{"id":155138,"date":"2026-10-30T13:33:10","date_gmt":"2026-10-30T13:33:10","guid":{"rendered":"https:\/\/dogewisperer.com\/?p=155138"},"modified":"2026-10-30T13:33:10","modified_gmt":"2026-10-30T13:33:10","slug":"binance-loses-6-3bn-in-largest-crypto-theft-ever-as-tether-and-circle-freeze-2-6bn-what-we-know-about-binance-hack","status":"publish","type":"post","link":"https:\/\/dogewisperer.com\/?p=155138","title":{"rendered":"Binance Loses $6.3Bn in Largest Crypto Theft Ever as Tether and Circle Freeze $2.6Bn: What We Know About Binance Hack"},"content":{"rendered":"<div>\n<p>Hackers took about $6.36 billion from Binance\u2019s hot wallets on ten blockchains on Thursday, October 29, in the largest crypto theft on record, a Binance hack the exchange says began with an engineer\u2019s compromised laptop.<br \/>\nMost of it was gone in about 20 minutes. Tether and Circle froze about $2.6 billion of stolen stablecoins within an hour, and Binance now puts the verified frozen total at around $3 billion. The exchange has promised to cover every loss and paused withdrawals, which it expects to reopen by Sunday.<\/p>\n<p>The market didn\u2019t wait. BNB fell 8.7% in an hour, Bitcoin slid below $77,000, and about $1.5 billion in leveraged positions were wiped out. So what exactly happened, how much is really gone, and where does BNB go from here?<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Breaking: The hackers behind the $6B <a href=\"https:\/\/x.com\/hashtag\/Binance?src=hash&amp;ref_src=twsrc%5Etfw\" rel=\"nofollow\" target=\"_blank\">#Binance<\/a> hack, $1.5B <a href=\"https:\/\/x.com\/hashtag\/Bybit?src=hash&amp;ref_src=twsrc%5Etfw\" rel=\"nofollow\" target=\"_blank\">#Bybit<\/a> hack, and $388M <a href=\"https:\/\/x.com\/hashtag\/Bitget?src=hash&amp;ref_src=twsrc%5Etfw\" rel=\"nofollow\" target=\"_blank\">#Bitget<\/a> hack may all be linked to North Korea&#8217;s Lazarus Group.<a href=\"https:\/\/t.co\/4IESZvOjHJ\" rel=\"nofollow\" target=\"_blank\">https:\/\/t.co\/4IESZvOjHJ<\/a><\/p>\n<p>\u2014 Lookonchain (@lookonchain) <a href=\"https:\/\/x.com\/lookonchain\/status\/2116071971054334398?ref_src=twsrc%5Etfw\" rel=\"nofollow\" target=\"_blank\">October 30, 2026<\/a><\/p>\n<\/blockquote>\n<h2>What Happened in the Binance Hack?<\/h2>\n<p>An attacker got Binance\u2019s own systems to sign withdrawals out of its hot wallets, the online wallets an exchange uses to pay out customers. <a href=\"https:\/\/x.com\/binance\/status\/2115993361517891592\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Binance said on Friday<\/a> that its first findings point to a DevOps engineer\u2019s compromised laptop, which let the attacker reach a service container and send unauthorized withdrawal transactions. It found \u201cno evidence of any wallet private key leak.\u201d<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Binance&#8217;s initial investigation suggests that the security incident may involve a compromised DevOps engineer\u2019s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private\u2026 <a href=\"https:\/\/t.co\/5REncAI77y\" rel=\"nofollow\" target=\"_blank\">pic.twitter.com\/5REncAI77y<\/a><\/p>\n<p>\u2014 Binance (@binance) <a href=\"https:\/\/x.com\/binance\/status\/2115993361517891592?ref_src=twsrc%5Etfw\" rel=\"nofollow\" target=\"_blank\">October 30, 2026<\/a><\/p>\n<\/blockquote>\n<p>The heist had been staged for more than a day. <a href=\"https:\/\/www.trmlabs.com\/resources\/blog\/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history\" target=\"_blank\" rel=\"noopener nofollow\">TRM Labs\u2019 reconstruction<\/a> lays out the timeline (times in UTC):<\/p>\n<ul>\n<li><strong>October 28, morning:<\/strong> the attacker\u2019s operator wallet is funded with three small withdrawals from the Tornado Cash mixer.<\/li>\n<li><strong>October 29, earlier in the day:<\/strong> the attack code is tested on two wallets, rehearsed on a third, then installed on a Binance hot wallet about four hours later.<\/li>\n<li><strong>20:05\u201320:09:<\/strong> five Binance XRP Ledger wallets send 233.46 million XRP to a single address.<\/li>\n<li><strong>20:20:<\/strong> a Binance Bitcoin hot wallet sends 18,270 BTC, and a Tron wallet follows with 612.7 million USDT within two minutes.<\/li>\n<li><strong>20:23:<\/strong> the main Ethereum hot wallet empties: 167,464 ETH and 1.615 billion USDT.<\/li>\n<li><strong>21:29:<\/strong> Binance posts that it is investigating \u201ca potential security issue.\u201d<\/li>\n<li><strong>23:05:<\/strong> a second wave hits Binance wallets on Avalanche and Polygon.<\/li>\n<\/ul>\n<p>On Ethereum, the attacker used EIP-7702, a feature added in the May 2025 Pectra upgrade that lets a normal wallet hand its controls to a smart contract. The hot wallet signed 50 such handovers to a \u201csweeper\u201d contract, so new deposits kept getting drained for hours: TRM counted six more sweeps between 20:41 and 23:56.<\/p>\n<p>TRM attributes the attack \u201cwith high confidence\u201d to TraderTraitor, the North Korean unit the FBI blamed for the $1.5 billion Bybit hack in February 2025. Binance hasn\u2019t named anyone.<\/p>\n<h2>How Much Was Stolen, and How Much Did Tether and Circle Freeze?<\/h2>\n<p>About $6.36 billion left Binance, and roughly $2.7 billion of it is frozen. That is TRM\u2019s count at 00:30 UTC on Friday, valued at prices at the time of each transfer. Binance\u2019s own figure is \u201caround $6.3B\u201d stolen and <a class=\"general-link\" href=\"https:\/\/x.com\/binance\/status\/2115970069696217576\" target=\"_blank\" rel=\"noopener nofollow\">around $3 billion verified frozen<\/a>, and it says that number may still rise.<\/p>\n<p>Ethereum took the biggest hit, about $3.79 billion, followed by the 18,270 BTC from the Bitcoin wallet, worth about $1.47 billion.<\/p>\n<p>Stablecoins were the attacker\u2019s weak spot, because their issuers can block an address. The freezes came fast:<\/p>\n<ul>\n<li><strong>Circle:<\/strong> at 21:04 UTC it froze 823 million USDC in the main receiving wallet. CEO Jeremy Allaire <a class=\"general-link\" href=\"https:\/\/x.com\/jerallaire\/status\/2115916207463481846\" target=\"_blank\" rel=\"noopener nofollow\">said Circle acted<\/a> \u201cin coordination with law enforcement.\u201d<\/li>\n<li><strong>Tether:<\/strong> 971.1 million USDT was frozen at 21:01, and CEO Paolo Ardoino <a href=\"https:\/\/x.com\/paoloardoino\/status\/2115918000373346709\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">put the total above 1.567 billion USDT<\/a> by 21:25. TRM now counts about 1.77 billion USDT frozen across Ethereum, Tron, Avalanche and Polygon.<\/li>\n<li><strong>Ripple:<\/strong> froze 40.5 million RLUSD at 22:01, after the attacker had sold 48 million on decentralized exchanges.<\/li>\n<li><strong>World Liberty Financial:<\/strong> froze 27.8 million USD1.<\/li>\n<li><strong>Arbitrum:<\/strong> its Security Council forced 8,426 ETH and 74.6 million ARB, about $30 million, out of the attacker\u2019s wallet.<\/li>\n<\/ul>\n<figure id=\"attachment_380277\" aria-describedby=\"caption-attachment-380277\" style=\"width: 2560px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-380277 size-full\" src=\"https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-scaled.png\" alt=\"The Binance hack by blockchain and by freezer, October 30, 2026. Source: TRM Labs\" width=\"2560\" height=\"1440\" srcset=\"https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-scaled.png 2560w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-300x169.png 300w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-1024x576.png 1024w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-768x432.png 768w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-1536x864.png 1536w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-2048x1152.png 2048w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2955-50x28.png 50w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\"><figcaption id=\"caption-attachment-380277\" class=\"wp-caption-text\">The Binance hack by blockchain and by freezer, October 30, 2026. Source: TRM Labs<\/figcaption><\/figure>\n<p>The rest is moving. TRM says the attacker still controls about $2.4 billion, including the BTC, which is being split into 1,000 BTC and 100 BTC pieces. About 325 million USDT was swapped for roughly 122,300 ETH through UniswapX, paying more than 10% over the market price for the ether, the cost of getting out before Tether could act. Ethereum can\u2019t be frozen by an issuer.<\/p>\n<p>A frozen balance isn\u2019t money back in Binance\u2019s hands, though. Releasing it takes the issuers, law enforcement and, in some cases, courts, and none has given a timeline.<\/p>\n<h2>CZ Warned About Phishing for Days. What Has Binance Said Since?<\/h2>\n<p>Binance founder Changpeng Zhao (CZ) had spent the week telling traders to lock down their accounts. On October 23 he argued that AI is a bigger threat to crypto users through leaked data and sharper phishing than through any attack on encryption. <a class=\"general-link\" href=\"https:\/\/x.com\/cz_binance\/status\/2115304943934672928\" target=\"_blank\" rel=\"noopener nofollow\">On Wednesday he posted a checklist<\/a> after four data leaks in a day, at Coinbase\u2019s vendor Amplitude, Korea\u2019s Bithumb and two Korean brokers. His line on breaches: \u201cscammers move fast after one.\u201d<\/p>\n<p>The next day, his own exchange was the one in the headlines. Binance hasn\u2019t said how the engineer\u2019s laptop was compromised. But it shows the same weak point CZ kept flagging: one person\u2019s device.<\/p>\n<p>Since the theft, CZ and co-CEO Yi He have kept to one message: users won\u2019t pay. \u201cLoss might be a bit higher than that, but will cover,\u201d CZ <a class=\"general-link\" href=\"https:\/\/x.com\/cz_binance\/status\/2115932500006756686\" target=\"_blank\" rel=\"noopener nofollow\">replied on Thursday night<\/a>. Hours later he added: \u201cIt hurts, but we will survive.\u201d<\/p>\n<p>The latest updates, as of Friday morning:<\/p>\n<ul>\n<li><strong>Withdrawals:<\/strong> paused on all networks. In a <a class=\"general-link\" href=\"https:\/\/x.com\/binance\/status\/2116026356740034858\" target=\"_blank\" rel=\"noopener nofollow\">service update at 04:36 UTC<\/a>, Binance said it is rebuilding its withdrawal service and addresses and expects to resume \u201cwithin 48 hours.\u201d<\/li>\n<li><strong>Deposits:<\/strong> working as normal.<\/li>\n<li><strong>Other services:<\/strong> Binance Alpha trading is suspended, and Friday\u2019s PREDICT listing is postponed.<\/li>\n<li><strong>Root cause:<\/strong> \u201cmultiple factors,\u201d with a full post-mortem to follow.<\/li>\n<li><strong>Binance.US:<\/strong> not affected, as a separate platform.<\/li>\n<\/ul>\n<p>The phishing risk is now Binance\u2019s users\u2019 problem too. Yi He\u2019s latest post on Friday asked users to trust only official Binance channels and not to click unofficial links or share account details with anyone. Fake \u201crefund\u201d and \u201cwithdrawal verification\u201d messages usually follow a hack like this.<\/p>\n<p><strong>EXPLORE:<\/strong> <a href=\"https:\/\/99bitcoins.com\/news\/bitcoin-btc\/btc-usd-fomc-meeting-history\/\" target=\"_blank\" rel=\"&quot;noopener\">BTC USD Fell in the Month After 12 of the Fed\u2019s 16 Rate Hikes Since 2018: What Could a December Hike Mean for Bitcoin?<\/a><\/p>\n<h2>How Did the Market React to the Binance Hack?<\/h2>\n<p>With a fast sell-off, then a partial bounce. BNB, Binance\u2019s own token, fell from $744.90 to $680 in the 20:00 UTC hour, an 8.7% drop. Bitcoin went from $80,849 to $76,500 by early Friday, and Ether from $2,337 to $2,174.<\/p>\n<p>Leverage made it worse. <a class=\"general-link\" href=\"https:\/\/www.coinglass.com\/LiquidationData\" target=\"_blank\" rel=\"noopener nofollow\">CoinGlass shows $1.55 billion in liquidations<\/a> over 24 hours, hitting 239,610 traders, and 83.6% of it, $1.29 billion, came from long bets. Bitcoin positions made up $501.6 million and Ethereum $360.6 million. Binance itself handled 49.4% of the total, including the largest single order: an $11.09 million BTCUSDT long closed at $79,254.71.<\/p>\n<figure id=\"attachment_380278\" aria-describedby=\"caption-attachment-380278\" style=\"width: 2560px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-380278\" src=\"https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-scaled.webp\" alt=\"Liquidation Map\" width=\"2560\" height=\"1527\" srcset=\"https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-scaled.webp 2560w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-300x179.webp 300w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-1024x611.webp 1024w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-768x458.webp 768w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-1536x916.webp 1536w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-2048x1222.webp 2048w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2957-50x30.webp 50w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\"><figcaption id=\"caption-attachment-380278\" class=\"wp-caption-text\">Liquidation HeatMap<\/figcaption><\/figure>\n<p>The Crypto Fear &amp; Greed Index dropped from 51 to 30, into \u201cfear.\u201d<br \/>\nBitcoin\u2019s low came within $30 of its 200-day exponential moving average (EMA) at $76,473, and buyers stepped in there. It trades near $78,000 now.<\/p>\n<h2>BNB Price Analysis: Can BNB Hold $680 After the Binance Hack?<\/h2>\n<p>So far it has. BNB bounced to $720 by 03:00 UTC as Binance repeated that it would cover all losses, but sellers capped it there, and it is back at $706, down 6.2% in 24 hours.<\/p>\n<ul>\n<li><strong>Resistance:<\/strong> $720, Friday\u2019s rebound high, then $745.74, where BNB traded before the hack.<\/li>\n<li><strong>Support:<\/strong> $692.49, the 200-day EMA, then $680, the low of the hack hour. Below that, $674.60, the September 1 low.<\/li>\n<\/ul>\n<figure id=\"attachment_380279\" aria-describedby=\"caption-attachment-380279\" style=\"width: 2560px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-380279\" src=\"https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-scaled.png\" alt=\"Bnb crypto\" width=\"2560\" height=\"1440\" srcset=\"https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-scaled.png 2560w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-300x169.png 300w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-1024x576.png 1024w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-768x432.png 768w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-1536x864.png 1536w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-2048x1152.png 2048w, https:\/\/99bitcoins.com\/wp-content\/uploads\/2026\/10\/IMG_2956-50x28.png 50w\" sizes=\"auto, (max-width: 2560px) 100vw, 2560px\"><figcaption id=\"caption-attachment-380279\" class=\"wp-caption-text\">BNBUSDT Chart 1H<\/figcaption><\/figure>\n<div class=\"nnbtc-table-wrapper\">\n<table>\n<colgroup>\n<col>\n<col>\n<col><\/colgroup>\n<tbody>\n<tr>\n<th colspan=\"1\" rowspan=\"1\">Path<\/th>\n<th colspan=\"1\" rowspan=\"1\">What has to happen<\/th>\n<th colspan=\"1\" rowspan=\"1\">Next stop<\/th>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\"><strong>Push higher<\/strong><\/td>\n<td colspan=\"1\" rowspan=\"1\">A daily close above $720<\/td>\n<td colspan=\"1\" rowspan=\"1\">$745.74, the pre-hack level<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\"><strong>Stall<\/strong><\/td>\n<td colspan=\"1\" rowspan=\"1\">Holding between $680 and $720<\/td>\n<td colspan=\"1\" rowspan=\"1\">Sideways trade until withdrawals reopen<\/td>\n<\/tr>\n<tr>\n<td colspan=\"1\" rowspan=\"1\"><strong>Slip<\/strong><\/td>\n<td colspan=\"1\" rowspan=\"1\">A daily close below $680<\/td>\n<td colspan=\"1\" rowspan=\"1\">$674.60, the September 1 low<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p>The next test is the 48-hour window. If Binance reopens withdrawals by Sunday morning without a rush for the exits, the worst of this Binance hack may already be in the price. If the reopening slips, $680 is the level to watch.<\/p>\n<p><strong>EXPLORE: <a class=\"general-link\" href=\"https:\/\/99bitcoins.com\/cryptocurrency\/best-meme-coin-icos\/\" target=\"_blank\" rel=\"nofollow noopener sponsored\">Best Meme Coin ICOs to Invest in 2026<\/a><\/strong><\/p>\n<p><b>Follow 99Bitcoins on<\/b> <a href=\"https:\/\/x.com\/99BitcoinsHQ\" target=\"_blank\" rel=\"nofollow noopener\"><b>X<\/b><\/a><b> For the Latest Market Updates, and Subscribe on<\/b><a href=\"https:\/\/www.youtube.com\/@99bitcoins\" target=\"_blank\" rel=\"nofollow noopener\"> <b>YouTube<\/b><\/a><b> For Daily Expert Market Analysis.<\/b><\/p>\n<p>The post <a href=\"https:\/\/99bitcoins.com\/news\/altcoins\/binance-hack-tether-circle-freeze\/\">Binance Loses $6.3Bn in Largest Crypto Theft Ever as Tether and Circle Freeze $2.6Bn: What We Know About Binance Hack<\/a> appeared first on <a href=\"https:\/\/99bitcoins.com\/\">99Bitcoins<\/a>.<\/p>\n<\/div>\n<p><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers took about $6.36 billion from Binance\u2019s hot wallets on ten blockchains on Thursday, October 29, in the largest crypto theft on record, a Binance hack the exchange says began with an engineer\u2019s compromised laptop. Most of it was gone in about 20 minutes. Tether and Circle froze about $2.6 billion of stolen stablecoins within [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[3,4,5],"class_list":["post-155138","post","type-post","status-publish","format-standard","hentry","category-news","tag-crypto","tag-doge","tag-news"],"_links":{"self":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/155138","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=155138"}],"version-history":[{"count":0,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=\/wp\/v2\/posts\/155138\/revisions"}],"wp:attachment":[{"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=155138"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=155138"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dogewisperer.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=155138"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}