The $6.3B Binance Hack: What Happened, and Why It Matters Who Holds Your Money

On Thursday evening, a little over $6 billion left Binance in about 20 minutes. Binance's customers didn't lose their own keys. Nobody broke into their personal wallets. The attacker went after the one place where everyone's money was held together, and that was enough.

That's the part worth thinking about if you run a business that gets paid in crypto. Not "Binance got hacked." Exchanges have been hacked before and will be again. The real lesson is what happens when money from millions of people sits in one place, behind one set of systems.

Here's what we know so far, what was saved, and what you can actually do about it.

What happened

At 20:05 UTC on October 29, wallets belonging to Binance started sending their balances to addresses controlled by one attacker. According to blockchain intelligence firm TRM Labs, about $6.36 billion moved out across ten blockchains, most of it in roughly 20 minutes (TRM Labs). Binance's own estimate of the total impact is about $6.3 billion (CoinDesk). That's about four times the $1.5 billion Bybit hack of February 2025, which until now was the record.

TRM attributes the attack, with high confidence, to TraderTraitor, North Korea's elite hacking unit. The FBI named the same group as responsible for the Bybit hack (TRM Labs). Chainalysis reached the same conclusion (CNBC).

How it worked, in plain English

Exchanges keep part of their customers' crypto in "hot wallets": wallets connected to the internet so withdrawals can be processed automatically. Those wallets are controlled by an internal signing system that approves outgoing transfers.

Binance's initial investigation said the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions" (CoinDesk). On Friday it added that it had "uncovered additional points of breach" beyond that laptop (CoinDesk live). Co-CEO Richard Teng said it was "a more complex attack process," not a one-click action, and that investigators had found no evidence of a wallet private-key leak (Cointelegraph). The full root cause hasn't been published yet.

What the blockchain shows is telling. Wallets on Bitcoin, Ethereum, Tron, Solana, the XRP Ledger and five other networks all produced valid signatures for the attacker within about half an hour. These wallets use different chains, key types and signing schemes. TRM's assessment is that the attacker gained the ability to make Binance's signing system approve transactions of its choosing, across chains (TRM Labs).

On Ethereum, the attacker went a step further. Using a feature called EIP-7702, it had one of Binance's best-known hot wallets sign control over to a "sweeper" contract. A single transaction then moved 167,464 ETH and 1.6 billion USDT out, and the sweeper kept draining new deposits as they arrived (TRM Labs).

And it was planned. Preparation started at least 36 hours before the theft, with the attacker's wallet funded through Tornado Cash, and the attack code was rehearsed on test wallets before being used on Binance.

What was saved, and what wasn't

About $3 billion of the stolen assets have been frozen so far, including $2.3 billion in USDT and USDC (CoinDesk). Tether, Circle, Ripple and World Liberty Financial froze stablecoins in the attacker's wallets, and Arbitrum's Security Council moved about $30 million out of the attacker's reach on its network (TRM Labs).

The attacker knew this was coming. It rushed to swap stablecoins for ETH and to borrow ETH against USDT on Aave, taking a discount of more than 10% just to get out of reach. It now holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze (TRM Labs).

Binance says it will cover all losses and that user funds are safe. It has set aside more than $6.34 billion of its own funds for the incident, $5 billion of it already held in the exact tokens that were taken, and is buying the rest on the market and over the counter (CoinDesk). It says it has begun recovering affected assets for users. Analysts don't currently see a solvency risk (CNBC). That deserves credit: a lot of past exchange failures didn't end this way.

But "your funds are safe" and "your funds are available" are two different things. Withdrawals are paused while Binance rebuilds its withdrawal system. On Friday morning it said it was on track to restart them in about 45 hours, which points to around Sunday (CoinDesk live). Until then, money that belongs to Binance's users can't leave the platform. And CoinDesk found that the drained wallets were the same ones Binance lists in its proof of reserves, which likely pushed its ETH backing below 100% until the stolen funds are replaced (CoinDesk). Binance says it's buying replacement tokens ahead of an updated proof of reserves (Cointelegraph).

The real lesson: the honeypot is the design

It's tempting to read this as "Binance should have had better security." Maybe. But Binance is one of the best-resourced security operations in the industry, and it still happened. Bybit happened. Last month, Bitget lost about $388 million from its hot wallets (CNBC), and on-chain investigator ZachXBT says funds from that hack and this one ended up in the same address (Cointelegraph).

The pattern isn't bad teams. It's the shape of the system. When billions of dollars sit behind one signing system, that system is worth months of preparation to a state-backed hacking unit. One compromised laptop, one internal service, one gap, and everything behind it is exposed at once.

That's what custody means. Someone else holds your money, so someone else's security is your security. Their laptop is your risk. Their pause is your pause.

What non-custodial changes for a business

This is the reason QBitFlow is built the other way round.

When your customer pays you through QBitFlow, the money goes straight from their wallet to yours, on-chain. We never hold it. There's no QBitFlow balance, no pooled hot wallet full of merchant revenue, and no withdrawal queue for anyone to pause.

So in practice:

• Nothing to drain at our end. An attacker who broke into QBitFlow would not find a pile of your money, because it's already in your wallet.
• You're paid the moment the payment confirms. Not after a payout schedule, and not after someone re-opens withdrawals.
• You can check everything yourself. Every payment is a transaction on a public blockchain. You don't have to trust a number in someone's dashboard, or a monthly reserve report.

What it doesn't change (the honest part)

Non-custodial isn't magic. It doesn't make risk disappear. It moves it, from a company you have to trust to keys you control.

• Your keys are now your security. If your wallet's keys are stolen, your funds are at risk, and no company can reimburse you. The difference is scale: one merchant's wallet is a far smaller target than a $6 billion pool, and you decide how well it's protected.
• Stablecoins can be frozen by their issuer. This hack proved it, in the good direction. But it's true for every USDT or USDC holder, in any wallet.
• Smart contracts carry their own risk. QBitFlow's contracts are open-source and auditable on GitHub. They are not formally third-party audited yet; that's on our roadmap.

A short checklist if you accept crypto

1. Use a hardware wallet for the wallet that receives your payments, or at least for where you keep the balance.
2. Separate receiving from saving. Let payments land in one wallet and move what you don't need to a colder one.
3. Watch for unexpected approvals and delegations. TRM recommends alerting on any EIP-7702 delegation on a treasury wallet, which shows up as code at an address that should have none (TRM Labs). Review your token approvals regularly too.
4. Treat your laptop like a vault door. This whole thing reportedly started with one. Keep seed phrases off it entirely.
5. Ask any processor one question: who holds the money between your customer paying and you receiving it? If the answer isn't "you," their security is your security.

The bottom line

Binance looks set to make its users whole, with more than $6 billion of its own money, and that's genuinely good. But the next target won't always have that kind of money to put up, or the whole industry rushing to help.

Security and simplicity aren't a trade-off. You can accept payments as easily as tapping a card and still be the only one holding the keys. That's what we build.

Start accepting payments · Read the docs

---

Figures from TRM Labs, CoinDesk, CNBC and Binance's public statements as of October 30, 2026, 13:30 CET. The investigation is ongoing and numbers may change.