Key Takeaways
- • Binance estimated the assets stolen in a cyberattack at US$6.3 billion (£4.7 billion), potentially the largest theft of its kind on record, according to The Conversation.
- • Most of the funds were moved out of exchange-controlled wallets across multiple blockchains within about 20 minutes on October 29, 2026.
- • Binance says it has restored 95% of the stolen assets as of November 1, largely using its emergency protection fund and corporate treasury, and has begun reopening withdrawals in phases.
- • Investigators point to North Korea-linked cybercriminals, though attribution remains provisional; the emerging explanation centres on compromised withdrawal-authorisation (signing) systems rather than the underlying blockchains.
- • The incident underscores that blockchain-level security does not guarantee security at centralised exchanges, and highlights custody, counterparty and recovery risks for crypto investors.
Summary
Analytics firms reported on October 29, 2026 that large volumes of crypto-assets had been moved from wallets used by the exchange Binance across multiple blockchain networks, with most of the transfers occurring within roughly 20 minutes. Binance estimated the stolen assets at US$6.3 billion (£4.7 billion), which The Conversation describes as potentially the largest theft of its kind on record. The exchange temporarily suspended deposits and withdrawals and said it would cover losses using its emergency protection fund and corporate resources. According to Binance, around US$3 billion of the affected assets was frozen by October 30, though The Conversation notes that freezing funds is not the same as recovering them.
As of November 1, Binance says it has restored 95% of the stolen assets, though much of this came from exchange-held funds and its corporate treasury rather than from recovery of the original transfers. Withdrawals are being reopened in phases, and the exchange has promised a full incident report once its investigation concludes. Investigators say indicators point to North Korea-linked cybercriminals, but the article cautions that attribution should remain provisional.
The emerging explanation points mainly to a compromise of the systems that authorise withdrawals, known as signing infrastructure, rather than an attack on the underlying blockchains. Binance initially suggested an engineer's laptop had been compromised, but later statements indicated other parts of the system were breached. Binance says it has found no evidence that private keys were leaked. Investigators also observed that authorisations linked to Ethereum's EIP-7702 feature enabled attacker-controlled code to move assets, including funds arriving after the initial compromise; the article stresses this does not by itself establish a flaw in Ethereum's consensus mechanism. The article also notes there is no established evidence that AI agents carried out the hack, despite broader concern about AI-enabled cybercrime.
The Conversation argues the case illustrates the gap between blockchain security and the security of the wider ecosystem, where centralised custody, access controls and transaction approval processes can create single points of failure. Stablecoin issuers were able to freeze tokens under their control, helping limit losses, whereas Bitcoin and Ether generally cannot be frozen by an issuer. For investors, the article highlights custody, cybersecurity, operational and counterparty risks, and warns that crypto holdings do not enjoy deposit insurance or central bank safety nets. It recommends stronger exchange security standards, regulatory focus on actual control and governance, segregation of customer assets, and international coordination among regulators, law enforcement, exchanges and blockchain analytics providers.
As of November 1, Binance says it has restored 95% of the stolen assets, though much of this came from exchange-held funds and its corporate treasury rather than from recovery of the original transfers. Withdrawals are being reopened in phases, and the exchange has promised a full incident report once its investigation concludes. Investigators say indicators point to North Korea-linked cybercriminals, but the article cautions that attribution should remain provisional.
The emerging explanation points mainly to a compromise of the systems that authorise withdrawals, known as signing infrastructure, rather than an attack on the underlying blockchains. Binance initially suggested an engineer's laptop had been compromised, but later statements indicated other parts of the system were breached. Binance says it has found no evidence that private keys were leaked. Investigators also observed that authorisations linked to Ethereum's EIP-7702 feature enabled attacker-controlled code to move assets, including funds arriving after the initial compromise; the article stresses this does not by itself establish a flaw in Ethereum's consensus mechanism. The article also notes there is no established evidence that AI agents carried out the hack, despite broader concern about AI-enabled cybercrime.
The Conversation argues the case illustrates the gap between blockchain security and the security of the wider ecosystem, where centralised custody, access controls and transaction approval processes can create single points of failure. Stablecoin issuers were able to freeze tokens under their control, helping limit losses, whereas Bitcoin and Ether generally cannot be frozen by an issuer. For investors, the article highlights custody, cybersecurity, operational and counterparty risks, and warns that crypto holdings do not enjoy deposit insurance or central bank safety nets. It recommends stronger exchange security standards, regulatory focus on actual control and governance, segregation of customer assets, and international coordination among regulators, law enforcement, exchanges and blockchain analytics providers.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.