Binance hack 2026: what we know about the $6.3 billion theft
By Shayan Parsai · Published · 2 min read
On 29 October 2026 attackers moved about $6.3 billion out of Binance’s hot wallets, the largest crypto theft on record. Binance’s first findings point to a compromised DevOps engineer’s laptop, and the FBI blames North Korea. Binance says customers won’t lose money, and withdrawals began reopening on 1 November. The root cause has not been published.
Lessons from this story4 points ▾
- One laptop can reach a lotBinance’s first lead is a single engineer’s computer. Find out what a stolen developer login could reach in your systems.
- Signing needs limitsElliptic says the attacker made Binance’s own systems sign the transfers. Put limits and a second approval on anything that moves money.
- Freezing only goes so farAbout $2.85 billion is frozen, nearly all of it stablecoins. Bitcoin has no issuer that can freeze it, so that money stays out of reach.
- Alerts must beat the attackerTRM Labs says most of the money moved in about 20 minutes. An alert has to reach a person faster than that, at any hour.
What happened
Money started leaving Binance’s hot wallets just after 20:05 UTC on 29 October, according to Elliptic and TRM Labs. TRM says most of it moved within about 20 minutes, and that a second wave hit wallets on Avalanche and Polygon three hours later. Elliptic counts wallets on 11 blockchains emptied over about three hours.
The totals differ because the firms measure different things. Binance says about $6.3 billion, the FBI about $6 billion, TRM $6.36 billion and Elliptic $6.43 billion. The Bybit theft of February 2025, the previous record, was about $1.5 billion.
How they got in
Binance says the intrusion probably began with a compromised laptop belonging to a DevOps engineer. That gave access to a service container, where the unauthorised withdrawals were submitted. Binance later said the investigation had found additional points of breach, without saying where.
Binance says it has seen no evidence that private wallet keys leaked. Elliptic reads the blockchain data the same way: the attacker got Binance’s own systems to sign the transactions. Binance has promised a technical report when the investigation is verified.
Who is behind it
The FBI attributed the theft to North Korea on 31 October and calls the activity TraderTraitor. TRM Labs and Chainalysis had reached the same conclusion. Chainalysis points to stolen funds mixed with money from the Bitget theft in September.
What happens to customers
Binance says it will cover the losses with its SAFU fund and its own money. It paused deposits and withdrawals, then began reopening withdrawals on 1 November, starting with bitcoin.
Elliptic has verified about $2.85 billion as frozen or seized, almost all of it USDT and USDC. It estimates that the attacker still controls about $3.25 billion that cannot be frozen.
What this means for your site
Few companies hold billions, but the route applies to everyone: a developer’s computer, a container, and a system allowed to act on its own. In a smaller company that could be a laptop with keys to production, or a CI/CD pipeline that can publish code by itself.
Three checks worth doing this week:
- List who can reach production, and remove access nobody uses.
- Require a second approval for anything that moves money or publishes code.
- Test that an alert reaches a person within minutes, at night as well.
Sources
More hacks
Node2Shell
Node.js 22, 24, 26A flaw in the Brotli decoder inside Node.js. On CISA’s list of exploited flaws.
PHP2Shell
7 in 10 websitesTwo critical PHP flaws under active attack, CISA confirms. Patched 21 October.
Denmark
8.8 million peopleNames, addresses and ID numbers, reached through one firm’s legitimate access.