Binance Hack: $6.3 Billion Taken After Engineers' Laptops Were Compromised, What Is Confirmed and What to Check This Week

On Thursday, October 29, 2026, attackers took about $6.3 billion in cryptocurrency from Binance, a crypto exchange. Binance's preliminary findings say the attack started on its engineers' work laptops, through a tampered software download and a fake job interview. That matters to any business with developers or IT admins. The weak point was not the blockchain. It was ordinary laptops, an internal tool that could reach too much, and an access token that stayed valid too long.

This post covers what is confirmed, what is only claimed, and what a business should check this week.

What happened in the Binance hack

Attackers drained Binance's hot wallets on October 29. Blockchain analytics firm Elliptic puts the total at $6.43 billion. Binance's own estimate is about $6.3 billion, and its preliminary report gives $6.34 billion. Elliptic describes the theft as the largest theft of cryptoassets on record.

On Saturday, October 31, the FBI formally attributed the theft to TraderTraitor, a North Korean hacking group. Elliptic had already named TraderTraitor as the likely attacker before the FBI announcement. Reuters reports that North Korea denies involvement.

Binance says it will cover all losses from its SAFU fund (Secure Asset Fund for Users) and company funds, and that it has set aside more than $6.34 billion for this. According to Elliptic, Binance began reopening withdrawals on November 1, starting with the Bitcoin network.

What is confirmed and what is only claimed

How the Binance hack started

Binance published its preliminary findings on Tuesday, November 3, on its X account. We could not open that post directly, so this section relies on how the findings were reported. Where those reports disagree, we say so.

June: a tampered download. A wallet infrastructure engineer searched the web for a popular AI coding tool. CSO Online, summarizing Binance's report, says the engineer downloaded a tampered installer for Homebrew, a common Mac tool for installing developer software. Elliptic's own summary describes it differently: "one engineer installed a tampered copy of an AI coding tool." The exact file is therefore still open. Both accounts agree that the engineer installed a tampered copy of developer software and that it exposed the wallet team. CSO Online reports that Binance's security team spotted the problem, replaced the laptop and rotated the engineer's credentials. According to the reports, the attackers still knew who worked on the wallet team.

About three months later: a fake job interview. A second wallet engineer was approached on a job platform by a fake recruiter. After staged interviews, the engineer downloaded a coding assignment onto a work computer. Binance's endpoint protection did not catch the malicious code inside it. Binance called it zero-day malware, meaning malware that security tools had not seen before.

October: an internal AI tool and a deploy token. The attackers used an internal Binance AI tool to reach two more engineers' computers. Binance has not said what the tool does. One of those machines held a token that could deploy containers on Binance's infrastructure. CSO Online reports that the attackers used the token nine days later to deploy a container running a malicious script. That script talked to the wallet signing service and started the withdrawals.

Binance says it found no evidence that private keys were leaked. Elliptic's on-chain analysis describes the attacker getting Binance's own systems to sign the transactions. Binance co-CEO Richard Teng said part of this "did not pass through our normal approval controls."

Did the Binance CFO resign because of the hack?

Binance has not said so. On Saturday, November 7, co-CEO Yi He announced that CFO Kaiser Ng "has decided to pursue a new venture after more than five years at Binance". Justin Yek, most recently vice president of finance at Airwallex, takes over. Reuters reports that the transition had been underway for about six months. The timing, just over a week after the theft, has drawn attention, but no primary source links the two.

Where the stolen money went

Elliptic's laundering report was last updated November 9. It says $2.85 billion of the stolen funds has been frozen or seized, almost all of it stablecoins that their issuers can freeze. About $3.0 billion is still in addresses linked to the theft, mostly ETH and Bitcoin. The attackers have used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. Elliptic says the laundering is clearly automated.

Why the Binance hack matters for a business network

Most businesses do not hold billions in crypto. Most do have developers, contractors or IT staff whose laptops can reach production systems. The chain Binance describes is not specific to crypto. A download found through a search engine, a coding test from a recruiter, an internal tool that could reach colleagues' machines, and a long-lived token that could deploy code would add up the same way at a software company, an online store or a medical practice's IT provider.

We covered fake download sites in ArmorSteal Malware. We covered how fast stolen credentials get used in Infostealer Attacks.

What to do this week

Binance hack questions people are asking

How much was stolen in the Binance hack?

Binance estimated about $6.3 billion, and its preliminary report gives $6.34 billion. Elliptic counts $6.43 billion.

Who hacked Binance?

The FBI attributed the theft to North Korea's TraderTraitor group on October 31. North Korea denies it.

Did Binance customers lose money?

Binance says it will cover all losses and has reserved more than $6.34 billion. Withdrawals began reopening on November 1.

How did hackers get into Binance?

According to Binance's preliminary findings, the attackers got in through a tampered developer download in June and a fake job interview coding test. From there they used an internal AI tool and a container deploy token. The findings are preliminary.

Was the Binance hack a private key leak?

Binance says it found no evidence of one. Elliptic describes Binance's own systems being made to sign the transactions.

Did the Binance CFO quit over the hack?

No source says so. Binance says Kaiser Ng is leaving for a new venture after a six-month transition, and Justin Yek replaces him.

The bigger lesson

Binance did catch the first intrusion and replaced the laptop. The attackers still got in, because they already knew which team to target and had a second way in. Cleaning up one device is not the end of an incident. The question is what that device and that person could reach, and who the attacker will target next. Developer laptops, internal tools and deploy tokens deserve the same scrutiny as the servers they reach.

To review how your developer machines, internal tools and tokens are locked down, see security hardening or request a quote.

Get security alerts like this by email, with the free checklist, at security alerts.

Sources: Elliptic: Inside the Binance hack; Elliptic: How North Korea is laundering the funds stolen from Binance; Elliptic Binance exploit blocklist; CSO Online; Reuters via The Star.