The largest known crypto theft shows how freezable tokens can help after a breach, and how limited that help can be

Tue 3 Nov 2026 · 18:06 EST · 3 min read

In Finance

Share

Approximately $6.3 billion left Binance’s hot wallets on October 29, 2026. The draining took somewhere between 20 and 30 minutes.

The breach hit the world’s largest crypto exchange across more than ten blockchains. TRM Labs, Chainalysis, and the FBI have attributed it to TraderTraitor, a North Korean hacking group.

How the attack unfolded

Binance halted all withdrawals after the breach. It then worked with stablecoin issuers, including Tether (USDT) and Circle (USDC), to freeze roughly $3 billion of the compromised funds.

The exchange also set aside more than $6.34 billion of its own money to cover user losses. Services were brought back gradually rather than all at once.

Around half of the stolen assets were moved into tokens with no centralized freezing capability. Once funds land there, no issuer holds a switch that can stop them.

Binance published an initial incident report on November 3, 2026. It described a drawn-out campaign rather than a single smash-and-grab, involving malware and sophisticated laundering methods.

The entry point was reportedly human, not technical. The attackers used social engineering, including fake job interviews aimed at Binance engineers, to gain insider access.

The news moving money, markets, and the world—before your day starts.

Daily. Free. Join 34,000+ readers across crypto, finance, and policy.

We respect your privacy. Unsubscribe anytime.

Why freezable tokens matter here

Stablecoins like USDT and USDC are issued by companies that can freeze specific addresses. In this case, that power turned into roughly $3 billion that the attackers could not use.

Tokenized securities work on a similar principle. They represent traditional assets on a blockchain, and their issuers typically keep administrative controls over who can hold or move them.

A familiar adversary at scale

North Korean groups like TraderTraitor are state-sponsored, and their operations against digital asset platforms have become a persistent threat. This incident extends that pattern to a scale the industry had not seen before.

The tactics on display were not exotic. Fake recruiters, malware, and layered laundering are standard tools. What stood out was the speed of the final draining and the breadth across more than ten chains at once.

Binance’s ability to cover losses with more than $6.34 billion in company funds supports part of that argument. The fact that the funds left in under half an hour undercuts another part.

What this means for exchanges, issuers, and users

For stablecoin issuers, the episode is a double-edged showcase. Tether and Circle demonstrated that freeze powers can recover billions in a real emergency.

The attackers’ choice to rotate funds into assets without central controls is the clearest signal of all. Sophisticated thieves already understand which tokens can be clawed back and which cannot, and they plan around it.

Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.

More in Finance