Binance, the world’s largest crypto exchange. The money moved across ten different blockchains, and most of it moved in roughly twenty minutes. It is the biggest theft in crypto history — about four times the previous record, the $1.5 billion taken from the exchange Bybit in February 2025.

By Friday, about $3 billion of the stolen money had been frozen. What happened to the rest tells you something important about how crypto actually works.

About half of the frozen money is in stablecoins — tokens like Tether’s and Circle’s that are designed to hold a steady dollar value. Stablecoins have an off switch. The companies that issue them can freeze tokens at an address when law enforcement asks, and this week Tether, Circle, and Ripple did exactly that. Much of the unfrozen remainder — an estimated $2.4 billion in bitcoin and ether — cannot be switched off. Bitcoin has no head office. Ether has no customer service line. Once those coins move to wallets the thieves control, they are, for practical purposes, gone.

The market noticed, but it did not panic. Bitcoin fell 3% to about $76,470, a six-week low. Ether fell more than 3% to about $2,186. A $6.3 billion theft at the industry’s biggest exchange produced a bad day, not a collapse. Hold that thought. It is either a sign of maturity or a sign that traders have decided the loss lands on one company’s balance sheet, not on the system.

Which raises the only question that matters for Binance’s customers: who pays?

Binance co-founder Yi He said the company will cover all losses from the hack. The money is supposed to come from two places: Binance’s user-protection fund — the Secure Asset Fund for Users, or SAFU — and the company’s own resources. Here is the arithmetic problem. The SAFU fund holds $1 billion. The theft was $6.36 billion. The fund covers about sixteen cents of every dollar taken, and the rest depends on Binance itself — its profits, its reserves, its word.

The honest counterweight: Binance can probably afford its word. It is the largest exchange in an industry that prints fees, and a co-founder said afterward that annual revenue covers the gap, with no need to sell assets like the company’s SpaceX shares. Bybit, the previous record holder, covered its $1.5 billion hole in 2025 and is still in business. Exchanges have survived this before.

But notice what “covered” means. Your balance on an exchange is not money in a vault with your name on it. It is a claim on a company — a promise that the company will hand your coins back when you ask. On Thursday night, that promise got a $6.3 billion test, and the only thing standing behind it is the company’s own finances. A bank deposit comes with government insurance and a regulator. An exchange balance comes with a protection fund that, this week, held one dollar for every six that walked out the door.

As for who did it: the blockchain analysis firm TRM Labs attributes the theft with high confidence to TraderTraitor, a North Korean state hacking unit. Binance has not confirmed the attackers, and North Korea routinely denies carrying out such attacks. If the attribution holds, the geopolitical angle is real — a sanctioned state treating crypto exchanges as a revenue line — but for now it is an attribution, not a finding.

Winners

• The stablecoin freeze button. Whatever you think of issuers holding an off switch, it stopped about $3 billion from disappearing. Centralization has its uses, and Thursday was one of them.
• Self-custody hardware makers. Every exchange hack is an advertisement for holding your own keys. This was the biggest advertisement yet.
• Bybit, relatively. Its 2025 theft held the record for twenty months. It now looks like the smaller problem — and proof an exchange can fill a hole that big and stay in business.

Losers

• Binance’s protection-fund math. A $1 billion fund behind the world’s largest exchange was a marketing number until this week. Now it is a measured one, and it measures short.
• Anyone who believed size was safety. Binance is the biggest exchange in crypto. The theft was sized accordingly.
• Bitcoin and ether holders who own neither exchange nor stolen coins. They still paid: down 3% for holding an asset near someone else’s crime scene.

The two biggest crypto exchange heists

Source: Reuters, October 30, 2026.

⚡ Spark Takeaway

On an exchange, your balance is a promise, and a promise is only as good as the balance sheet behind it. Binance’s promise is probably good. Thursday night showed everyone exactly what it rests on.

Update, October 30: Co-CEO Richard Teng said Binance’s early investigation points to a compromised engineer’s laptop, which let the attacker reach an internal service and submit unauthorized withdrawals; the company says it has found no evidence of a private-key leak. Binance has set aside more than $6.34 billion to cover losses, aims to restart withdrawals before Sunday, November 1, and promises an updated proof of reserves by Monday, November 2. The FBI is investigating; Binance has not confirmed the North Korea attribution.

Update, November 2: Binance delivered on both promises it made on October 30, with a caveat on timing. Withdrawals resumed Sunday, November 1, in a phased rollout covering 15 networks — not before Sunday as targeted — with $4.649 billion withdrawn against $1.01 billion deposited in the first window, a net outflow of about $3.64 billion. On Monday, Binance published its updated proof of reserves, a zero-knowledge proof covering ten tokens at at least 1:1, with about 95% of the stolen assets covered and the remaining roughly 5%, in less-liquid tokens, still being sourced.

Sources: Reuters reporting, October 30, 2026 — the account of the breach, the TRM Labs attribution report, and the analyst and market reaction roundup.

KEEP READING

The NBA Is Turning Predictions Into a Business — the other big platforms story of the week: who holds the money, and who sets the rules, when trading moves to new venues.

The Spark Board — bitcoin is a standing figure on the Board; this is the week it moved on someone else’s bad news.