Tech • AI • Robotics • Game
Why Crypto Exchanges Keep Getting Hacked
8/10TL;DR
Binance says $6.3 billion was drained from its hot wallets on October 29, 2026, in what could be the largest crypto theft on record, reviving longstanding concerns about exchange security, key control and human-targeted attacks.
KEY POINTS
A record-scale breach
Binance, the world’s largest crypto exchange, said attackers compromised its hot wallets at about 8:05 p.m. UTC on October 29, 2026. The exchange put losses at about $6.3 billion across USDC, USDT, Bitcoin, Ether and BNB. TRM Labs and reporting cited by the BBC indicated most of the funds were moved in roughly 20 minutes, making it one of the fastest and largest digital asset heists ever recorded.
What Binance has confirmed
Binance initially pointed to a compromised engineer’s laptop, then said investigators had identified additional breach points. The company said it found no evidence that wallet private keys leaked, suggesting the incident may not have been a straightforward key theft. Co-chief executive Richard Teng said the attacker abused EIP-7702 delegation, allowing transfers to bypass normal approval controls, and used a self-destruct mechanism to erase traces.
Recovery and customer protection
The exchange said it would absorb the financial impact and that user balances would not bear the loss. SAFU and company funds reportedly total more than $6.34 billion, with about $5 billion already held in the same tokens that were stolen. On-chain freezes have already captured a large share of the haul, including about $971 million frozen by Tether and $823 million by Circle, while CZ said about $3 billion had been frozen overall.
Operational fallout
Withdrawals were paused while deposits remained open. In an update issued on October 30, Binance said it was targeting a phased restoration of withdrawals within about 34 hours and planned to publish proof-of-reserves results by November 2. The U.S. Secret Service and the FBI are involved in the investigation.
Analysts suspect state-backed involvement
Blockchain investigators said an operator wallet tied to the theft had been funded roughly 36 hours before the attack, indicating planning rather than an opportunistic breach. Some outside analysts assessed with high confidence that North Korea was responsible, consistent with previous major crypto thefts, though Binance has not confirmed that attribution. North Korea has repeatedly denied involvement in such operations.
Why these attacks keep happening
The crypto sector’s recurring weak points are well known: hot wallets connected to the internet, stolen private keys, social engineering, and flaws in bridges or smart contracts. In practice, many of the biggest losses have come from combinations of those risks. Even where blockchains themselves remain intact, attackers routinely exploit the systems and people surrounding them.
A history of repeated failures
The pattern stretches back to Mt. Gox, where a 2011 compromise triggered a flash crash and a broader collapse that culminated in 2014 with about 850,000 Bitcoin missing, worth about $473 million at the time. In 2016, Bitfinex lost 119,754 Bitcoin, later linked to one of the largest U.S. financial seizures. In 2018, Coincheck lost about $530 million in NEM after malware on an employee computer exposed a key.
Binance has been hit before
In 2019, Binance lost 7,000 Bitcoin, then worth about $40 million, after attackers obtained user API keys and two-factor authentication codes through phishing and malware. The exchange covered that loss through SAFU and resumed operations after about a week. The latest incident is vastly larger, turning what was once a major breach into a historical footnote.
The biggest modern heists broadened the threat
In 2021, Poly Network lost $610 million through a smart-contract flaw before the attacker returned the funds. In 2022, Wormhole lost more than $320 million, Ronin lost about $620 million, and more than $400 million vanished from FTX wallets on the night of its bankruptcy filing. In 2025, Bybit lost about $1.5 billion, showing that even cold-wallet setups can fail if transaction signers are deceived.
Not every crypto disaster is a hack
Major losses have also come from alleged frauds and failed operations. Prosecutors have linked BitConnect to an alleged $2.4 billion scheme, while OneCoin was described by U.S. authorities as taking in more than $4 billion from over 3.5 million victims. For customers, the practical result is the same whether funds vanish through a technical exploit or a deceptive business model.
CONCLUSION
The Binance theft underscores a hard lesson repeated across 15 years of crypto history: the greatest vulnerability is often not the blockchain itself, but the people, software and operational controls built around it. Whether users are truly insulated this time will depend on how much of the frozen money can be secured and how quickly Binance restores normal operations.
Ask a question