The $6.3 Billion Binance Hack, Explained in Plain English
October 31, 2026
On Thursday night, October 29, about $6.3 billion in cryptocurrency left the wallets of Binance, the world's largest crypto exchange. Most of it moved in roughly twenty minutes. It is the largest theft in the history of crypto - about four times the previous record - and as of this writing, around $3 billion of it is simply gone.
The news coverage is full of terms like "hot wallets," "private keys," and "on-chain." Here is what actually happened, without the jargon.
How digital money moves
Every form of digital money - Bitcoin, a bank transfer, a Venmo payment - works the same way at the bottom: a computer system has the authority to say "move this money from here to there," and a payment happens when that system is told to do it by someone it trusts.
On a public blockchain like Bitcoin or Ethereum, the "someone it trusts" is whoever holds a secret code called a private key. Think of it as a signature that can't be forged. If a transfer carries the right signature, the network accepts it, and that's the end of the matter. There is no bank in the middle, no customer service line, and no undo button. Irreversibility is the design - it is what makes the system work without a central authority.
An exchange like Binance holds crypto on behalf of millions of customers, which means Binance - not you - holds the keys. To let customers withdraw quickly, it keeps part of that money in "hot wallets": accounts whose keys are on computers connected to the internet, ready to sign withdrawals automatically. The rest sits in "cold storage," offline, where no hacker can reach it.
What happened
According to Binance's early findings, the attackers got into the laptop of a Binance engineer. From there they worked their way into the company's internal systems and reached the service that approves withdrawals. Then they did the simplest possible thing: they told Binance's own system to send money out, and the system - believing the instructions came from inside the company - signed the transfers.
Binance has said it found no evidence that a private key was stolen. The attackers didn't need one. They got control of the machinery that uses the keys, which amounts to the same thing. Seventeen hot wallets were emptied across nine or ten different blockchains, with most of the money going out in a twenty-minute burst before anyone could react. Binance later described it as a "complex attack" with more than one point of entry, and blockchain analysts have attributed it with high confidence to a North Korean state hacking group that was also behind the $1.5 billion Bybit theft last year.
Why about half of it was recovered - and half wasn't
Here the story splits in two, and the split is instructive.
Roughly $3 billion of the stolen funds were in "stablecoins" - digital dollars issued by companies like Tether and Circle. Those companies can freeze any balance on their systems, and within a few hours they did, locking the thieves out of that money. It's the one place in this story where someone had an undo button, and it worked.
The other half was in Bitcoin, Ether, and similar assets that have no issuer and no freeze function. Once those transfers were signed, they were final. The thieves still hold roughly $2.9 billion of it, sitting in fresh addresses, and investigators can watch it but can't touch it.
Binance has said it will make every customer whole out of its own emergency fund and balance sheet, and that withdrawals will resume within a couple of days. If that holds, ordinary users won't lose money. The company will.
What this has to do with TxGold
We've had a few people ask, so here is a plain description of how TxGold is different. I want to be careful about the word "different" - this isn't a claim that we're safer. Every system has risks, and the lessons from this week apply to anyone who moves money electronically, including us.
- We don't run on a public blockchain. TxGold runs on a private network that we operate. Transactions are recorded in our ledger, not on Bitcoin or Ethereum, and there is a company behind it that can see and act on what happens.
- We don't hold customers' private keys. When you set up TxGold, your phone creates a key that never leaves the device. Every payment you send is signed on your phone, by you. There is no central wallet full of customer funds that a single break-in could drain.
- Customers who fund with crypto send it to us; we don't keep it. When a deposit arrives we immediately convert it to physical gold, held in the Texas Bullion Depository under a bailment agreement. We are not a crypto exchange and we don't custody crypto for anyone.
None of that makes us immune to the broader lesson here, which is older than any blockchain: whoever controls the authority to move money has to protect it, and the way a system is built determines what happens when that protection fails. Binance will be writing a post-mortem on that question. So, quietly, should everyone else in this business.