Binance, one of the world's largest cryptocurrency platforms, was the target of a cyberattack of historic proportions on October 29, 2026. Estimates from TRM Labs indicate that approximately $6.36 billion in digital assets was moved illicitly, in an operation that hit the exchange's wallets across different blockchain networks. The incident is among the largest attacks ever recorded in the cryptocurrency world.
How the attack happened
Investigations indicate that the criminals managed to compromise internal mechanisms used to sign and authorize transactions from Binance's wallets. On Bitcoin, approximately 18,270 BTC were transferred to addresses controlled by the attackers, equivalent to about $1.47 billion at the time. On other networks, previously prepared authorizations were used, along with mechanisms capable of facilitating the movement of the assets.
The operation drew attention for its complexity and speed. The funds were spread across different addresses and networks, making them harder to trace. Elliptic's investigation also pointed to signs that equipment and systems used in the company's internal security processes had been compromised.
One of the hypotheses raised was the use of artificial intelligence to help the criminals. However, so far there is no public evidence confirming that AI was used in this attack. The sophistication of the operation, by itself, is not enough to prove such involvement.
On October 31, the FBI officially attributed the action to the group TraderTraitor, associated with the North Korean government. The conclusion reinforces suspicions raised by blockchain analysis firms, which identified similarities with previous operations attributed to North Korean hackers.
Billions frozen and Binance's response
The reaction of companies and organizations responsible for different networks helped contain part of the loss. Stablecoin issuers such as Tether and Circle froze billions of dollars in assets identified during tracing. Elliptic estimated that approximately $2.85 billion had been frozen or seized as of its latest update. That amount, however, does not represent full recovery of the stolen funds.
Given the scale of the incident, Binance announced it would use its own funds to restore the affected amounts. In an update published on October 31, the company said it had set aside more than $6.34 billion and had already replenished approximately 90% of the impacted amount. According to the exchange, the main assets, including Bitcoin, Ethereum, USDT, BNB and USDC, were fully covered.
It is important to clarify that the replenishment announced by Binance does not mean that 90% of the stolen coins were found or recovered from the criminals. It is the financial coverage provided by the company itself to preserve customers' balances. The exchange said it intends to acquire the remaining assets, made up mainly of less liquid tokens.
The case leaves an important warning for the entire market: even giant companies with large security structures can be vulnerable to highly sophisticated attacks. The combination of social engineering, compromise of internal systems and advanced techniques for moving funds shows that digital security needs to keep evolving.
More than the billion-dollar amount involved, the attack on Binance represents a worrying milestone in the history of cybersecurity. Investigations may still reveal new details, but one lesson is already clear: in the world of digital assets, protecting the technology is as important as protecting the funds themselves.
Sources: Binance — official update on the replenishment of assets; investigations and analyses by TRM Labs and Elliptic; FBI statement and Reuters coverage.
