US$6.3bnis what Binance, the world’s biggest crypto exchange, says last week’s hack hit, the largest crypto theft on record. About US$3bn of it has since been frozen. Coins you leave on an exchange aren’t in your hands. They’re an IOU from a company that can be robbed.
Source: CoinDesk (29 Oct 2026)
If you bought bitcoin through an app and never moved it, you don’t hold bitcoin. You hold a promise from the exchange that it will give you bitcoin when you ask. On Thursday 29 October, Binance, the biggest exchange in the world, suspended deposits and withdrawals after hackers drained its online wallets in what it estimates is a US$6.3 billion hit. About 22% of Australians hold digital assets, according to a survey by the exchange Gemini. Many of them keep those coins with the same kind of company that was just hit: an exchange.
How it works
How the money got out
Binance’s first account of the attack, in 4 steps.
Binance says it found “no evidence of any wallet private key leak”. It didn’t need one. The attacker used Binance’s own systems to send the coins out, from the “hot” wallets that stay online so customers can trade and withdraw quickly. Around 30 to 40 different tokens were taken, including bitcoin, ether and the dollar stablecoins USDT and USDC.
What we know so far
- It is the biggest crypto theft ever recorded. Chainalysis put the amount stolen at about US$5.9 billion at the time of the theft. Binance’s US$6.3 billion is its estimate of the total impact.
- Investigators point at North Korea. TRM Labs says it has “high confidence” the attack was the work of TraderTraitor, a North Korean hacking group. Investigator ZachXBT names the Lazarus Group. As of 30 October, neither the FBI nor Binance had confirmed it.
- Some of it was stopped. Tether froze more than US$1.57 billion of its USDT and Circle more than US$800 million of its USDC. That only works for coins a company controls. Bitcoin and ether can’t be frozen this way.
- Binance says customers won’t lose a cent. Co-CEO Yi He said it would cover “all hacking losses” from its SAFU emergency fund, worth about US$1 billion, and company money. Binance held about US$144 billion before the hack.
The thefts keep getting bigger
The previous record lasted 20 months. In February 2025, North Korean hackers took about US$1.5 billion from Bybit. Across 2025, Chainalysis says North Korea stole just over US$2 billion, up 51% on the year before, out of US$3.4 billion stolen worldwide. The amount targeted in this one hack is bigger than all of that.
Biggest crypto hacks of 2025–26
US$ billions, estimated
Binance figure is its estimate of total impact; about US$3 billion has been frozen.
Sources: CoinDesk, citing DefiLlama; Bloomberg
RMIT economist Chris Berg told the ABC there has been a recent run of hacks and security holes found with the help of frontier AI models. Whatever the cause, the target is clear: one company holding billions in coins for millions of people is worth attacking.
Binance says it can absorb this one. The loss is about 4% of the customer assets it held, but covering it depends on Binance’s own reserves, which it doesn’t fully disclose. The next exchange may not be so big. When FTX collapsed in 2022, its customers’ IOUs were frozen for years. And Binance isn’t a spotless guardian here either. In March, its Australian derivatives arm was ordered to pay a A$10 million penalty after it wrongly treated 524 retail clients as wholesale, mostly “sophisticated”, investors, who then lost A$8.66 million. Australia’s new law requiring crypto platforms to hold a financial services licence became law in April, but doesn’t take full effect until 9 April 2027.
The fix: hold your own keys
You can’t stop hackers going after exchanges. You can make sure your savings aren’t sitting there when they do. Use an exchange to buy and sell, then move anything you plan to keep into a wallet only you control. Self-custody moves the risk onto you: lose your recovery words, or let malware onto your phone, and nobody can get your coins back. And stablecoins like USDT and USDC can be frozen by their issuers in any wallet. For anything you plan to keep, that trade is still worth it.
What each fix does
Each one takes you out of the exchange’s blast radius.
Sources: Bitcoin Magazine via Nasdaq; Proton’s wallet security model
The Proton links below are affiliate links: I earn a commission if you sign up, at no cost to you.
Proton Wallet
A free bitcoin wallet from the Swiss company behind Proton Mail. It’s self-custodial: Proton doesn’t have access to your private keys, so a breach of Proton’s servers alone shouldn’t expose your coins. It’s still an online wallet, so turn on 2FA and keep your phone clean. It’s bitcoin only, with no Lightning payments yet. When you set it up, write down the 12-word recovery phrase on paper and keep it somewhere safe; it’s optional in the app, but without it a lost phone means lost coins.
Get Proton Wallet →A hardware wallet
For savings you’d hate to lose, a hardware wallet such as a Trezor or Ledger keeps the keys on a small device that never exposes them to the internet, and asks you to confirm every payment on its own screen. Buy only from the maker or an authorised reseller, never second-hand, and never type its recovery words into a computer or phone.
See Trezor →
Proton Pass
Most people still need an exchange account to buy and sell. Give it a unique password and turn on two-factor login. Proton Pass is an end-to-end encrypted password manager with email aliases, so a leaked shopping-site password can’t open your exchange. Pass Plus adds a built-in 2FA code generator, though a separate authenticator app or security key is stronger for an exchange. This link gives a 14-day trial of Plus and US$20 off a paid plan. In your exchange settings, switch on withdrawal address allow-listing too.
Try Proton Pass →Do this today
- 1. Check what you hold on exchanges. Leave only what you’re actively trading.
- 2. Move your bitcoin to your own wallet, such as Proton Wallet, and write the recovery words on paper. For other coins, use a hardware wallet.
- 3. For bigger sums, get a hardware wallet straight from the maker.
- 4. Lock down your exchange login with a unique password, 2FA and an address allow-list.
For why governments want their own digital money instead, read what central bank digital currencies would mean for your cash.
What to make of it
The biggest crypto exchange in the world just lost billions to a single compromised laptop. Binance says it will make customers whole, and it can probably afford to this time. But the whole point of bitcoin was that you didn’t have to trust a middleman. If your coins sit on an exchange, you’ve brought the middleman back. Keep what you trade there, and take the rest home.
Sources
- CoinDesk (2026): Binance loses over $6 billion in the largest crypto hack to date
- ABC News (2026): Billions stolen as Binance targeted in largest cryptocurrency hack in history
- Bloomberg (2025): Bybit hit by crypto’s worst hack with almost $1.5 billion stolen
- The Register (2025): Kim’s crypto thieving reached a record $2B in 2025 (Chainalysis)
- CFOtech Australia (2025): Australian crypto adoption grows as 22% invest in digital assets (Gemini survey)
- ASIC (2026): Binance Australia Derivatives ordered to pay $10 million penalty
- ASIC (2026): Final call for firms to act before ASIC’s digital asset licensing deadline
- Proton: Proton Wallet security model
- Nasdaq / Bitcoin Magazine: Proton Wallet is a great starter self-custodial bitcoin wallet
Proton links are affiliate links.
This article is general information, not financial advice. Consider your own circumstances before acting.