Contents
In short: on 29 October 2026, about $6.3 billion moved out of Binance wallets, most of it in about 20 minutes. Nothing was cracked: the blockchain wasn't hacked, and Binance has found no evidence that private keys leaked. Its early findings point to one DevOps engineer's compromised laptop, which reached a service trusted to submit withdrawals. The transfers skipped the normal approvals and travelled a legitimate route, so they could look routine. Two analytics firms suspect North Korea's TraderTraitor; that is not confirmed.
What happened
"The estimated total impact sits at around $6.3B," Binance said in its security update of 30 October. The BBC called it "what is thought to be the largest hack in history - worth up to $6.3bn (£4.7bn)".
For comparison, the BBC's cyber correspondent Joe Tidy listed the earlier records: "Last year $1.5bn (£1.12bn) was taken from Bybit. Before that it was $600m (£433m) from Poly Network in 2021 and $540m (£412m) from Ronin in 2022."
It was fast. TRM Labs: "On October 29, 2026, an attacker moved approximately USD 6.36 billion out of Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC". As TRM's Ari Redbord told the BBC: "That speed is the product of long preparation."
Not the blockchain, not the keys
The surprise is what wasn't broken. The BBC's Mitchell Labiak: "The short version is that the blockchain wasn't hacked. Rather, the exchange on which people trade cryptocurrency was hacked."
And Binance: "We have found no evidence of any wallet private key leak."
It may have begun on one laptop
Binance's early answer: "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."
It may also be more than one machine. Binance's co-CEO Richard Teng, via the BBC: "This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach."
Binance hasn't published how the service was reached, and this post doesn't guess.
Why it's hard to defend
Teng also said the transfers "did not pass through our normal approval controls".
Aikido's Mackenzie Jackson described the general shape to the BBC: "From one laptop, an attacker can open one internal system, then another, until they reach a service trusted to send out withdrawals. Those withdrawals travel through a legitimate route, so they can look routine."
In the BBC's summary of Jackson: "He says hackers have shifted from going after company infrastructure to going after the machines of the people who run it. Those machines hold the digital keys that unlock a company's systems, so an attacker can act as that engineer."
Who: suspected, not confirmed
TRM Labs, via the BBC: "Several features of this attack match earlier North Korea-linked heists". One of them is Bybit. The FBI: "North Korea was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025."
For Binance, two analytics firms name a suspect. TRM Labs: "TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on and off-chain intelligence. We make this judgment with high confidence." Chainalysis: "Chainalysis investigators assess the $6.4 billion hack of Binance … to be the work of North Korean cybercrime group TraderTraitor."
But Elliptic notes: "No government or law enforcement agency has confirmed attribution, and Binance has not commented on who was responsible." And the BBC: "We don't yet know who was behind the attack". So: suspected, not confirmed.
What happened next
Binance "temporarily suspended withdrawals while security checks are completed" and said: "Binance will cover all losses from the SAFU fund and the company's funds. User funds are safe." It also reported: "We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far."
The clock matters. The theft took minutes; laundering takes weeks. Chainalysis: "Following major theft events between 2022-2025, stolen funds follow a structured, multi-wave laundering pathway that unfolds over approximately 45 days". For scale: "North Korean hackers stole $2.02 billion in cryptocurrency in 2025, a 51% year-over-year increase" (Chainalysis).
And getting money back is slow. On Bybit, 18 months on, Decrypt reported "around $48.4 million has been recovered and about $30.5 million frozen across more than 28 exchanges and custodians". That's about 3% of $1.5 billion recovered (our arithmetic: $48.4M ÷ $1.5B).
The fix
- Approve from outside the system that's asking. The FBI advises: "Require multiple factors of authentication and approvals from several different unconnected networks" before any movement of company financial assets.
- Split who can sign what. TRM Labs: "Signing infrastructure and approval paths should be separated by chain and wallet tier."
- Lock down the machines near the money. "For companies with access to large quantities of cryptocurrency, the FBI recommends blocking devices connected to the company's network" from downloading or running anything but approved programs.
The biggest thefts don't break the crypto; they take over the process that's trusted to move the money, and that process runs through people and their laptops.
Sources
- Binance, Security Incident Update, 30 Oct 2026
- TRM Labs, North Korea steals $6.36 billion from Binance in the largest hack in history, 29 Oct 2026
- Chainalysis, Binance exploit: latest findings and response, 30 Oct 2026
- Elliptic, Binance: the largest hack in history, 30 Oct 2026
- BBC News, North Korea thought to be behind $6.3bn crypto hack, as firm begins recovering some funds (live page), 30 Oct 2026
- Chainalysis, Crypto hacking and stolen funds 2026, Dec 2025
- Decrypt, Bybit sues North Korea over $1.5B hack, wins order freezing assets, 10 Aug 2026
- FBI, PSA 250226 (Bybit), 26 Feb 2025
- FBI, PSA 240903: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks, 3 Sep 2024
The video is animated with code and the script was written with AI assistance; every figure above is checked against the sources. Illustrative: the infection filling the laptop screen, the hop-by-hop route and the transaction log. This post explains the risk and the fix, not the steps of an attack. Made with Shotloop, my free Mac app for code-made explainers, fixed one shot at a time.