Binance suffers record hack: what Thai users should know

In about 20 minutes, a huge sum of crypto drained out of Binance, the world's largest crypto exchange, in a theft that may total around 200 billion baht. It is the biggest hack the crypto world has seen. So how worried should Thai traders be?

TRM Labs, a firm that traces crypto transactions, estimates that about $6.36 billion was taken from Binance wallets on 10 blockchains, starting at around 3 a.m. on 30 October 2026, Thailand time. Chainalysis puts the figure at about $5.9 billion. The estimates differ, and Binance has not published its own loss figure, according to CoinDesk.

Binance co-CEO Yi He said all deposits and withdrawals were temporarily suspended and that Binance will cover all losses. If TRM Labs' figure holds, the theft is about four times the previous record, the $1.5 billion Bybit hack in February 2025.

The money left through the hot wallet

Exchanges keep customers' funds in two places. A hot wallet stays connected to the internet so it can pay out withdrawals. A cold wallet is kept offline and holds the bulk of the money. Think of a shop's cash drawer and the safe in the back room. This time the thieves got into the drawer, but Binance's drawer held billions of dollars.

Binance's initial investigation, shared on Telegram, suggests the incident may involve a compromised DevOps engineer's laptop, and it has found no evidence of a wallet private key leak, CoinDesk reported. TRM Labs assesses that the attackers got Binance's signing system to approve transfers out. On Ethereum, a single transaction moved 167,464 ETH.

The trail points to North Korea

TRM Labs attributes the attack with high confidence to TraderTraitor, a North Korean hacking group the FBI also named for the Bybit hack, and says preparation began at least 36 hours before the theft.

The good news is that coin issuers including Tether, Circle and Ripple have frozen about $2.7 billion in linked tokens. The bad news is that the attackers still hold about $2.4 billion in ETH and BTC that no issuer can freeze, and have started laundering some of it, according to TRM Labs.

Binance TH says Thai customers' assets are safe

Binance TH, the exchange Thai users trade on, is licensed in Thailand and run by Gulf Binance, a joint venture of the Gulf group and Binance. It said customers' digital assets on Binance TH remain safe because its cold wallet is separate from and independent of Binance, and it temporarily paused digital asset deposits and withdrawals for security checks while other services run as usual, Thansettakij reported.

Markets took the hit too. Bitcoin fell about 2% to $77,646, and BNB, Binance's own coin, dropped more than 8% to $694, Thansettakij reported.

Expect a wave of scams

Every big incident like this brings fake messages claiming to be Binance support and asking users to click a link to "verify your account now". Binance TH has said it will never ask for personal information, passwords or OTP codes by SMS, email or phone.

There are three things you can do now.

1. Don't click links in texts, emails or chats that claim to be from Binance, however urgent they sound.
2. Check when deposits and withdrawals reopen only in the official Binance or Binance TH app or website.
3. Turn on two-step verification with an authenticator app instead of SMS if you haven't already.

Sources

• TRM Labs: North Korea steals USD 6.36 billion from Binance in the largest hack in history
• CoinDesk: Live updates, Binance confirms security breach
• TechCrunch: Binance pauses withdrawals as hackers suspected of stealing billions in crypto
• Thansettakij: Binance may have been hacked for $5.6 billion
• Binance TH: warning about fake messages