Binance hack: the largest robbery in financial history

October 30, 2026

Binance hack: the largest robbery in financial history

Key takeaways

On Thursday, October 29, Binance experienced a $6.3 billion hack. So far, $3 billion has been frozen and is protected from loss. Binance says it will cover every loss.
This is the largest robbery in financial-market history, surpassing Bybit in 2025 ($1.5 billion) and the Central Bank of Iraq in 2003 (~$1 billion).
Bitcoin fell just over 2% in the 24 hours following the hack. This is significantly less than Bitcoin's 26% drawdown following the infamous FTX issue of November 2022.
Bitcoin itself was not hacked: this was a security breach at one company, Binance.
No impact to 21shares' physically-backed ETPs; all products are trading normally.

‍

Binance hacked for $6.3 billion

On Thursday, October 29, Binance experienced a $6.3 billion hack, the largest theft in history. In response to the hack, Binance has paused withdrawals (deposits have resumed), though it expects to resume within 48 hours, and says it will cover all losses from its Secure Asset Fund for Users (SAFU) emergency fund and company funds.

^{Source: 21shares, Arkham,}^{stolen by chain}^{, posted 05:20 CET; values at the time of the theft (on-chain estimate, not confirmed by Binance). USDT = $1,875.46M on Ethereum + $612.73M on Tron. *Derived: Arkham’s Ethereum total ($3,738.66M) minus the USDT, USDC and ETH it itemises; includes tokens such as wBETH and RLUSD. **Arbitrum, Avalanche, Polygon, Optimism and Base, as grouped by Arkham.}

Binance reports that about $3 billion of the stolen assets is frozen onchain (and so protected from loss), which leaves about $3.3 billion still at risk of loss. Freezing works only for tokens whose issuer or governing body can block specific addresses.

Stablecoins, tokens designed to track the US dollar, are one example. Stablecoin issuer Tether froze more than 1.6 billion USDT and Circle more than 800 million USDC, while the Security Council of Arbitrum, a network built on Ethereum, moved 75 million ARB and 8,425 ETH to a frozen wallet.

If unfrozen assets, worth up to $3.3 billion, are moved toward services that obscure the origin of funds (known as ‘mixers’), then recovery prospects for them are narrow.

^{Source: 21shares}^{Binance, 03:25}^and^01:52^;^{Arkham, 05:20}^{(est.); issuer statements. ARB, ETH and PAXG $ values use CoinGecko prices at 06:48 CET (PAXG via the XAUT gold price). Issuer amounts are “more than” floors and may overlap Binance’s ~$3 billion.}

‍

Binance will cover all losses

Binance says it will cover all losses from SAFU and company funds. Its SAFU emergency fund holds 15,000 bitcoin, about $1.18 billion at $78,509 per bitcoin (CoinGecko as of 30 October 2026). That covers about 36% of the $3.3 billion not frozen and leaves about $2.1 billion, which will come from company funds. As of 1 October 2026, its proof of reserves showed net user balances of $134 billion against onchain holdings of about $136 billion, a surplus near $2 billion (ChainCatcher).

Binance has met a loss before, when in May 2019 its SAFU covered 7,000 bitcoin, about $40 million, in full.

‍

How did the Binance hack happen?

Binance's initial finding points to a compromised DevOps engineer's laptop, with no sign that any wallet private key leaked. Binance has not disclosed its fund-approval process, and no evidence shows that one person could approve these transfers, and nothing indicates an insider job.

Chainalysis says it has a high degree of confidence that North Korea is responsible, though Binance and no government entity has confirmed attribution. If this does prove to be the case, recovery of the unfrozen funds is unlikely. Groups linked to North Korea typically launder through swaps and bridges that move tokens between blockchains, and through mixers, and funds not frozen early are rarely recovered. Attribution also carries sanctions weight, since the US Treasury's Office of Foreign Assets Control (OFAC) sanctions Lazarus Group and related North Korean cyber groups, so anyone handling the stolen funds could face compliance questions.

A spillover into decentralized finance (DeFi), lending and trading applications that run on blockchains without a central operator, was contained. The attacker supplied 60 million stolen USDT to Aave, a DeFi lending protocol, and borrowed 19,762 wrapped ether (WETH), about $44.6 million, within about three minutes. Aave froze its markets as a precaution and reported no bad debt, meaning no loan whose collateral it cannot cover, because the position remains over-collateralized (LlamaRisk, Aave governance forum).

^{Source: 21shares,}^{Binance, 03:25}^{and issuers (official). Est.: Arkham (}^05:20^,^swaps^,^movable^,^06:24^),^LlamaRisk^,^Lookonchain^,^EmberCN^{, ZachXBT.}^CoinGecko^{: PAXG $3,991.74 (11:05), ETH $2,245 (06:25). Remainders computed.}

‍

What does this mean for 21shares

21shares’ physically-backed exchange-traded products (ETPs and ETFs) are not exposed to Binance. Underlying digital assets are held in cold storage by regulated third-party custodians, including BitGo, Coinbase Custody, Anchorage Digital, and Zodia Custody. 21shares does not hold assets in exchange accounts, thus separates product assets from any exchange’s balance sheet, so incidents like yesterday’s hack do not touch the assets backing our ETPs.

Furthermore, liquidity for 21shares ETPs does not depend on a single venue: our market makers source liquidity across multiple trading venues and exchanges, so there is no single point of failure.

As a result of the operating structure that 21shares has created for managing digital assets, all our ETPs are trading normally today.

‍

Proud of our operational excellence

21shares has been managing its assets with this level of operational excellence since the launch of our very first ETP in 2018, and we are proud to be the only digital asset manager that has maintained continuous trading of every product for over eight years.

Share

Add to Preferred Sources

This report has been prepared and issued by 21Shares AG for publication globally. All information used in the publication of this report has been compiled from publicly available sources that are believed to be reliable, however we do not guarantee the accuracy or completeness of this report. Crypto asset trading involves a high degree of risk. The crypto asset market is new to many and unproven and may have the potential to not grow as expected.

Currently, there is relatively small use of crypto assets in the retail and commercial marketplace in comparison to relatively large use by speculators, thus contributing to price volatility that could adversely affect an investment in crypto assets. In order to participate in the trading of crypto assets, you should be capable of evaluating the merits and risks of the investment and be able to bear the economic risk of losing your entire investment.

Nothing in this publication does or should be considered as an offer by 21Shares AG and/or its affiliates to sell or solicitation by 21Shares AG or its parent of any offer to buy bitcoin or other crypto assets or derivatives. This report is provided for information and research purposes only and should not be construed or presented as an offer or solicitation for any investment. The information provided does not constitute a prospectus or any offering and does not contain or constitute an offer to sell or solicit an offer to invest in any jurisdiction.

Readers are cautioned that any such forward-looking statements are not guarantees of future performance and involve risks and uncertainties, and that actual results may differ materially from those in the forward-looking statements as a result of various factors. The information contained herein may not be considered as economic, legal, tax, or other advice and users are cautioned against basing investment decisions or other decisions solely on the content hereof.

‍