The Binance hack: how $6.3bn got past the stablecoin freezes

The Binance hack of 29 October 2026 is the largest crypto theft on record: about $6.3bn drained from the exchange’s hot wallets, of which roughly $3bn has been frozen. Nearly everything that was frozen was stablecoins, because their issuers can blacklist an address. Bitcoin and ether can’t be frozen by anyone. So after the breach, the attacker raced to turn stolen stablecoins into ether, partly by selling on decentralized exchanges and partly by posting the stolen USDT as collateral on Aave and borrowing ether against it, a loan they never meant to repay.

How was Binance hacked?

On 29 October Binance flagged a “potential security issue” and paused withdrawals. Within hours, on-chain investigators were tracing billions out of its hot wallets, the online wallets an exchange uses to process everyday withdrawals.

Binance’s first explanation was short. Its initial investigation pointed to a compromised DevOps engineer’s laptop, which gave the attacker access to a service container. From there the attacker submitted withdrawal transactions that the system treated as legitimate. Binance said it found no evidence that any wallet private key had leaked. Co-CEO Richard Teng has since said the investigation found additional points of breach and that the attacker didn’t simply ride one engineer’s permissions. That’s one of the questions the postmortem needs to settle.

The preparation started earlier. TRM Labs says the attacker funded an operational wallet with small Tornado Cash withdrawals at least 36 hours before the theft and tested malicious code on three wallets. On Ethereum, the attacker used EIP-7702, a feature that lets an ordinary wallet run contract code, to turn a Binance hot wallet into a sweeper: anything deposited into it was forwarded straight out. They prepared 50 pre-signed authorizations so that at least one would still be valid when needed. Elliptic says the sweeper kept catching new deposits after the first drain. TRM says coordinated transfers on nine other blockchains point to a compromise of Binance’s wider hot-wallet signing setup, not a single wallet.

Who was behind the Binance hack?

Chainalysis, Elliptic and TRM Labs all attribute the attack to North Korean groups. TRM ties it to the same group behind the $1.5bn Bybit theft in February 2025. Binance itself hasn’t named an attacker.

Why could only some of the money be frozen?

To see why the laundering went the way it did, you need one distinction.

Freezable assets are tokens with an issuer who can blacklist an address. USDC (Circle), USDT (Tether), RLUSD (Ripple) and USD1 (World Liberty Financial) all work this way. They’re dollars on a blockchain, and the company behind them can stop a given address from ever moving them again.

Unfreezable assets have no one in charge. Bitcoin and ether move if you hold the key. Nobody can reverse or block a transfer, even after an obvious theft.

The freezes came from exactly where you’d expect:

That’s most of the roughly $3bn now frozen. The bitcoin, about 18,270 BTC spread across 19 addresses, is out of reach.

The race against the freeze

Once the funds left Binance, the attacker held a mix of both kinds. The bitcoin and ether were safe. The stablecoins had a clock on them: the time it takes Tether and Circle to confirm the addresses and blacklist them, which turned out to be hours, not days.

So the attacker had one goal. Convert as many stablecoins as possible into ether before the freeze landed.

Option one: sell them. The obvious move is to swap USDT for ETH on a decentralized exchange like Uniswap. The attacker did this at scale. In roughly 20 minutes they turned $325m of stablecoins into $285m of ether, a 12% haircut. Some trades filled as much as 26% below market. Automated market makers price each trade off the pool’s remaining balance, so a $100m sell order moves the price hard against you. At billions, selling through DEXs bleeds money and takes too long.

Option two: borrow against them. This is the move that matters.

How did the hacker use Aave to dodge the freeze?

Lending protocols like Aave let anyone deposit one asset and borrow another against it. No account, no name, no credit check. If the collateral’s value drops below a set line, the protocol sells it to repay the loan. That’s liquidation.

Here’s what one attacker wallet did on 29 October, per Decrypt’s on-chain breakdown:

1. Between 20:57 and 21:01 UTC it deposited $10m, then $50m, in stolen USDT into Aave. Total collateral: $59.9m.
2. It borrowed 3,271 ETH ($7.43m), then 16,491 ETH ($37.47m). Total: 19,762 ETH, about $44.9m.
3. It left with the ether and never repaid.

Look at what each side holds afterward. Aave holds $59.9m of USDT that’s about to be frozen and can’t be moved. The attacker holds $44.9m of ether that nobody can freeze. The attacker gave up about 25 cents on the dollar, roughly what the worst DEX trades cost. The difference is that the loan takes a handful of transactions, with no pool to drain and no price impact.

Liquidation doesn’t hurt the attacker, because the collateral was never theirs. As of Elliptic’s latest update the position was still open and close to liquidation.

Put simply, the attacker hands the protocol collateral that’s stolen and about to be frozen, and borrows an asset nobody can freeze. The protocol works as designed. It just can’t tell clean dollars from stolen ones.

Aave froze its Ethereum V3 markets shortly afterward to block new deposits and borrowing, then unfroze all V3 and V4 markets on Friday 31 October. It says its contracts weren’t affected and user positions remain fully collateralized. Kamino on Solana paused one market as a precaution.

Why did the attacker still lose half?

By hacker standards this was a messy cash-out. About $3bn of the $6.3bn ended up frozen. Stablecoins that sat still a few hours too long are gone for good, from the attacker’s side.

Speed was the problem. A loan converts tens of millions at a time, but every wallet, deposit and borrow is a separate set of transactions, and the issuers were working in parallel. Faster, fully automated laundering across hundreds of fresh wallets would have saved more. That’s the uncomfortable forecast for the next one: automation helps the attacker convert faster, though it should also help issuers freeze faster.

What the postmortem still needs to answer

Binance has promised a detailed technical postmortem once its investigation is complete. These are the open questions we’ll check it against:

• The entry point. Was it one compromised laptop, as the first statement said, or several breach points, as Richard Teng later suggested?
• The signing setup. How did access to a service container turn into valid withdrawals across Ethereum and nine other chains without a private key leak?
• The final number. Investigators’ estimates range from $5.5bn to $6.3bn. What’s Binance’s own audited figure?
• The frozen total. Tether’s own count and on-chain trackers don’t agree. How much is actually frozen, and how much of it can be returned?
• The fixes. What has Binance changed in its hot-wallet and access controls?

What the Binance hack means if you hold crypto

An exchange balance is a claim on the exchange. Your balance on Binance is an IOU, not coins in your name. Binance says it will cover all losses from its $1bn SAFU fund and its own balance sheet, and The Block reports it’s buying about $1.3bn of assets through market and OTC channels to close the gap. Binance can absorb a $3bn hole. Most exchanges couldn’t, and a hit this size would have meant a run on deposits.

Stablecoins cut both ways. The freeze feature that saved half the money here is the same feature that lets an issuer block your address. Holding stablecoins means trusting the issuer’s judgment about which addresses deserve freezing. We covered how US stablecoins are reshaping global money rails in Why the dollar stays the reserve currency.

Bitcoin and ether are bearer assets. That’s the point of them, and it’s why a thief wants them. There’s no recovery desk for a mistaken or stolen transfer.

DeFi lending doubles as a laundering tool. Any protocol that accepts stablecoin collateral can be used this way within minutes of a theft. Expect lending venues to add emergency pauses on freezable collateral, and expect issuers and protocols to coordinate faster.

Our take

The way in, a compromised laptop leading to unauthorized withdrawals, is an old story. What’s new is how openly the cash-out showed the split inside crypto. Half the industry runs on assets a company can stop. The other half runs on assets nobody can. As long as the two trade freely against each other, every large theft becomes a race between the attacker’s conversion speed and the issuers’ freeze speed, and lending protocols sit right in the middle.

If you hold meaningful amounts, know which kind of asset you hold, who can freeze it, and whose balance sheet stands behind it when something goes wrong.

Common questions

See Velora first on GoogleAdd us as a preferred source and our research shows up higher in your Top Stories.

Update log

• 1 November 2026: First published. Based on Binance’s initial statement and third-party on-chain analysis. Official postmortem pending.

Sources

• The Block, “Inside the largest crypto hack on record”, 30 Oct 2026: https://www.theblock.co/news/business/2026-10-30-binance-hack-largest-crypto-hack-north-korea-432225
• Decrypt, “Binance Hacker Hunts for Exit Ramps as DeFi Exchanges Pause Markets”, 29 Oct 2026: https://decrypt.co/382194/binance-hack-exit-ramps-defi-exchange-ethereum
• CNBC, “$6.3 billion Binance hack is largest crypto theft on record”, 29 Oct 2026: https://www.cnbc.com/2026/10/29/circle-tether-freeze-funds-impacted-by-potential-binance-security-issue.html
• Forbes, “Binance’s $6.3 Billion Hack Started With One Engineer’s Laptop”, 30 Oct 2026: https://www.forbes.com/sites/digital-assets/2026/10/30/binances-63-billion-hack-started-with-one-engineers-laptop/
• CryptoTicker, Tether freeze figures and the discrepancy: https://cryptoticker.io/en/tether-freeze-usdt-binance-hack-how-much-frozen/