- What: Binance disclosed a security incident in which an attacker, possibly using a compromised DevOps engineer's laptop, reached a service container and submitted unauthorized withdrawal transactions.
- Impact: Binance puts the affected assets at about $6.3 billion, Chainalysis estimates $5.912 billion stolen and Elliptic $6.43 billion, making it the largest crypto heist on record.
- Fix / mitigation: Binance suspended deposits and withdrawals, revoked the affected address authorization, is rebuilding security around its withdrawal service, and says it will cover all losses from its SAFU fund and its own funds.
- Who's at risk: Binance users face the withdrawal suspension, while any organization whose engineers or service accounts can reach transaction signing systems faces the same class of attack.
On Thursday, the world's biggest cryptocurrency exchange told the market that a "security incident" had affected about $6.3 billion in assets. Its initial investigation suggests the incident may involve a single compromised laptop belonging to a DevOps engineer. The Hacker News reports this is the largest cryptocurrency heist recorded to date, passing the theft of about $1.5 billion from Bybit in February 2025.
The human cost has so far been contained by the balance sheet. Binance says it will cover all losses from its Secure Asset Fund for Users (SAFU) and its own funds. It also suspended deposits and withdrawals, and it expects withdrawals to resume in 48 hours, once its team "completes a security revamp of the withdrawal service and its related addresses." The harder question is how much access one engineer's machine could unlock.
Three minutes and 24 seconds
Binance's account is short. A compromised laptop "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." The company says there is no evidence of a wallet private key leak.
TRM Labs supplies the mechanics. Preparation was underway at least 36 hours before the theft. At 20:20 UTC, the operator submitted a single transaction containing 50 authorizations, each signed by the Binance hot wallet and each pointing it to a sweeper contract that accepts instructions only from the operator. Three minutes and 24 seconds later, the operator told the hot wallet to send its entire balance to an attacker-controlled address. That one transaction moved 167,464 ETH and 63 tokens, including 1.615 billion USDT.
An authorization works only at the transaction count, or nonce, the wallet has reached when it executes. A busy hot wallet's count keeps moving as withdrawals flow. By preparing signatures for 50 consecutive counts, the attacker guaranteed one would still be valid. One matched. TRM Labs says the batch suggests the access may have been limited in time, or that signatures had to be requested through a system.
TRM Labs calls the most likely explanation an ability to make Binance's hot wallet signing system sign transactions of the attacker's choosing across chains. Elliptic reaches the same view: "Rather than stealing Binance's private keys, the attacker appears to have been able to get Binance's own systems to sign transactions on their behalf."
A familiar hand
TRM Labs attributes the theft with high confidence to TraderTraitor, the North Korean actor it also links to the 2025 Bybit heist, citing on-chain and off-chain intelligence. It points to shared features with Bybit and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging well before the theft, and signatures obtained in advance then executed in one burst.
Chainalysis also links the hack to the DPRK with high confidence, saying it saw funds from last month's Bitget exploit commingling with funds stolen from Binance. Elliptic's chief scientist and founder, Dr. Tom Robinson, told The Hacker News that North Korea-linked actors were behind it, citing similar tradecraft and commingling with funds from another hack attributed to them.
One thing has changed. TRM Labs says the laundering so far is built on large swaps through market makers and lending protocols, which differs from the bridge-heavy pattern that followed Bybit.
The race after the theft
The response moved quickly, and it depended on outside parties. Tether and Circle froze more than 1.567 billion USDT and 800 million USDC respectively. Across Tether, Circle, Ripple and World Liberty Financial, about $2.67 billion in stablecoins has been frozen, and Arbitrum's Security Council froze about $30 million in ETH and ARB. Binance also engaged law enforcement and blockchain intelligence partners to trace and recover funds.
The attacker still controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, plus smaller amounts on other chains. Totals also differ by source: about $6.3 billion from Binance, $5.912 billion from Chainalysis at time of theft, and $6.43 billion from Elliptic. Treat each as an early estimate.
The RedEye take
This is an operations failure at the scale of a national budget line, and the industry should stop describing these events as crypto hacks. Elliptic said it plainly when comparing the case to Bybit, where a developer's machine at wallet provider Safe{Wallet} was compromised: "In both cases, it was the infrastructure and people around the wallets that were compromised, not the cryptography." Key custody was the question Binance could answer quickly. Signing authority is the question that matters.
If the early account holds, a world-class exchange let a path exist from an engineer's endpoint to a service container to transactions that emptied a hot wallet, and nothing stopped a full-balance transfer in the 204 seconds after delegation. Large freezes softened the blow, but they came from third parties and left about $2.4 billion out of reach. A recovery plan that depends on other organizations acting fast is a useful backstop and a poor control. Binance has also yet to publish a root cause, so this view may need to change when it does.
What defenders should learn
- No stolen keys does not mean no compromise. Binance's statement about private keys and the reported loss are both compatible with an attacker who could obtain signatures. Key-protection assurances say little if the system that uses the key will sign what it is given.
- Developer laptops belong in the crown-jewel threat model. Bybit and Binance both trace back, on current reporting, to a machine used by technical staff. If an endpoint can reach production services that touch money, its risk rating should reflect the money.
- Signing policy is a separate control from signing access. The damaging request here was a transfer of a hot wallet's entire balance. Limits enforced independently of the requesting service are what make a stolen session less valuable.
- Preparation time is detection time. TRM Labs dates staging to at least 36 hours before the theft, while the final stage took under four minutes. The realistic detection window sits in the staging period, and it applies well beyond crypto wherever payments are automated.
- Plan for attackers who change their laundering or exfiltration playbook. Attribution held across Bybit, KelpDAO and Binance, yet the laundering pattern shifted. Detections tied to the last incident's methods will age quickly, so response plans should rest on behavior and on relationships with outside partners who can act within minutes.
What is still unknown
Binance's laptop explanation is preliminary and worded as such. How the laptop was compromised, how the attacker reached signing capability and whether the 48-hour target holds are all open. Those answers will decide whether this becomes a story about one endpoint or about the design of the withdrawal service itself.
Source: The Hacker News, "Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen," Ravie Lakshmanan, October 30, 2026. https://thehackernews.com/2026/10/binance-suffers-security-breach.html
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us