The Binance hack India is searching for ran for about 20 minutes. According to blockchain analytics firm TRM Labs, roughly $6.36 billion (about ₹60,000 crore) left the exchange’s wallets from 20:05 UTC on 29 October 2026, which was 1:35 am IST on 30 October. Binance is registered with India’s Financial Intelligence Unit, yet India has no dedicated crypto statute and no single regulator for exchanges. No earlier crypto exchange hack has tested that arrangement as hard.
The Binance Hack Was a $6.3 Billion Sweep in 20 Minutes
The Binance hack affected an estimated $6.3 billion, according to Binance, which says it will cover every loss. TRM Labs counts about $6.36 billion moved across 10 blockchains, most of it in roughly 20 minutes. Deposits are working. Withdrawals are suspended while Binance rebuilds its withdrawal service, and the exchange expects to restore them by Sunday, 1 November.
The official Binance hack account changed overnight.
Its first statement blamed the compromised laptop of a DevOps engineer, which let an attacker reach a service container and submit unauthorised withdrawals. By Friday, co-chief executive Richard Teng said investigators had found additional points of breach and that this was no “one-click” action. Binance says it has found no evidence of leaked private keys, and a root-cause report is promised.
TRM’s technical reading of the Binance hack is more specific, and Binance has not confirmed it. Signatures were gathered in advance and fired in a single burst, using an Ethereum feature called EIP-7702 to make a Binance hot wallet obey only the attacker. Small withdrawals from Tornado Cash, a mixing service, funded the operator’s wallet beforehand.
Tether Froze $1.6 Billion, but About $2.4 Billion Was Already Out of Reach
About $3 billion (roughly ₹28,500 crore) is frozen, according to Binance, because much of the haul sat in stablecoins whose issuers can block specific addresses. Tether’s chief executive, Paolo Ardoino, put his company’s freeze at about $1.6 billion in USDT, and Circle’s Jeremy Allaire said more than $800 million in USDC. TRM estimates the attacker still holds about $2.4 billion (roughly ₹22,800 crore) in ether and bitcoin that no issuer can touch.
Read that from a sanctions desk.
The brake was not a court order, a naval patrol or a treaty. It was a private company’s freeze, which TRM says landed 37 minutes after the main Ethereum sweep, while the attacker was selling about 325 million USDT to market makers at a discount of roughly 10 per cent for 122,300 ETH. Binance has said it will use company funds alongside its SAFU insurance fund, which held about $1 billion in February 2026.
Markets priced the Binance hack within hours. Bitcoin fell below $77,000, forced liquidations across crypto reached about $1.57 billion, and BNB, Binance’s own token, dropped between 5 and 10 per cent in early trading, depending on the report.
Analysts Call It a North Korea Crypto Hack, but No Agency Has Yet
TRM Labs attributes the Binance hack “with high confidence” to TraderTraitor, the crypto unit of North Korea’s Lazarus Group, and Chainalysis and Elliptic say they also believe North Korea is responsible. No law-enforcement agency has announced an attribution for this attack, Binance has named no one, and Pyongyang has denied involvement in earlier hacks. TRM’s own earlier count put North Korea-linked actors at 76 per cent of global crypto hack losses in the first four months of 2026.
The case rests on precedent, and the oldest precedent sits in India’s neighbourhood. On 4 February 2016, hackers sent 35 fraudulent SWIFT orders worth about $951 million from Bangladesh Bank’s account at the New York Federal Reserve. Some $81 million reached accounts in the Philippines. A misspelled instruction made the Fed block the other 30 transfers, worth about $850 million.
The US Justice Department later charged a North Korean programmer, Park Jin Hyok, describing him as part of the Lazarus Group working for his government. Ten years on, the target is an exchange, not a central bank, and the sum is about seven times the amount attempted in Dhaka.
TES Analytical Assessment: The conventional reading is criminal: a record crypto exchange hack by a sophisticated group, to be settled by forensics and indictments. The operational reading adds a state dimension without proving one. If TRM’s attribution holds, this North Korea crypto hack would roughly equal the $6.75 billion that Chainalysis credits to North Korea between 2016 and the end of 2025, and US and South Korean officials say such theft helps finance the regime’s weapons programmes. That is an official claim, and no agency has yet tied this attack to it. TES has tracked how Pyongyang expands its nuclear programme while Washington’s attention sits elsewhere.
| Incident | Amount | Attribution | Note |
|---|---|---|---|
| Bangladesh Bank, Feb 2016 | $81 million stolen of $951 million attempted | US Justice Department charge against a North Korean programmer | Funds routed to the Philippines |
| WazirX, Jul 2024 | Over $230 million | Cyfirma: North Korea-affiliated groups | Indian exchange |
| Bybit, Feb 2025 | About $1.5 billion | FBI: TraderTraitor | Previous record |
| CoinDCX, Jul 2025 | $44 million | None cited (server-side flaw) | Absorbed from company treasury, per CoinDCX |
| Binance, Oct 2026 | About $6.3 billion (estimate) | TRM, Chainalysis, Elliptic: North Korea (claim) | Binance says it will cover all losses |
Binance Hack India Impact: A Framework Built on Tax and Reporting
India crypto regulation works through anti-money-laundering duties, tax and transaction reporting, and that is how India supervises Binance. Binance completed registration as a reporting entity in May 2024, was penalised ₹18.82 crore on 19 June 2024 under the Prevention of Money Laundering Act, and restored access for Indian users in August 2024. The FIU-IND order sets out those obligations: record-keeping, timely reporting and know-your-customer checks that depend on digital identity systems. None of them is a wallet-security standard.
The Income Tax Department’s own explainer covers the rest: a flat 30 per cent tax on income from transferring virtual digital assets under Section 115BBH, 1 per cent tax deducted at source under Section 194S, and a reporting duty on specified entities under Section 285BAA. A loss on one asset cannot be set off against gains on another. The February 2026 Budget left the rates unchanged.
Parliament has begun to look at the gap. Reports of a 16 September 2026 hearing quote committee chair Bhartruhari Mahtab as saying the government neither accepts nor regulates virtual digital assets, which leaves room for abuse. The committee’s 36th report, tabled on 23 July 2026, asked the government to examine a statutory framework and, pending one, to consider an interim self-regulatory organisation under SEBI or the Reserve Bank of India. The Department of Economic Affairs’ long-promised discussion paper has not been published.
The first Indian effect of the Binance hack came from market plumbing. CoinDCX put its futures market into reduce-only mode, citing a global liquidity provider that its spokesperson confirmed was Binance, and said deposits and withdrawals were unaffected. Binance has not said whether Indian users were affected by the $6.3 billion hack.
TES Analytical Assessment: The conventional reading is that India crypto regulation is working as designed, because it was built to trace transactions, not to certify custody. The operational reading is that, after the Binance hack, the interim self-regulatory route is the nearest available vehicle for custody audits, incident disclosure and reserve attestations. The committee has already named it, and it needs no new statute. Whether it moves depends on a decision that has not been taken.
Three Answers Still Missing
Will an agency confirm a North Korea crypto hack? An FBI attribution, as in the Bybit case, would move this from analysts’ judgement to an official finding. TRM expects the laundering to run through cross-chain bridges, swap services and over-the-counter brokers.
What will the root-cause report show? It will say how the $6.3 billion hack unfolded and whether the attacker reached keys, systems or people. Binance’s withdrawal restart, expected by Sunday, will be the first test of its rebuilt controls.
Will India’s regulators speak? A statement from the Finance Ministry or FIU-IND on Indian exposure, or publication of the discussion paper, would show whether custody standards enter the agenda. Transaction monitoring, the duty FIU registration does impose, matters most if the laundering routes TRM describes touch Indian platforms.
In 2016, a misspelled word stopped $850 million. In 2026, the defence that worked in the Binance hack was a freeze order issued 37 minutes after the main sweep.
Neither was a regulatory standard.
Whether India writes one is the decision to watch.
Source note: Binance statements, TRM Labs and Chainalysis reports, FIU-IND and Income Tax Department records, parliamentary committee reports, court and justice-department records, major news agencies.
