The biggest crypto theft ever hit an exchange with no EU licence

At 4:05pm New York time on 29 October, someone began moving money out of Binance’s hot wallets on the XRP Ledger. Within about 20 minutes most of roughly $6.3 billion across ten blockchains had gone; further sweeps on Ethereum and a second wave on Avalanche and Polygon continued for about four hours. TRM Labs, which traced the flows, puts the total at $6.36 billion.

That makes it the largest theft in the history of crypto, and by a wide margin. The previous record, the $1.5 billion taken from Bybit in February 2025, is less than a quarter of it. Every other major hack is smaller still.

What was taken, and where

Most of the value sat on Ethereum: about $3.8 billion in ether and tokens. Another $1.5 billion was bitcoin, 18,270 coins. TRON, the network that carries much of the world’s Tether, accounted for $628 million, the XRP Ledger $296 million and Solana $96 million. The rest was spread across smaller chains.

How the attackers got in is still being pieced together. Binance first pointed to a compromised laptop belonging to an engineer on its DevOps team. Within a day, it said there were “additional points of breach”. Chief executive Richard Teng has said the attackers abused EIP-7702, an Ethereum upgrade that lets an ordinary wallet temporarily run code like a smart contract, to take control of hot-wallet permissions. Binance says it has found no sign that its private keys leaked.

The size of the loss raises its own question. Exchanges keep most customer assets in cold storage, offline, and hold only what they need for day-to-day withdrawals in hot wallets connected to the internet. That more than $6 billion was reachable in hot wallets at all suggests either that the attackers reached wallets meant to be colder, or that Binance kept far more online than its customers would have assumed. Binance has not yet said which.

TRM Labs says, with high confidence, that the attack was carried out by TraderTraitor, a North Korean unit within the Lazarus Group. Chainalysis reached the same conclusion. The same unit was blamed for Bybit. North Korea stole more than $2 billion in crypto across the whole of 2025. This one afternoon was three times that, and it takes the country’s total for 2026 so far to about $7.4 billion, 85% of all value stolen in hacks this year, by TRM’s count.

The fastest freeze yet

The response was quicker than in any earlier hack. Tether began freezing wallets at 5:01pm, under an hour after the first transfer. Circle followed three minutes later. By 00:30 UTC on 30 October, TRM counted about $2.7 billion frozen: about 1.77 billion USDT by Tether, 825 million USDC by Circle, and smaller amounts by Ripple, World Liberty Financial and Arbitrum’s security council. Binance puts the total frozen by issuers and other firms at about $3 billion.

That is the main difference from Bybit. Stablecoins can be frozen by their issuer, because the issuer controls the token contract. Bitcoin and ether cannot. Bybit’s attackers swapped most of what they took into ether and laundered it through THORChain. This time about half of the loot was stablecoins when it left Binance, and issuers froze most of that half within hours. None of the bitcoin or ether could be frozen. By TRM’s count the attackers still hold more than 420,000 ETH and the 18,270 BTC; much of the rest has been sold to market makers, swapped on decentralised exchanges or borrowed against on lending protocols.

Binance cut the attackers off from the hot wallets at 8:10pm, four hours after the draining began. On 30 October it said it would cover every customer loss in full. It is drawing on its SAFU emergency fund, which holds about $1 billion, about one-sixth of the loss, along with its insurance fund, its bitcoin reserve and its own treasury. By 1 November it said it had replaced 95% of the stolen assets. On 2 November it published a zero-knowledge proof of reserves for ten assets, based on a snapshot at midnight UTC on 31 October. It did not publish per-asset ratios, and the proof has not been checked by an outside auditor.

The test: withdrawals

Withdrawals reopened in phases on 1 November. Between 6am and 3:30pm UTC, customers took out $4.6 billion and deposited $1.0 billion, a net outflow of about $3.6 billion. That is real money, but it is under 3% of the roughly $128 billion held in Binance-linked wallets, according to an on-chain tracker cited by The Block. The theft itself was about 5% of that. When FTX failed in 2022, customers tried to withdraw several billion dollars in a few days and the exchange could not pay. Binance did pay.

That matters for the wider market. A failure at Binance, which handles a large share of global spot trading, would have spread to every exchange and lender that depends on it. For now, that has not happened.

Where Europe comes in

Binance is the world’s biggest crypto exchange. It is not licensed in the European Union.

Since 1 July 2026, firms offering crypto services in the EU have needed authorisation under MiCA, the Markets in Crypto-Assets Regulation. Binance had applied in Greece. It withdrew that application on 24 June, a week before the transitional period ended, and said it would apply in another member state. It does not appear among the 389 firms on ESMA’s interim register, as updated on 30 October, which we mapped in Issue 1.

A MiCA licence would not have stopped North Korean hackers; licensed firms get hacked too. But the rules set out what happens to customers when a firm loses their money, and that is the question European users of an unlicensed exchange now cannot answer from the rulebook.

Under MiCA, client crypto must be held separately from the firm’s own (Article 70). A custodian is liable to its clients for assets lost through an incident it is responsible for (Article 75). Licensed firms also fall under DORA, the EU’s Digital Operational Resilience Act, which requires tested systems, reporting of major ICT incidents and oversight of outside suppliers. Binance has promised to cover its customers. In the EU, a licensed firm would be legally required to.

What to watch

Three things will decide how this ends. The first is how much of what the attackers still hold is laundered before it can be traced; the Bybit money moved within weeks, and investigators have already traced some of these funds through THORChain. The second is whether Binance’s next proof-of-reserves snapshot, due on 4 November, shows the gap fully closed, and whether an outside auditor confirms it. The third is where Binance applies for its MiCA licence next, and how that regulator weighs the largest theft in crypto’s history.

We will update the figures as they settle.