The Binance Heist: One Laptop, Six Billion Dollars
· Jerwin Arnado · 6 min read ·
On 29 October 2026, attackers moved about $6.3 billion out of Binance’s hot wallets on ten blockchains. That makes it the largest crypto theft on record, roughly four times the $1.5 billion Bybit hack of February 2025. Binance’s preliminary finding is that it started with one DevOps engineer’s compromised laptop.
Written 30 October 2026, the day after. The investigation is ongoing and figures are still moving, so treat the numbers below as a snapshot.
What happened
- The theft. Starting at 20:05 UTC on 29 October (4:05 AM on the 30th here in Manila), Binance wallets on XRP Ledger, Solana, Optimism, Bitcoin, Tron and Ethereum were drained within minutes of each other. A second wave hit Avalanche and Polygon about three hours later. TRM Labs traces about $6.36 billion at the time of transfer. Binance’s own estimate is $6.3 billion.
- The biggest pieces. About $3.79B on Ethereum (ETH plus stablecoins), $1.47B on Bitcoin (18,270 BTC), $628M on Tron, and $296M on XRP Ledger.
- Who. TRM attributes it with high confidence to TraderTraitor, the North Korean unit the FBI named for Bybit. Chainalysis reached the same assessment. Binance hasn’t named anyone.
- Binance’s response. Withdrawals were paused on several networks. Binance says user funds are safe, that it will cover all losses from its SAFU fund and company funds, and that it expects to start resuming withdrawals within 48 hours.
How they got in (as far as we know)
Binance’s early read, as reported by CyberInsider and others: a DevOps engineer’s laptop was compromised, which gave the attacker a path into a service container. That container was then used to submit unauthorized withdrawal transactions. Binance says it has found no evidence that any wallet private key leaked.
Read that again, because it’s the whole story. The keys didn’t leak. The attacker didn’t need them. They reached the thing that asks for signatures, and the signing system did its job.
TRM’s on-chain analysis fits that picture. On nine of the ten chains, the funds left through ordinary signed transfers, across different key types and signing schemes. One phished key doesn’t explain that. A compromised signing pipeline does. On Ethereum, the attacker went further: the hot wallet signed 50 EIP-7702 authorizations in one transaction, each delegating the wallet to an attacker-controlled sweeper contract. Three minutes later the wallet emptied itself.
Binance hasn’t said how the laptop was compromised or what permissions that container had. Those are the two answers I most want to read in the post-mortem.
The staging was patient
TRM’s timeline shows this wasn’t a smash-and-grab:
- 28 October: an operator wallet is funded through three small Tornado Cash withdrawals.
- Early 29 October: the attack code is deployed and tested on two wallets, then rehearsed on a third.
- 20:05–20:23 UTC: the main drain, chain after chain, in under twenty minutes.
That’s the same playbook as Bybit: long staging, pre-signed transactions, then everything at once before anyone can react.
About half of it got frozen
Here’s the twist that makes this different from older exchange hacks. Within an hour, the stablecoin issuers started freezing:
| Who | Frozen (per TRM) |
|---|---|
| Tether | ~1.77B USDT |
| Circle | ~825M USDC |
| Ripple | 40.5M RLUSD |
| World Liberty Financial | 27.8M+ USD1 |
| Arbitrum Security Council | ~$30M in ETH and ARB |
Binance put the verified frozen total at $2.54 billion by 23:35 UTC, and later reports put it near $3 billion. Aave froze the affected markets too. What’s left is the hard part: roughly $2.4 billion in ETH and BTC that nobody can freeze. The BTC is already being split into round 1,000 and 100 BTC pieces.
I wrote about FTX and Poly Network back when “code is law” was the pitch. This week, the thing that saved billions was a handful of companies with a freeze button. Whether that’s comforting or alarming depends on what you thought crypto was for. It’s honest, though: stablecoins are centralized, and that cuts both ways.
The lessons for the rest of us
I don’t run an exchange. But I run production servers, I hold deploy keys, and my laptop can reach things that matter. So can yours.
- Your laptop is production. If a developer machine can reach a container that can move money, then the laptop is part of the money-moving system, and it needs to be secured like one. Same lesson as the xz backdoor: attackers go after the people and tools around the system, not the system itself.
- Protecting the key isn’t enough. The keys here apparently never left the vault. The attacker just got access to something that could ask the vault to sign. If a service can request a signature, an approval or a deploy, then that service’s permissions are what really protect you. Lock down the requester, not only the key.
- Limit what one request can do. Withdrawal limits, velocity checks, per-destination allowlists, and a human approval step above a threshold. A whole hot wallet emptying in one transaction shouldn’t be possible no matter who’s asking. It’s the same thinking as rate limiting, with much higher stakes.
- Hot wallets should be small. “Hot” means online and reachable. Only keep online what you need online. That goes for exchange float and for any credential with production write access.
- Detection has a deadline. The main drain took under twenty minutes. Alerts that page someone in an hour are too slow. If you can automatically freeze when something abnormal happens, do it, and accept the occasional false alarm.
What I’d tell the barkada
If you keep crypto on Binance: it says it will cover losses, and it has the money to do it. That’s a promise from a company, though, not a property of the blockchain. Anything you’re not actively trading belongs in a wallet you control. I said it during Axie and I’ll keep saying it: withdrawing to cold storage feels boring until the day it isn’t.
Sources: TRM Labs, TechCrunch, CyberInsider, CoinDesk, CNBC.