Late on Thursday 29 October 2026, Binance, the world’s largest cryptocurrency exchange, was hit by a theft that the company has put at about $6.3 billion. Blockchain-intelligence firms give slightly higher totals: $6.36 billion according to TRM Labs and $6.43 billion according to Elliptic. On any of those figures it is the largest theft in crypto history, roughly four times the $1.5 billion taken from Bybit in February 2025.

Five weeks earlier, on 25 September 2026, Binance founder Changpeng Zhao (CZ) gave an hour-long interview to the When Shift Happens podcast (episode 187). Zhao holds no operational role at the company, although he is reportedly still its majority shareholder. He spoke about how exchanges should react to a security incident, his view of the FTX collapse, regulation, his four months in a US federal prison and his pardon. The two events are unconnected. This analysis simply sets what Zhao said in September beside what is publicly known about October. No full transcript of the interview has been published, so his views below are paraphrased from published summaries of the episode rather than quoted.

Anatomy of the October Breach: What Is Known So Far

According to TRM Labs, the first theft began at about 20:05 UTC on 29 October on the XRP Ledger, and most of the funds left within roughly 20 minutes across ten blockchains (Elliptic counts eleven). The largest single transaction was an Ethereum sweep of 167,464 ETH and 63 other tokens, including 1.615 billion USDT – more than $2.5 billion in one transfer, which Elliptic timestamps at 20:24 UTC. A second wave followed at around 23:05 UTC. On-chain evidence shows the attacker’s operating wallet was funded through Tornado Cash on 28 October, and CNBC reported that preparations began at least 36 hours before the theft.

How the attackers got in is still being established. Binance’s first statement said a compromised engineer’s laptop may have let an attacker reach a service container and submit unauthorised withdrawals; early reports differ on whether the engineer worked in DevOps or software engineering. Binance later said its investigation had uncovered additional points of breach, and co-CEO Richard Teng said the attacker did not simply use one engineer’s permissions and that it was not a single “one-click” action. Al Jazeera reported Binance’s statement that there was no evidence any wallet private key had leaked. TRM’s reading is that the attacker most likely gained the ability to make Binance’s hot-wallet signing system sign transactions of its choosing across chains. On Ethereum, TRM and other outlets describe the use of EIP-7702, an account-delegation feature added in the May 2025 Pectra upgrade, with 50 pre-signed authorisations submitted from the attacker’s wallet. Some early reports loosely called this a multi-signature exploit.

Two hardware wallets and a physical bitcoin coin
Hardware wallets and a physical bitcoin coin. Photo: Gage Skidmore, CC BY-SA 3.0, via Wikimedia Commons

Key parameters as of 31 October:

  • Asset freezes: Binance says about $3 billion has been frozen. TRM itemises roughly $1.77 billion in USDT frozen by Tether and $825 million in USDC frozen by Circle, plus smaller freezes by Ripple, World Liberty Financial and the Arbitrum Security Council. Elliptic verified $2.85 billion frozen or seized on-chain. Native bitcoin and ether cannot be frozen by an issuer, and TRM estimates the attacker still holds about $2.4 billion in ETH and BTC.
  • Attribution: TRM attributes the attack to TraderTraitor, which it calls “North Korea’s premier hacking unit”, and, according to CNBC, did so with high confidence. Chainalysis also points to TraderTraitor and notes that the stolen funds commingled with those of a Bitget theft the previous month. Elliptic calls TraderTraitor the likely perpetrator but notes that no government has confirmed it. Some outlets describe TraderTraitor as part of the wider Lazarus Group; CNBC notes that the FBI previously linked the same group to the Bybit theft.
  • A warning days earlier: On 27 October Binance said it had blocked a week of North Korea-linked attempts that used fake job interviews, the “Contagious Interview” tactic, with no systems compromised and no assets lost. It said the attackers had not tried brute force but a job interview. No public evidence yet links those attempts to the 29 October theft.
  • Binance’s response: The exchange halted deposits and withdrawals, says user funds are safe and has pledged to cover all losses from its SAFU emergency fund (reported at roughly $1 billion to $1.2 billion) and company reserves. It has said it will publish proof of reserves on 2 November.
  • Public comments from Zhao: Crypto Times reported that Zhao said on X that Binance appeared to have been hacked and that user funds were safe. On 30 October, CNBC reported, he asked Elon Musk to stop mocking the exchange over the incident.
Changpeng Zhao speaking at a press conference at Web Summit 2022
Changpeng Zhao at Web Summit 2022. Photo: Web Summit, CC BY 2.0, via Wikimedia Commons

The ‘Big Red Button’ and the Lessons of 2019

The central operational question in a live breach is how quickly to halt. According to summaries of the September interview, Zhao argued that an exchange should be able to stop everything first and investigate second, a “big red button”. He said Binance used that approach in 2019, and he revisited the Bybit episode of February 2025.

After the $1.5 billion Bybit theft, Zhao publicly suggested that Bybit pause withdrawals. Bybit CEO Ben Zhou replied that he agreed with the point in principle but would pause everything only if Bybit’s internal systems or hot wallet had been breached, and he kept withdrawals open. Bybit’s losses came from the compromise of the Safe multisig interface it relied on, and the FBI attributed the theft to TraderTraitor. According to one summary, Zhao described the pause question in the interview as a judgement call with no absolute right or wrong, and noted that Bybit experienced no further problems.

The 2019 precedent is on the record. On 7 May 2019 hackers took about 7,000 BTC, worth roughly $40 million at the time, from Binance. The exchange suspended deposits and withdrawals for about a week and covered the losses from SAFU. Binance also publicly considered rolling back the Bitcoin blockchain, drew criticism and dropped the idea. The October 2026 theft is roughly 150 times larger. Binance halted deposits and withdrawals on the day of the attack.

Resilience: The FTX Post and the 10 October 2025 Cascade

According to interview summaries, Zhao rejected the argument that his post of 6 November 2022, in which he said Binance would liquidate its remaining FTT tokens, was what brought down FTX. His position, as summarised, is that a company a competitor can destroy with a single tweet is not a real company, and that FTX’s underlying problem was the misuse of customer funds rather than his announcement.

A more recent test of Binance’s standing came on 10 October 2025. After President Trump announced 100 per cent tariffs on Chinese imports, crypto markets saw the largest liquidation event on record, with more than $19 billion in leveraged positions wiped out. Several assets, including Ethena’s USDe, BNSOL and wBETH, briefly traded far below their pegs on Binance; USDe fell to $0.65 there while holding around $0.99 on decentralised venues. A debate followed over how far Binance’s pricing of those assets contributed to the losses, and Zhao pushed back on claims that Binance had triggered the cascade. Binance said it paid about $283 million to users affected by the depegs, then announced a further $300 million distribution to liquidated traders and $100 million in low-interest loans – about $683 million in Binance-funded commitments, and more than $700 million including BNB ecosystem partners.

The Regulatory Contrast: HyperLiquid and the Question of KYC

Perpetual-futures platform HyperLiquid has been winning market share from centralised venues. Speaking to Alex Thorn, head of research at Galaxy, on the Galaxy Brains podcast in June 2026, Zhao called the Hyperliquid invention “awesome”, said it occupies a niche Binance cannot compete in because it has no KYC, and said he would not do what it does, citing his own experience. According to summaries of the September interview, he also welcomed more decentralised exchanges, said growing the industry mattered more than growing one platform, and described crypto as far from saturated, with global penetration below 1 per cent.

The remark draws attention to a contrast at the centre of the industry’s regulatory debate: a centralised exchange bound by identity-verification rules on one side, decentralised platforms that operate without them on the other. Binance pleaded guilty in 2023 to US Bank Secrecy Act violations, and Zhao served four months in prison.

Four Months Inside and the Road to a Pardon

According to summaries of the interview, Zhao argued that no one in US history had previously gone to prison solely for a Bank Secrecy Act violation. He was pardoned by President Trump in 2025. In the interview, as summarised by ChainCatcher, he said he submitted his pardon application in April 2025.

Responding to speculation about White House access, Zhao said he has never met Trump in person and has never spoken to him by phone or email. He attributed the timing of one bullish post that preceded a Trump speech to coincidence, arguing that someone who is always bullish and posts about five times a day will sometimes post shortly before good news.

Where Things Stand

As of 31 October, Binance says user funds are safe, its investigation is continuing and the US Secret Service has said it is working to trace the stolen funds. Bitcoin fell about 5 per cent to below $80,000 after the news. One analyst quoted by CNBC said the theft did not appear to create meaningful solvency risk for Binance. Recovery is a separate question: roughly $3.3 billion has not been frozen, and CNBC reports that the attackers are using automation, Chinese money-laundering networks and Tron addresses to move funds beyond easy tracing. Readers interested in Bitcoin’s origins may also find Creativity’s UK’s piece on how AI read the mind of Satoshi Nakamoto a useful companion.

For institutional investors and venture capital, the open questions are operational rather than rhetorical: how Binance rebuilds its signing and withdrawal controls, how quickly it restores services, and whether the episode moves liquidity toward on-chain venues, as some commentators argue. Figures in this article are as reported on 30 and 31 October 2026 and may change as investigations continue.

Sources