Binance hack: the largest robbery in financial history

On Thursday, October 29, Binance experienced a $6.3 billion hack. So far, $3 billion has been frozen and is protected from loss. Binance says it will cover every loss.This is the largest robbery in financial-market history, surpassing Bybit in 2025 ($1.5 billion) and the Central Bank of Iraq in 2003 (~$1 billion). Bitcoin fell just over 2% in the 24 hours following the hack. This is significantly less than Bitcoin's 26% drawdown following the infamous FTX issue of November 2022. Bitcoin itself was not hacked: this was a security breach at one company, Binance.No impact to 21shares' physically-backed ETPs; all products are trading normally.

Binance hacked for $6.3 billion

On Thursday, October 29, Binance experienced a $6.3 billion hack, the largest theft in history. In response to the hack, Binance has paused withdrawals (deposits have resumed), though it expects to resume within 48 hours, and says it will cover all losses from its Secure Asset Fund for Users (SAFU) emergency fund and company funds.

Source: 21shares, Arkham, stolen by chain, posted 05:20 CET; values at the time of the theft (on-chain estimate, not confirmed by Binance). USDT = $1,875.46M on Ethereum + $612.73M on Tron. *Derived: Arkham’s Ethereum total ($3,738.66M) minus the USDT, USDC and ETH it itemises; includes tokens such as wBETH and RLUSD. **Arbitrum, Avalanche, Polygon, Optimism and Base, as grouped by Arkham.

Binance reports that about $3 billion of the stolen assets is frozen onchain (and so protected from loss), which leaves about $3.3 billion still at risk of loss. Freezing works only for tokens whose issuer or governing body can block specific addresses.

Stablecoins, tokens designed to track the US dollar, are one example. Stablecoin issuer Tether froze more than 1.6 billion USDT and Circle more than 800 million USDC, while the Security Council of Arbitrum, a network built on Ethereum, moved 75 million ARB and 8,425 ETH to a frozen wallet.

If unfrozen assets, worth up to $3.3 billion, are moved toward services that obscure the origin of funds (known as ‘mixers’), then recovery prospects for them are narrow.

Source: 21shares Binance, 03:25 and 01:52; Arkham, 05:20 (est.); issuer statements. ARB, ETH and PAXG $ values use CoinGecko prices at 06:48 CET (PAXG via the XAUT gold price). Issuer amounts are “more than” floors and may overlap Binance’s ~$3 billion.

Binance will cover all losses

Binance says it will cover all losses from SAFU and company funds. Its SAFU emergency fund holds 15,000 bitcoin, about $1.18 billion at $78,509 per bitcoin (CoinGecko as of 30 October 2026). That covers about 36% of the $3.3 billion not frozen and leaves about $2.1 billion, which will come from company funds. As of 1 October 2026, its proof of reserves showed net user balances of $134 billion against onchain holdings of about $136 billion, a surplus near $2 billion (ChainCatcher).

Binance has met a loss before, when in May 2019 its SAFU covered 7,000 bitcoin, about $40 million, in full.

Binance's initial finding points to a compromised DevOps engineer's laptop, with no sign that any wallet private key leaked. Binance has not disclosed its fund-approval process, and no evidence shows that one person could approve these transfers, and nothing indicates an insider job.

Chainalysis says it has a high degree of confidence that North Korea is responsible, though Binance and no government entity has confirmed attribution. If this does prove to be the case, recovery of the unfrozen funds is unlikely. Groups linked to North Korea typically launder through swaps and bridges that move tokens between blockchains, and through mixers, and funds not frozen early are rarely recovered. Attribution also carries sanctions weight, since the US Treasury's Office of Foreign Assets Control (OFAC) sanctions Lazarus Group and related North Korean cyber groups, so anyone handling the stolen funds could face compliance questions.

A spillover into decentralized finance (DeFi), lending and trading applications that run on blockchains without a central operator, was contained. The attacker supplied 60 million stolen USDT to Aave, a DeFi lending protocol, and borrowed 19,762 wrapped ether (WETH), about $44.6 million, within about three minutes. Aave froze its markets as a precaution and reported no bad debt, meaning no loan whose collateral it cannot cover, because the position remains over-collateralized (LlamaRisk, Aave governance forum).

Source: 21shares, Binance, 03:25 and issuers (official). Est.: Arkham (05:20, swaps, movable, 06:24), LlamaRisk, Lookonchain, EmberCN, ZachXBT. CoinGecko: PAXG $3,991.74 (11:05), ETH $2,245 (06:25). Remainders computed.

What does this mean for 21shares

21shares’ physically-backed exchange-traded products (ETPs and ETFs) are not exposed to Binance. Underlying digital assets are held in cold storage by regulated third-party custodians, including BitGo, Coinbase Custody, Anchorage Digital, and Zodia Custody. 21shares does not hold assets in exchange accounts, thus separates product assets from any exchange’s balance sheet, so incidents like yesterday’s hack do not touch the assets backing our ETPs.

Furthermore, liquidity for 21shares ETPs does not depend on a single venue: our market makers source liquidity across multiple trading venues and exchanges, so there is no single point of failure.

As a result of the operating structure that 21shares has created for managing digital assets, all our ETPs are trading normally today.

Proud of our operational excellence

21shares has been managing its assets with this level of operational excellence since the launch of our very first ETP in 2018, and we are proud to be the only digital asset manager that has maintained continuous trading of every product for over eight years.