The notification hit my phone past midnight, and crypto feeds were already in a panic. Rumors said Binance’s internal signing services had been breached and that billions were leaving its hot wallets across several chains within minutes.
So, can a crypto exchange be hacked? I opened the Binance app to pull my portfolio into a cold wallet and got a loading screen that never finished. Nothing tests your faith in a spinner like a rumor about billions. Meanwhile, on-chain trackers were flagging huge unauthorized outflows to addresses nobody recognized, and the figure they kept quoting settled at $6.3 billion.
About half an hour later, the official word began to arrive. Tether and Circle moved to freeze stolen tokens, and Binance said the breach hit its hot wallets and that user funds would be covered in full. My balance was intact. The relief lasted about a minute, and then I spent the rest of the night rebuilding how I store my coins.
Can a crypto exchange be hacked? Yes, and October 29 set the record
Binance puts the loss from its October 29, 2026 hot wallet theft at about $6.3 billion, roughly four times the $1.5 billion Bybit theft that held the previous record. According to Crypto Briefing, the money was left across about 10 blockchains in around 20 minutes.
One detail matters if you live in the US. The hack hit Binance.com, which blocks American customers, although some probably get in through VPNs. Binance.US, the smaller platform for users in certain states, was not part of it. Most US readers dodged this particular bullet.
The method is the part that travels. It would work on any exchange that runs its withdrawals the same way, which is why the rest of this article is about how the attackers got in and what that means for you.
The attackers did not crack the code. They borrowed the keys.
The stolen withdrawals carried valid signatures from Binance’s own hot wallet infrastructure. The approval path that should have blocked them signed them instead. In its first report, Binance said attackers reached an internal wallet signing service and used it to move funds outside the normal withdrawal process, as TradingView’s Cointelegraph feed reported.
How did they reach that service? Early investigations pointed to a compromised laptop belonging to a DevOps engineer, which reportedly handed the intruders access to the systems that sign wallet transactions. Later analysis described a multi-month campaign instead of a single slip.
The nonprofit group SEAL estimated that the North Korea-linked group TraderTraitor had been inside Binance’s systems about eight weeks before the theft. Binance said employee devices were infected through fake job interviews, which let the attackers steal credentials, according to BigGo Finance. One more detail stings. Binance spotted and replaced one infected device, but by then the attackers already had the team structure and the wallet layout.
Accounts of the timeline differ. One write-up on TechFlow says the intrusion began in June, when an engineer downloaded a tampered installer for an AI coding assistant. I would treat the exact dates as unsettled until Binance publishes a full post-incident report.
Notice what is missing from every version of the story. Nobody broke encryption. Someone got a laptop, a credential, or a job applicant’s trust, and the rest followed.
Why hot wallets are the soft spot
Co-CEO Richard Teng said most customer assets sit in offline cold storage and move to hot wallets only when users request withdrawals. That is the standard design, and it explains why an exchange hack this large does not mean every customer’s coins vanished.
The catch is that hot wallets have to stay connected so withdrawals can run automatically. Alex Tobol, chief technology officer at the wallet Walt, told Cointelegraph that billions in a hot wallet is not unusual for an exchange of Binance’s size. He added that refilling the wallet from cold storage should require a separate treasury decision and manual approval.
On Ethereum, attackers drained one hot wallet again and again as new deposits arrived, which points to an exploit that stayed live. Binance has kept the technical details private to avoid helping future attackers. Rivals such as Coinbase and Upbit have since disclosed their cold-storage ratios.
I read that contrast as a question worth asking. Before you park real money anywhere, find out whether the exchange publishes how much of its customer assets sits offline. An exchange that will not say is telling you something, even if only that it is nervous.
How often do exchange hacks happen?
Less steadily than the headlines suggest, and in larger lumps. Chainalysis counted more than $3.4 billion stolen in 2025, with roughly 59% traced to North Korea. The top three hacks alone made up 69% of the total.
The 2026 numbers lean even harder in one direction. Chainalysis says North Korea-linked hacks account for nearly 89% of reported hack losses this year, up from 15% in 2021. The FBI attributed the Binance breach to TraderTraitor. Chainalysis tied it to North Korea partly because the stolen Binance funds mingled with money taken from Bitget a month earlier.
None of this started in 2026. Mt. Gox lost more than 850,000 bitcoin in 2014. Coincheck lost hundreds of millions of dollars in NEM in 2018 and later repaid 260,000 customers from its own money. Binance itself lost over $40 million in Bitcoin from a hot wallet in 2019, per Money Crashers.
What changed is the target. Chainalysis’s 2026 report says North Korean actors increasingly embed IT workers inside crypto services to gain privileged access. Attackers have stopped hunting for bugs and started applying for jobs.
What protects your money in the US
Not the government. Fidelity states plainly that crypto is not insured by the FDIC or protected by SIPC, and FINRA’s investor guidance says the same about SIPC. Some platforms hold customers’ dollar balances at insured banks, but that only covers a bank failing. It does not cover the exchange failing.
Even US-based platforms say it outright. Kraken’s disclosures state that its digital asset accounts are not FDIC insured or covered by SIPC, though its separate brokerage accounts carry standard SIPC protection.
So repayment depends on the exchange’s own willingness and its own wallet. Binance’s co-CEOs, Richard Teng and Yi He, committed to covering all losses from corporate funds, and the exchange has set aside more than $6.34 billion, a pool that includes its SAFU reserve. Stablecoin issuers and partners froze about $2.85 to $3 billion of the stolen assets, and withdrawals have resumed, per Cryptonews.
That is the good outcome, and it is not guaranteed. NBC reported years ago that an exchange with deep pockets and an emergency fund can compensate customers, while one without often goes out of business. Mt. Gox creditors, as 247WallSt notes, have waited nearly 13 years and still are not fully repaid.
Can a crypto exchange be hacked again? Assume so
Binance was not the only exchange hit this fall. Chainalysis linked a $387 million Bitget theft to North Korea in the weeks before the Binance attack. SEAL found that the Bitget, Kelp DAO, and AFX hacks also involved pre-access periods of three to six weeks, so the pattern is patience, not speed.
That has a practical consequence. An exchange that looks fine today may already host a visitor it has not noticed. A clean record tells you how the company behaved before, not what is happening on its network this week.
I would stop asking which exchange is unhackable and start asking what I lose if mine is the next one to be hacked. The honest answer is the balance sitting there, and that is a number you control.
What I changed that night
The adrenaline turned into an impromptu security overhaul. I moved my core assets onto hardware keys and reminded myself of something I already knew: exchange convenience always carries systemic risk. The convenience is real. So is the risk, and it does not show up on the screen until a night like that one.
My rule now is simple. Keep on an exchange only what you actively trade, and keep the rest offline where no one’s laptop can sign for it. Cold storage is not a magic fix, though. Chainalysis has flagged a rise in personal wallet compromises, and the social engineering that works on an exchange engineer works on you too. A fake support message or a tampered download defeats a hardware key just as easily if you approve the transaction yourself.
When you move coins to a new wallet, send a small test amount first, and keep your recovery phrase on paper that never touches a camera or a cloud folder. Read every signing prompt like it is a contract. If a request surprises you, stop and verify it through a channel you started, not one that contacted you.
As for the exchange side, the open questions are still open. Binance has promised to publish Proof of Reserves, and observers are also waiting on a detailed post-incident report and on how much of the stolen money gets recovered. As of early November 2026, I have not seen either document. Until they arrive, I am keeping my own keys.
