Key facts
- The DeFi Edge reported $6.3 billion was taken from Binance hot wallets, more than four times Bybit's $1.46 billion.
- Binance said it would absorb the full loss and that users would not lose funds, per The DeFi Edge.
- Elliptic counted $2.85 billion, or 44% of the theft, frozen or seized, per The DeFi Edge.
- Arbitrum's Security Council moved 8,425 ETH and 74.56 million ARB out of the attacker's address, per The DeFi Edge.
- The DeFi Edge said the attacker reached wallet signing systems through a fake job interview and malware.
- Binance disputed a DefiLlama tracker figure on withdrawals that was higher than its own, per The DeFi Edge.
Binance said it would absorb the full loss from a theft of $6.3 billion in assets from its hot wallets, according to the crypto newsletter The DeFi Edge. The transfers began at 20:05 UTC on October 29, 2026, starting with XRP and SOL before moving 18,270 BTC and a quantity of ETH, and the last transfer cleared at 23:56 UTC that day.
The DeFi Edge reported that the FBI attributed the theft to North Korea's TraderTraitor group two days later. Binance said users would not lose funds. The newsletter described the entry route as a fake job interview in September that ended with a take-home assignment carrying malware, plus a tampered Homebrew install on another engineer's laptop in June.
By October 31, 2026, Binance had replenished 98% of the stolen assets from its SAFU fund and company cash, per The DeFi Edge. When withdrawals reopened, users pulled a net $3.64 billion in the first 9.5 hours, which the newsletter put at 2.1% of the exchange's $171 billion in assets. It said DefiLlama's tracker showed a higher figure that Binance disputes.
Elliptic counted $2.85 billion, or 44% of the theft, frozen or seized, almost all in stablecoins. Tether froze 1.567 billion USDT the same night, and Arbitrum's Security Council moved 8,425 ETH and 74.56 million ARB out of the attacker's address by briefly rewriting a system contract, per The DeFi Edge. The newsletter said the attacker deposited 60 million USDT on Aave and borrowed 19,762 WETH, and Aave froze 292 reserves across its markets within hours.