On Thursday, October 29, 2026, hackers broke into Binance's digital wallets and stole about $6.3 billion in cryptocurrency. It is the largest crypto heist ever — roughly four times the previous record, the $1.5 billion Bybit hack of February 2025. Binance suspended withdrawals for more than two days, then resumed them in phases from Sunday, November 1.

I do not use Binance — it does not serve US users, and my own balances are tiny. But this hack is the best free lesson in crypto security available right now, because it shows exactly how money gets stolen at every level: at the exchange, in the laundering that follows, and in the panic afterwards. Here is the process, as reported, and what each step means for someone holding $0.02 or $2,000.

How it happened

Binance said the attack went through an engineer's laptop, which gave the attacker access to a service container — a piece of the exchange's internal machinery — and from there the attacker submitted unauthorized withdrawal transactions. Co-CEO Richard Teng said it was not a "one-click" action but a complex process. Binance also said its investigation found no evidence of any wallet private key leak.

That detail matters. The popular image of a hack is someone guessing a password or stealing a key. This one looks like a compromise of internal systems: one machine, then a container, then withdrawals. The FBI later attributed the theft to TraderTraitor, a North Korean state-sponsored group active since at least 2020. North Korea denied it. Blockchain tracing firms including TRM Labs, Chainalysis and Elliptic independently pointed the same way.

The target was Binance's hot wallet — wallets connected to the internet so an exchange can process withdrawals quickly. A hot wallet is a trade-off by design: fast access for users means fast access for anyone who gets inside.

What happened to the money next

The laundering was as industrial as the theft. Elliptic counted roughly 12,000 wallets across 11 blockchains and more than 40,000 transactions in the first four days — about one new wallet every 25 seconds.

The sequence, as traced:

1. Much of the early movement ran on Tron, spreading across about 7,700 addresses.

2. Funds moved through cross-chain bridges to Ethereum and other networks, including Solana.

3. The attackers rushed to swap stolen stablecoins into assets issuers cannot freeze, like ether. About $786 million in stablecoins was converted before Tether and Circle froze the rest — roughly $1.8 billion frozen within about 40 minutes of the main Ethereum leg.

4. About $2.85 billion, or 44% of the $6.43 billion Elliptic counted, was frozen or seized. Roughly $3.24 billion remained in addresses linked to the theft, mostly in bitcoin and ether.

Two things stand out. First, stablecoins are freezable: USDT and USDC issuers can and do blacklist stolen tokens, which is exactly why the thieves hurried to swap them. Second, the laundering moved more slowly than after the Bybit hack, when the stolen ether was moved within 10 days — this time, the freezing response was faster and the trail is being watched wallet by wallet.

What Binance did — and why it might not save you next time

Binance said it would absorb the losses from company funds, not users: its Secure Assets Fund for Users (about $1 billion in bitcoin), its corporate treasury, and its futures insurance fund. It said about 95% of the stolen amount was covered, with the remaining 5% in less liquid tokens that take longer to source. Withdrawals resumed in phases — 15 currencies including bitcoin, Solana and ether first — and by Sunday morning Binance had processed around $4.6 billion in withdrawals against $1 billion in deposits. Net outflows since reopening were about $4.72 billion, roughly 3% of platform assets.

That is the good version of this story, and it only exists because Binance is huge. A smaller exchange hit this way might not have a billion-dollar reserve fund. "User funds are safe" was true here because the company could pay. It is not a property of exchanges in general — it is a property of this exchange's balance sheet on this occasion.

How you avoid being next

Most of this hack was not aimed at individual users. But every step of it maps to a habit that protects your own money:

1. Exchanges are for trading, not storage. A hot wallet is online by definition. Keep on an exchange only what you are actively using. Everything else belongs in a wallet you control. If an exchange is hacked, only what is sitting there is at risk.

2. Self-custody scales with amount. Small balances: a reputable mobile wallet with a seed phrase you wrote down on paper. Anything you would hate to lose: a hardware wallet. The seed phrase never gets photographed, emailed, or typed into any website — anyone who has it has your money, no hacking required.

3. Lock down withdrawals before you need to. Turn on withdrawal allowlisting (address book only) wherever it exists, and use an authenticator app or hardware key for two-factor authentication, not SMS. Test any new address with a tiny amount first. A wrong-network send is your loss, not the platform's — the same rule I wrote about in my cash-out piece.

4. Verify, don't click. The most common way small holders actually lose money is not an exchange hack — it is phishing: fake support accounts, fake "security alert" emails, and links in DMs. Bookmark the real site. No legitimate support agent will ever ask for your seed phrase or ask you to "validate" a wallet.

5. Know that stablecoins can be frozen. USDT and USDC issuers froze about $1.8 billion of the Binance loot in under an hour. That is a feature when the coins are stolen and a risk when they are yours: your stablecoins exist at the issuer's discretion. Holding everything in one stablecoin on one chain is a single point of failure.

6. During an incident, don't panic into a mistake. After the hack, Binance users rushed to withdraw — $4.6 billion in a morning. Panic withdrawals are when people paste the wrong address, pick the wrong network, or fall for fake "recovery" sites. Check the exchange's official announcements, wait for phased reopening, and move once, carefully.

The zero-capital version of this lesson

My Publish0x balance is $0.02. Nobody is hacking me for it. But the habits are free and they scale: I keep tiny balances where they are earned, I will move them to my own wallet only when the fees make sense, and I am setting up allowlists and hardware two-factor now, while the stakes are small — not later, when a mistake would cost real money.

The Binance hack is a reminder that in crypto, custody is the whole game. The exchange held the keys, so the exchange's security was the users' security. The day you hold your own keys, your security is yours. That is both the risk and the point.