VERALO · DATA, EXPLAINED

$6.3 Billion in 20 Minutes: The Numbers Behind the Biggest Hack in Crypto History, Visualized

Veralo Editorial · October 31, 2026 · 6 min read

Cracked digital vault with frozen and flowing Bitcoin streams representing the $6.3 billion Binance hack.

On the evening of October 29, 2026, attackers drained an estimated $6.3 billion from Binance’s hot wallets in about 20 minutes. By the numbers alone, it is the largest cryptocurrency theft in history — roughly four times the $1.5 billion taken from Bybit in February 2025. But the raw total is the least interesting number here. The more telling story is in the breakdown: how much was frozen, how much is still moving, who is paying to make customers whole, and what the market did in response.

This is a developing story. Figures below are as reported through October 31, 2026, and several are Binance’s own estimates, subject to revision.

The headline numbers

$6.3 billion — Binance’s estimated loss from the breach, which began around 20:05 UTC on October 29.
~20 minutes — how long the bulk of the theft took to unfold, according to TRM Labs and Chainalysis (as reported by AP and Blockonomi).
4x — how the haul compares to the previous record, the $1.5 billion Bybit hack of February 2025.
$3 billion — stolen assets frozen so far with the help of partners.
$6.34 billion — the amount Binance says it has set aside from its own funds to restore customer balances.
18,270 — the number of stolen Bitcoin now sitting in 19 wallets that no one can freeze.

Where the $6.3 billion went: a flow breakdown

Think of the stolen funds in three buckets.

Frozen: ~$3 billion. Stablecoin issuers moved fast. Tether froze nearly $1.56 billion, and Circle CEO Jeremy Allaire said the company froze more than $800 million in USDC (figures via Forbes). Stablecoins can be frozen because a company issues them and controls the blacklist. That’s roughly half the haul stopped before it could be laundered.

Moving: ~$1.4 billion in Bitcoin alone. The attackers split roughly 18,270 BTC across 19 wallets in what analysts call a “peel chain” — a technique that peels small amounts off a large balance through a chain of addresses to obscure the trail (CoinDesk). Unlike stablecoins, Bitcoin has no issuer. There is no company to call, no freeze function. Those coins can only be stopped if and when they reach an exchange, OTC desk, or swap service willing to block them. As of this writing, the wallets are unmoved.

Covered: $6.34 billion backstop. Binance says it has set aside more than $6.34 billion of its own money to restore customer balances (CoinDesk). About $5 billion is already held in the exact tokens that were taken; the remaining ~$1.3 billion is being bought on public markets and over the counter. In other words, Binance is absorbing the loss on its own balance sheet rather than passing it to users.

$6.34 billion in context

To grasp the scale of that backstop: Tether — the largest stablecoin issuer — reported about $1.5 billion in Q3 2026 operating profit, with excess reserves nearly doubling to roughly $7.95 billion (BDO attestation, via Cointelegraph). Binance’s self-funded backstop is more than four times Tether’s quarterly profit. It is one of the largest corporate loss-absorptions in crypto history, and it only works because the exchange’s balance sheet is that deep.

The market footprint

The hack landed in an already fragile market, and the data shows the stress clearly:

Bitcoin fell to ~$76,260–$76,368 on October 30, a six-week low (Reuters), and traded near $77,000–$77,300 on October 31 — down about 4% on the day of the attack.
Bitcoin dominance held at 59.2% of a $2.6 trillion total crypto market — capital concentrated in BTC as altcoins sold harder (TRON fell 7.14% to lead major-token losses).
Spot Bitcoin ETFs lost ~$643 million on October 30 — the largest single-day outflow since September 25 — led by BlackRock’s IBIT at $233.7 million (SoSoValue, via Blockchain Reporter). Ether ETFs lost $155.85 million, a fifth straight day of outflows.
The Crypto Fear & Greed Index dropped to 30 — firmly in “Fear.”
Liquidations collapsed as the panic priced in: about $311 million in 24 hours on October 31, down from roughly $1.33 billion the day before (MyCoinDeck, tracking 15 exchanges).

Zoom out further and the damage compounds: Bitcoin is tracking toward what could be its worst October performance in twelve years, sitting roughly 39% below its $126,000 record from October 2025.

How it happened: what the data says so far

The attack vector, per Binance co-CEO Richard Teng, was a “complex attack” that may have begun with a compromised software engineer’s laptop, with social engineering suspected. TRM Labs and Chainalysis link the attack’s patterns to North Korean hackers — though there is no official attribution, and North Korea routinely denies involvement in crypto thefts.

One technical footnote worth knowing: Bitcoin Core disclosed three node vulnerabilities on October 28 (fixes shipped for versions 29.5, 30.4, 31.2, and 32.1). One could let an attacker flood a node on Windows, macOS, or BSD with data until it crashed. These concern full-node operators, not ordinary holders — but the timing, one day before the Binance breach, made for an unnerving week.

The industry’s response is already measurable. Coinbase said it adjusted the systems that store its cryptocurrency keys offline. OKX CEO Star Xu publicly called for a real-time alert system so exchanges can share hack data and freeze suspect funds faster — an admission that the industry’s current coordination is too slow for 20-minute heists.

What to watch next

Three dates matter:

This weekend — Binance is targeting a phased restart of withdrawals within about 34 hours of its October 30 update, subject to security checks. Deposits were never affected.
November 2 — Binance’s proof-of-reserves results are due. After a $6.3 billion hole, the industry will read those numbers closely.
The 19 wallets — 18,270 BTC, unmoved. The moment those coins stir, chain analysts (and markets) will notice.

The bottom line

$6.3 billion in 20 minutes is a record, but records get broken. The durable numbers are the structural ones: stablecoins can be frozen and Bitcoin cannot, which is why the same hack produced two completely different outcomes for different assets. An exchange can absorb a $6.34 billion loss only if its balance sheet allows it. And 20 minutes is now the benchmark — the industry’s defenses are being measured against a stopwatch, not a calendar.

Sources (checked October 31, 2026): CoinDesk (Binance $6.34B backstop, 19-wallet peel chain, EIP-7702 explainer); Reuters via ad-hoc-news.de (six-week low, $3B frozen, 34-hour restart target, PoR Nov 2); AP via Blockonomi (20-minute attack window, TRM Labs/Chainalysis attribution, no official attribution); Forbes via Blockchain Reporter (Tether $1.56B freeze, Circle $800M USDC freeze, largest-theft framing); SoSoValue via Blockchain Reporter and Crypto Briefing ($643.33M BTC ETF outflows, $155.85M ETH ETF outflows); CoinMarketCap via Blockchain Reporter/LoopWire ($2.60–2.62T market cap, BTC ~$77,300, BTC dominance 59.2%); MyCoinDeck via YouTube ($311M vs $1.33B liquidations); Cointelegraph/Investing.com (Tether Q3 $1.5B operating profit, $7.95B excess reserves, BDO attestation); Coinjuice ($77,174 at 05:59 UTC Oct 31, $76K level analysis); 99Bitcoins (71 Fed decisions analysis, 50-week EMA $78,637).

All loss and freeze figures are Binance’s and partners’ estimates as reported, subject to revision. This is a developing story; numbers will move.

Share on Facebook ↗ · Share on X ↗