Biggest Crypto Hack Ever? Binance Joins the List of Exchange Hacks

At about $2.8 billion, the suspected Binance hack of October 29, 2026 would be the largest theft ever suffered by a crypto exchange. The previous record belonged to Bybit with about $1.5 billion in February 2025. Unlike then, most of the loot is already frozen this time: Tether and Circle have blocked stablecoins worth about $2.4 billion. Binance says it is investigating reports of a potential security issue, co-founder Changpeng Zhao says it does look like a hack. We place the case in the line of major crypto hacks and explain why exchanges are hit more and more often.

What happened to the wallet is in our Binance hack report, how the market reacted in our crypto crash timeline.

The biggest crypto hacks in history

The table shows the damage at the time of the theft. Several cases were later fully or partly covered or recovered.

DateVictimDamage at the timeWhat happened next

October 2026	Binance (suspected)	about $2.8B	about $2.4B in stablecoins frozen
February 2025	Bybit	about $1.5B	attributed to North Korea by the FBI, customer funds covered
March 2022	Ronin Network (Axie Infinity)	about $620M	attributed to North Korea, users reimbursed
August 2021	Poly Network	about $610M	almost fully returned by the attacker
January 2018	Coincheck	about $530M	customers compensated in yen
February 2014	Mt. Gox	about 850,000 BTC	bankruptcy, repayments only from 2024
November 2022	FTX	about $477M	outflow on the day of the bankruptcy
September 2026	Bitget	about $352M	covered from its protection fund
May 2019	Binance	7,000 BTC	covered from the SAFU emergency fund

AI-generated illustration

Why do crypto exchanges get hacked so often?

There are not more attacks, there are bigger ones. According to Chainalysis about $3.4 billion in crypto was stolen in 2025, about $2 billion of it by groups attributed to North Korea, as Bloomberg Law reported. The number of North Korean attacks fell while the loot per attack rose. Four reasons explain it:

Hot wallets hold billions. Exchanges need coins they can pay out instantly. These hot wallets are online, and the bigger the exchange, the more they hold. Professional attackers. Groups like Lazarus work like intelligence services: they prepare attacks for months, apply for jobs at crypto firms under false identities and go through employees and service providers instead of the blockchain. New attack surfaces. In the Binance case the attacker used EIP-7702, a feature live on Ethereum since the Pectra upgrade in May 2025. With a single signature a wallet can hand its control to a contract. Whoever obtains that signature owns the wallet. People, not machines. In the 2025 Bybit hack the entry point was not the exchange itself but a developer's computer at a service provider. AI-written messages make such attacks even more convincing, as Changpeng Zhao warned before the incident.

Tornado Cash, Tron and the dark web: where does the money go?

Many ask why money from a Binance wallet flows "into the dark web". Strictly speaking it stays on the blockchain, visible to anyone. Three tools make it opaque:

Tornado Cash is a mixer on Ethereum, not part of the Tor network. It pools deposits of many users so that it is no longer traceable who withdrew what. In the Binance case the attacker's address was funded with 0.1 ETH from Tornado Cash, so the gas money leaves no trail to his identity. Tron and bridges. Stolen funds often move across bridges to other blockchains. Tether is especially widespread on Tron and is often swapped for cash there through over-the-counter dealers. Decentralized exchanges. What cannot be frozen, such as Ether, attackers swap in small tranches. About 195,460 ETH still sit on an attacker address according to Etherscan.

That Tether and Circle could freeze so fast this time is the biggest difference to earlier cases. In the Bitget hack in September the stablecoins were swapped into Ether within minutes and only about $318,000 could be frozen, as Decrypt reported.

AI-generated illustration

More on the Binance hack

Binance hack: how the hot wallet was drainedLive ticker and timeline: the crypto crash after the hackUSDT frozen: what Tether and Circle really blockedBinance withdrawals: which networks are pausedIs this the end? Three scenarios for BitcoinEthereum: the hacker sits on 195,000 ETHSolana below $100: is $80 next?BNB crash: another FTT moment?How to short Bitcoin in the crashWhy is crypto down today?

What did past exchange hacks mean for prices?

The list shows a pattern: what mattered for the market was never the amount but whether the exchange stayed solvent.

Covered and kept trading: Binance 2019, Bybit 2025 and Bitget 2026 covered the loss from their own funds or protection funds. Prices dipped briefly and recovered once withdrawals ran. Insolvent: Mt. Gox 2014 and FTX 2022 collapsed. There the market fell for weeks because customer money was missing.

According to DefiLlama's public address data Binance holds about $144 billion in customer assets, and the loss equals just under 2% of that. On current information the first pattern looks more likely than the second. How low Bitcoin could fall in either case is covered in our three scenarios after the Binance hack.

How to protect your coins from the next hack

Only keep what you trade on an exchange. Larger holdings belong on a hardware wallet whose keys only you hold. Our hardware wallet comparison shows the devices. Look for licences and protection funds. Which exchanges are regulated is shown in our comparison of regulated exchanges. Never sign what you do not understand. Since EIP-7702 a single signature can hand over control of a wallet. Check every request your wallet shows and reject what you did not trigger yourself.

This article is not investment advice. We will update the list as Binance completes its investigation.