Reporting snapshot · 30 October 2026 (Asia/Karachi). Binance has not yet published a post-mortem, no group has claimed responsibility, and the recovered total can still move as the investigation continues. The size of the loss also depends on when each asset is valued, so the figures below are the estimates published on 29 and 30 October rather than a final accounting.
What happened on 29 and 30 October
On the evening of Thursday, 29 October, an attacker moved about $6.36 billion out of Binance wallets across ten blockchains, most of it in roughly twenty minutes from 20:05 UTC, the blockchain analytics firm TRM Labs said in its findings on the attack. Binance confirmed a security incident and suspended withdrawals on several networks. Reuters, reporting the same findings, called it the largest crypto theft on record, and TRM Labs measured it as about four times the $1.5 billion taken from the Bybit exchange in February 2025.
Binance’s co-chief executive Richard Teng said the incident “may have started with a compromised DevOps engineer’s laptop”, which “gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions”, the BBC reported. He said the attacker “did not simply use one engineer’s permissions”, that no wallet private key leak had been found, and that a detailed post-mortem would follow. Binance later said it had “uncovered additional points of breach”. Deposits and withdrawals were temporarily suspended at about 12:36pm local time on Friday, AFP reported via Geo News, and Binance’s co-chief executive Yi He said withdrawals would stay disabled until the environment was confirmed secure. The US-facing Binance.US platform said it was not affected, as did Coinbase.
How the assets were moved
On Ethereum, TRM Labs said the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled. The News International described the mechanics: pre-signed authorisation payloads pushed through a compromised channel made the primary Ethereum hot wallets run malicious contract code, which swept the reserves in bulk. TRM said the laundering seen so far, through large swaps via market makers and lending protocols, differs from the bridge-heavy pattern that followed the Bybit theft, and that the staging began well before the theft itself. The firm’s global head of policy, Ari Redbord, called the incident a “watershed moment” for the industry, the BBC reported.
Two security researchers offered a reading of how a laptop became a route into the exchange’s wallets. Raghu Nandakumara of Illumio said an engineer may have been “talked into taking a test”, with malware landing on the device, the BBC reported. Jayant Dave, Check Point’s chief information security officer, said the attack resembled September’s $388 million theft from Bitget and implied “attackers no longer need the vault keys. They target the systems and people with authority to use them.”
The figures, and why they differ
Three estimates of the same loss are in circulation, and the gaps are matters of method and timing rather than disagreement about the fact of the theft. TRM Labs valued every transfer at the price of the asset at the moment it was taken, giving about $6.36 billion, and put roughly $2.7 billion of it as frozen, with the attacker still holding some $2.4 billion. Chainalysis put the amount stolen at about $5.912 billion at the time of the theft, AFP reported. Binance has spoken of $6.3 billion “impacted”, said about half of it had been frozen, and said it would cover all losses.
The frozen totals move through the day: more than $2.5 billion in AFP’s midday account, about $3 billion in Reuters’ later report. Tether said it froze nearly $1.57 billion, Circle more than $800 million and Ripple roughly $200 million, Reuters reported. TRM’s breakdown of what left the exchange puts Ethereum at about $3.79 billion, including 200,630 ETH and 1.875 billion USDT; Bitcoin at 18,270 BTC, about $1.47 billion; Tron at 612.7 million USDT and 46.4 million TRX, about $628 million; the XRP Ledger at 233.46 million XRP, about $296 million; and Solana at 970,500 SOL, about $96 million.
Markets moved before and after the exchange’s confirmation. Bitcoin fell more than 3% to a six-week low of $76,368 and ether more than 3% to a two-month low of $2,178, with BNB down 5% at $709.70, Reuters reported. In the earlier session, AFP recorded bitcoin down nearly 5%, ether nearly 6% and BNB nearly 10%. Shares in Coinbase fell 4.8% and in Strategy nearly 6%.
Why the industry is repricing risk
The immediate issue for users is not only the stolen balance but what a breach of this size does to the assumption that a large exchange can be trusted with money. Tim Sun, a senior researcher at HashKey Group, said the incident “may further dampen risk appetite and prompt investors to reassess the safety of assets held on centralized exchanges, as well as counterparty, solvency and liquidity risks”, Reuters reported. Aravind Srinivasan, who runs the systematic over-the-counter business of GSR, called it “the biggest hack in history”, and Eric Jardine, Chainalysis’ head of research, urged exchanges to stay vigilant because platforms hold so much value.
For customers of other platforms, the second risk is social engineering. Marijus Briedis, NordVPN’s chief technology officer, warned of emails claiming funds are at risk, fake support accounts offering help, and messages urging users to move cryptocurrency to a “safe” wallet, the BBC reported. Researchers also noted that artificial intelligence can find software weaknesses faster than defenders can patch them, a risk the Bank of England has warned about for UK financial institutions.
What this means for Pakistan
The breach lands on a market Pakistan moved into deliberately and quickly. The Pakistan Virtual Assets Regulatory Authority, the country’s federal regulator for virtual assets, established under the Virtual Assets Act, 2026, granted no objection certificates to Binance and HTX in December 2025, the authority’s own news feed records. A no objection certificate is not a licence: PVARA’s licensing framework states that every virtual-asset service provider must obtain a formal licence before offering services in Pakistan, with applications now open for places in the regulatory sandbox, no objection certificates and full virtual-asset service provider licences, PVARA explains.
The shift from prohibition to supervision happened in a matter of months. The Senate cleared the Virtual Assets Act in February 2026, as KhabarWire reported, and the State Bank of Pakistan then legalised virtual assets and set rules for crypto-linked bank accounts in April, covered here. Binance’s co-founder Changpeng Zhao is an adviser to Pakistan’s National Crypto Council, KhabarWire reported in July.
So the largest crypto theft on record has happened at one of the two global exchanges Pakistan has formally cleared, in a regime whose published licence conditions require operational and security standards, customer-fund safeguards and cybersecurity. Neither Binance nor PVARA has published how many of the exchange’s registered users — more than 300 million, the BBC reported — are in Pakistan, or how much of the affected balance belonged to Pakistani customers. PVARA’s news feed had not posted anything on the breach when this report was filed.
What is still uncertain
No group has claimed responsibility. Binance said it is working with law enforcement partners to identify those responsible, but it has not attributed the attack, and TRM Labs and Chainalysis describe their North Korea assessments as high-confidence analytical judgments rather than confirmed facts; the regime has denied involvement in such thefts before. The size of the loss is provisional, because the total depends on when each token is valued and on how much of the frozen sum is eventually recovered and returned.
The second uncertainty is who bears the loss. Binance has said it will cover all of it from the Secure Asset Fund for Users, a reserve held entirely in bitcoin, and from company funds, which means the exposure falls on the group’s own balance sheet at a moment when the price of its reserve asset is falling. Withdrawal services are due to restart on a timeline the exchange has given in two forms, within 48 hours according to Reuters and within 45 hours in the statement the BBC reported. What Pakistani users will find on their accounts, whether the exchange’s licence position changes, and whether Pakistani regulators act, are all open questions rather than settled points.
