Note: This post was written by Muse Wonder 1.0. The following is a synthesis of Binance’s incident updates and reporting from major news organizations.
Attackers moved about $6.3 billion out of Binance hot wallets on October 29, most of it in roughly 20 minutes, in the largest cryptocurrency theft reported to date. Binance suspended withdrawals that evening and says it will cover every loss from company funds. Two blockchain tracing firms attribute the theft to a North Korean unit that governments have warned targets exactly the kind of employee Binance says was compromised: a DevOps engineer.
$6.36 billion leaves Binance wallets starting at 20:05 UTC on October 29
The drain began at 20:05 UTC on October 29 across ten blockchains, according to TRM Labs, which counted about $6.36 billion leaving Binance wallets. A first wave hit wallets on the XRP Ledger, Solana, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Base in quick succession, and a second wave reached Avalanche and Polygon about three hours later. Ethereum accounted for roughly $3.79 billion of the total, and one Bitcoin transfer of 18,270 BTC was worth about $1.47 billion.
Binance puts the total impact at about $6.3 billion. Chainalysis counts approximately $6.4 billion and Elliptic $6.43 billion, so the firms agree on the scale while differing on the last decimal. Each total is roughly four times the $1.5 billion taken from Bybit in February 2025, the previous record. Preparation started a day earlier: TRM Labs says the operator wallet was funded from Tornado Cash on October 28, and the attack code was rehearsed on test wallets early on October 29.
A compromised DevOps laptop reached Binance’s signing system
Binance traces the entry to one engineer’s machine, and says the keys themselves stayed put. Its first investigation update said the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” and added: “We have found no evidence of any wallet private key leak.”
That distinction is the technical center of the story. The evidence assembled by TRM Labs indicates the attacker could get Binance’s hot-wallet signing system to sign transactions of the attacker’s choosing, rather than stealing a key and signing elsewhere. On Ethereum, the operator submitted a single transaction at 20:20:59 UTC carrying 50 pre-signed authorizations under EIP-7702, the mechanism that lets a wallet delegate its execution to smart-contract code. Each authorization covered a different transaction counter, so one was bound to be valid when it landed; one succeeded against the busy Binance 14 hot wallet, and the delegation persisted, sweeping later deposits as well. On the other nine chains, funds left through ordinary signed transfers.
Binance has since widened its own account. On October 30 the exchange said a follow-up investigation had found “additional points of breach” beyond the laptop, called the operation a complex attack, and said the intruder used a self-destruct mechanism that destroyed tooling and traces along the way. How the laptop was compromised, what the service container was, and why it could submit withdrawals of this size remain undisclosed as of October 31. Co-CEO Richard Teng said the attacker did not simply use one engineer’s permissions in a single action.
TRM Labs and Chainalysis attribute the theft to TraderTraitor
TRM Labs attributes the theft with high confidence to TraderTraitor, North Korea’s elite crypto-theft unit, citing on-chain and off-chain intelligence. Chainalysis reached the same attribution and linked funds from the theft to assets taken in September’s Bitget attack, which investigators also tie to North Korea. No government had confirmed the attribution as of October 31; the FBI told Reuters it is working with public and private partners on the incident, and a Secret Service spokesperson said its investigators are working with partners including Circle to identify, freeze, trace and recover the funds.
The named unit has a documented targeting pattern that matches the reported entry point. An April 2022 joint advisory from the FBI, CISA and the Treasury Department, AA22-108A, warned that TraderTraitor targets employees “often working in system administration or software development/IT operations (DevOps),” typically with recruitment lures and trojanized applications. The FBI blamed the same activity for the $1.5 billion Bybit theft, which began on a developer machine at Bybit’s wallet provider, and for the DMM Bitcoin theft, which began with a fake recruiter approaching an employee of its wallet vendor.
Chainalysis adds the wider tally: North Korea-linked hackers account for nearly 89% of reported cryptocurrency hack losses so far in 2026, through October 29, up from 15% in 2021.
$3 billion frozen and 90% replenished, with withdrawals targeted for November 1
About $3 billion of the stolen assets were frozen on-chain with the help of stablecoin issuers and other partners. Tether froze 971.1 million USDT in the main receiving wallet 37 minutes after the principal sweep, and verified freezes reached about $2.7 billion by 00:30 UTC on October 30. Issuers can freeze their own tokens wherever they sit; they cannot freeze the bitcoin and ether the attacker still holds.
Binance says customers will not bear the loss. It set aside more than $6.34 billion in company funds, drew partly on its $1 billion Secure Asset Fund for Users (SAFU), and reported on October 31 that it had replenished 90% of the stolen amount, up from about 80% a day earlier. A proof-of-reserves snapshot from 00:00 UTC that day shows ten major tokens backed at 100% or more, with the full cryptographic proof still to come. Withdrawals remained suspended on October 31, with a phased resumption targeted for Sunday, November 1.
The lesson for IT teams is what one laptop could reach
One compromised endpoint reached a system able to empty hot wallets across ten chains before outside parties could intervene, and the freezes that stopped part of the money came from stablecoin issuers, not from controls on the withdrawal path itself. Binance has not said whether limits on that path failed or were bypassed through the same access. Either way, a signing service that treats a request from an authenticated internal service as sufficient authorization will sign whatever that service is made to ask for.
That exposure is not specific to cryptocurrency. Any engineer workstation that can reach a payment system, a deployment pipeline or a code-signing key through inherited sessions carries the same shape of risk, and TraderTraitor’s playbook aims at those workstations first. Short-lived, device-bound production sessions, fresh phishing-resistant authentication before high-value actions, and hard limits a requesting service cannot override are the controls this theft argues for. Binance promises a technical post-mortem; whether it explains how one laptop’s reach extended to $6.3 billion is the part worth waiting for.
Sources
- Binance - Security Incident: Recovery Update #3, 90% of Stolen Assets Replenished (October 31, 2026)
- Reuters via SRN News - Binance Says 90% of Stolen Assets Replenished (October 31, 2026)
- Reuters via WIXX - Blockchain Analysis Firm TRM Says North Korea Behind Binance Crypto Theft (October 29, 2026)
- CoinDesk - Binance Loses Over $6 Billion in the Largest Crypto Hack to Date (October 29, 2026)
- CoinDesk - Binance Says It Has Replaced 90% of Stolen Crypto After Massive $6.3 Billion Breach (October 31, 2026)
- Decrypt - TRM and Chainalysis Tie $6.4B Binance Hack to North Korea’s TraderTraitor (October 2026)
- Decrypt - Binance Finds ‘Additional Points of Breach’ in $6.3B Hack (October 2026)
- Cloud Security Alliance - From One Laptop to $6.3 Billion (October 31, 2026)
- CISA, FBI and Treasury - TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies, AA22-108A (April 2022)