On 30 October 2026, comparisons are already being drawn between the Binance breach of 29 October 2026 and the Bybit hack of 2025. The headline difference is size: Binance's estimated impact is about $6.3 billion, while Bybit's loss in 2025 was $1.5 billion. On that preliminary estimate, the Binance incident would be the largest crypto theft on record, more than four times the Bybit figure. The investigation into Binance is ongoing and its figures are preliminary estimates.

Binance is described as the world's largest crypto exchange, which adds to the scale of attention around the incident. Bybit was also a major exchange when it was hacked in 2025, but the reported Binance total is far larger. Size alone does not explain how either incident happened, and the two cases should not be treated as the same event with different numbers.

What is known so far about Binance points to a different reported mechanism. A preliminary investigation suggests a compromised DevOps engineer's laptop may have let an attacker access a service container and submit unauthorised withdrawal transactions. No evidence of a wallet private key leak has been found so far, on a preliminary basis. That is the reported starting point for Binance, and it differs in framing from a direct wallet-key compromise.

The Binance mechanism also involved a specific Ethereum feature. Reports say the attacker used EIP-7702 on a wallet called Binance 14, which appeared in Binance's 1 October proof of reserves, turning it into a sweeper. About 204,500 ETH was reported moved, leaving ETH backing near 94 percent, down from 100 percent on 1 October. Those details are specific to Binance and have no parallel in the Bybit figure alone.

Recovery reporting also differs in the detail available so far. For Binance, around $3 billion has been frozen, including $2.3 billion in USDT and USDC. Tether froze more than $1.567 billion in USDT, Circle froze about $823 million in USDC, Ripple froze around $200 million, and World Liberty Financial froze $27 million in USD1. Those frozen amounts are a major part of the Binance story so far, because they reduce the amount still in the attacker's control, even though the final net loss is not yet confirmed.

Binance's public response has centred on coverage. Co-CEO Yi He has said all losses will be covered from company funds plus the SAFU emergency fund, which holds around $1 billion in bitcoin, and that user funds are safe. Deposits and withdrawals were suspended as a precaution, with Yi He expecting withdrawal resumption to begin within the next 48 hours. Some reports say deposits were unaffected, so that detail should be checked against official Binance channels.

Market reaction to the Binance breach was sharp. Bitcoin fell below $77,000, down about 4.5 percent in 24 hours to $76,664 and later around $77,984, ether fell about 3.2 percent, BNB fell about 3.9 percent, and over $1 billion in leveraged positions was liquidated in 24 hours. Market moves after Bybit in 2025 were also significant, but the Binance figures above are the ones reported for this incident and should not be mixed with the earlier case.

Attribution for Binance is, at this stage, an investigators' claim, not a court finding. TRM Labs traced it to the North Korean unit TraderTraitor, and other trackers also pointed to North Korea. Pyongyang has previously denied hacking allegations. Any comparison with Bybit should keep attribution claims separate from proven findings.

FAQ: Which hack was larger? On preliminary estimates, Binance at about $6.3 billion versus Bybit at $1.5 billion in 2025. How did Binance reportedly happen? A compromised laptop may have led to unauthorised withdrawals, with EIP-7702 used on Binance 14. Is the Binance total final? No, the investigation is ongoing, figures are preliminary, and the next proof-of-reserves snapshot is due on 1 November 2026.