Binance Hack: The $6.3 Billion Theft Traced to a DevOps Laptop, and What Businesses Should Check

On October 29, 2026, attackers drained about $6.3 billion in cryptocurrency from Binance's hot wallets. Hot wallets are the online wallets an exchange uses to process withdrawals, and three blockchain analysis firms call this the largest crypto theft on record. Binance says its early investigation points to a compromised laptop belonging to one of its DevOps engineers. Any business that runs servers should pay attention to that part.

Binance has paused withdrawals, says customer funds are safe and says it will cover the losses. It has not published a root cause, and much of what spread in the first hours has already been revised.

What happened in the Binance hack

According to blockchain analysis firms TRM Labs and Elliptic, the theft began at about 20:05 UTC on October 29. Five Binance wallets on the XRP Ledger sent 233 million XRP to one attacker address. Over roughly the next half hour, Binance hot wallets on Bitcoin, Ethereum, Tron, Solana and other networks were emptied. Elliptic reports that $2.53 billion left Binance's Ethereum hot wallet in a single transaction. A second wave hit Binance wallets on Avalanche and Polygon after 23:00 UTC.

TRM traced the preparation back to October 28, when the attacker's wallet received three small withdrawals from the Tornado Cash mixer. TRM says the attack code was then tested on other wallets the next day before it was used against Binance.

The first headline figure, $5.8 billion, was a wallet-tracking total posted on social media while the theft was still under way. The current estimates are higher:

Most of the gap comes from pricing. TRM, for example, values the stolen coins at about $6.36 billion at the moment of each transfer and about $6.23 billion at later prices. Every estimate makes it more than four times the size of the February 2025 Bybit theft, which Elliptic puts at $1.46 billion.

What is confirmed and what is still claimed

Confirmed by on-chain data and reported by all three analysis firms: funds left Binance-controlled wallets on ten or more blockchains (TRM counts ten, Elliptic counts eleven). Stablecoin issuers, including Tether and Circle, froze large amounts within hours. Much of the rest is held in assets like bitcoin and ether, which no issuer can freeze. TRM estimates the attacker still controls about $2.4 billion. Elliptic puts the amount that cannot be frozen at about $3.33 billion. These numbers will keep changing.

Stated by Binance, not independently verified: its initial investigation suggests a compromised DevOps engineer's laptop let the attacker submit unauthorized withdrawals. It has found "no evidence of a private key leak." It will cover losses from its SAFU emergency fund and company funds, and it plans a detailed technical post-mortem. According to BleepingComputer, Binance said the attacker reached a service container, and it later said it had "uncovered additional points of breach." Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions, and that this was not a "one-click" action.

Assessed, not proven: TRM attributes the attack, with high confidence, to TraderTraitor, a North Korean state-backed hacking unit the FBI previously linked to the Bybit theft. Chainalysis reached the same assessment after it saw stolen Binance funds mixing with proceeds from last month's Bitget exploit. Elliptic says North Korea is likely responsible, but notes the overlap is small and no government has made an attribution.

Not known: how the laptop was compromised, what the additional points of breach are, and when withdrawals will fully resume.

How did the Binance hack happen?

No one outside Binance knows yet, but the researchers can see the pattern. On Ethereum, TRM found the attacker used EIP-7702, a feature that lets an account hand control to code. One transaction carried 50 authorizations signed in advance. The one that matched the wallet's state turned Binance's hot wallet into a sweeper the attacker controlled. On the other nine chains, the money left through ordinary signed transfers.

This points away from the simple story of one phished employee clicking a bad link. TRM's assessment is that the attacker gained control of Binance's hot wallet signing system, the internal machinery that approves withdrawals. Elliptic sees the same theme as Bybit: the cryptography was not broken. Developer systems were compromised and approvals were manipulated.

Is my money on Binance safe?

Binance says user funds are safe and that it will cover all losses. It has suspended deposits and withdrawals while it runs security checks. BleepingComputer reports that Binance will publish an updated Proof of Reserves once the cleanup is complete.

For customers, the bigger near-term risk is scams. Expect fake "Binance support" emails, texts and direct messages offering refunds, early withdrawals or account verification. A Binance spokesperson told BleepingComputer that customers should avoid unofficial links and any request for account information.

Why this matters for a company network

Most businesses do not run a crypto exchange. Nearly all of them have a developer, contractor or IT person whose laptop can reach production: the website server, the cloud console, payment settings, backups. If Binance's early finding holds, the path to the largest theft on record ran through that kind of device.

Three lessons carry over directly:

• Admin laptops are production systems. A machine that can push code or approve changes needs the same protection as the server it controls.
• No single person should be able to move the money. Binance's co-CEO stressed that the attacker needed more than one engineer's permissions. In your business, payments, bank detail changes and domain transfers should need a second approval.
• How fast you respond decides how much you lose. Tether froze 971 million USDT less than an hour after the first transfers, and that quick action kept billions out of the attacker's hands. Know who you will call and what you will shut off before it happens.

We covered the same idea from another angle in Your Tailscale Network Is Only as Safe as Its Weakest Device. Browser add-ons are a common way onto a developer's laptop, as we covered in Malicious Chrome Extensions.

What to do this week

Binance hack questions people are asking

Was Binance hacked?

Yes. Binance has confirmed a security incident, and the movement of about $6.3 billion out of its wallets on October 29, 2026 can be seen on public blockchains.

How much was stolen from Binance?

Binance estimates about $6.3 billion. TRM Labs says about $6.36 billion, Chainalysis about $6.4 billion and Elliptic about $6.43 billion. As of October 30, between about $2.7 billion and $2.84 billion had been frozen.

Who hacked Binance?

This has not been officially confirmed. TRM Labs and Chainalysis attribute the attack to North Korea's TraderTraitor group, and Elliptic calls that likely. No government has made an attribution.

Are Binance withdrawals paused?

Yes. Binance suspended deposits and withdrawals as a precaution and has not given a date for a full restart. Check the Binance app for official updates.

Will Binance customers lose money?

Binance says no. It says it will cover the losses from its SAFU fund and company funds.

Is this the biggest crypto hack ever?

By every estimate so far, yes. It is more than four times the size of the 2025 Bybit theft.

The bigger lesson

Binance was not beaten by clever mathematics. By its own early account, the attacker came in through a work laptop that could reach the systems that move money. Every business has a version of that laptop. Find it, lock it down, and make sure no single device or login can empty the account.

For help hardening admin devices and the servers behind them, see security hardening or request a quote.

Get security alerts like this by email, with our free checklist, at security alerts.

Sources: TRM Labs: North Korea Steals USD 6.36 Billion From Binance; Chainalysis: Binance Exploit Latest Findings and Response; Elliptic: The largest theft in history; BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop.