Binance: $6.3 Billion Hack Traced to an Engineer's Laptop, the Biggest Crypto Theft Ever

On the evening of Thursday 29 October 2026, money started pouring out of Binance, the world's biggest cryptocurrency exchange. Within minutes, digital coins worth billions of dollars had left wallets that Binance uses to pay out its customers. By the early hours of Friday, Binance had suspended every deposit and withdrawal, said it was working with law enforcement, and made a promise in a post on X: "Binance will cover all losses."

At 02:25 UTC on Friday, Binance put the estimated total impact at around $6.3 billion, and said its first findings pointed to a compromised laptop belonging to one of its engineers. That is about four times the previous record, the $1.5 billion stolen from the exchange Bybit in February 2025. It is the biggest crypto theft there has ever been.

What a hot wallet is

An exchange like Binance keeps most of its customers' coins in cold storage: wallets whose secret keys are kept off the internet, like cash in a vault. A smaller amount sits in hot wallets, which are connected to the internet so the exchange can pay out withdrawals quickly, like the cash in a shop's till. Whoever can sign for a hot wallet can move everything in it.

How it unfolded

The analysis that has been most widely repeated comes from Blockaid, a security company that studied the transactions. At about 20:20 UTC, a single transaction arrived on the Ethereum network carrying 50 signed permissions for one of Binance's hot wallets, labelled Binance 14. The permissions use a feature added to Ethereum in 2025, known as EIP-7702, which lets an ordinary wallet hand control to a piece of software. The attacker did not know the wallet's current sequence number, so they sent 50 versions and one matched. That one handed the wallet to a program that could empty it.

About three minutes later, the money left. Reports based on the blockchain records list 167,464 ether, about 1.6 billion USDT (a digital dollar issued by the company Tether) and more than 60 other tokens leaving Binance 14, followed within minutes by a second Ethereum hot wallet and a USDC hot wallet (USDC is a digital dollar issued by Circle). Researchers cited by Bitcoin.com said a contract had been set up earlier that day and an address funded through Tornado Cash, a service that hides where coins come from.

The permissions were signed with the wallet's own key. How the attacker got those signatures is the central unanswered question. Ido Ben-Natan, Blockaid's chief executive, told Cointelegraph he suspected misuse of Binance's signing systems rather than a stolen key: "We don't think a key was leaked." Arkham, another tracking firm, said there was not yet enough information to tell.

Binance gave its own first answer at 02:25 UTC on Friday. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," it said. "We have found no evidence of any wallet private key leak." A DevOps engineer is someone who runs the systems that keep a company's software working; a service container is one of the small, sealed programs those systems run. In other words, the attacker did not steal Binance's keys but got inside a machine that was allowed to ask for withdrawals, and asked. Binance says it has revoked the affected permission and will publish a detailed technical report once the facts are verified.

Why the early numbers were so far apart

Before Binance gave its figure, estimates ran from about $2.8 billion to $5.9 billion. The lower estimates, around $2.8 billion to $3.5 billion, count what can be traced from the Ethereum attack. The higher ones, $5.3 billion from Glassnode, $5.7 billion to $5.84 billion from Arkham and $5.912 billion from Chainalysis, also include about 18,000 bitcoin and money that left on the Tron network. Bitcoin.com and the outlet Blockhead noted that those movements are not explained by the Ethereum attack and have not been shown to be part of it. The researcher Molly White said Arkham's figure was probably too high because some of the wallets it counted may be unrelated. Binance's own estimate of around $6.3 billion is higher than all of them, and TRM Labs, a blockchain analysis firm, put the total at $6.36 billion.

The freeze

What happened next was unusual. Digital dollars like USDT and USDC can be frozen by the companies that issue them, and both acted within about 90 minutes. Paolo Ardoino, Tether's chief executive, said Tether froze more than 1.567 billion USDT. Jeremy Allaire, Circle's chief executive, said Circle froze more than 800 million USDC, in coordination with law enforcement. World Liberty Financial froze $27 million of its own digital dollar and $2 million of its token. The Arbitrum network's Security Council, a group that can act in emergencies, froze about $30.5 million. Binance's co-founder Yi He said Ripple had frozen about $200 million of its digital dollar; Ripple confirmed it was freezing funds but gave no figure.

Binance's own count of what has been frozen rose from $2.54 billion at about 23:20 UTC to "around $3 billion" at 00:52 UTC. Frozen money is not yet returned money, but the attacker cannot spend it.

The attacker kept moving what could not be frozen. They deposited 60 million USDT on Aave, a lending platform where people borrow against coins they put up as security, and borrowed 19,762 wrapped ether, about $44.6 million, within minutes. The trick was simple: put up digital dollars that might soon be frozen, and walk away with ether, which cannot be. Aave froze its markets at 22:32 UTC. The borrowing worried Aave's own users, because in April an earlier theft, the Kelp DAO bridge hack, had left Aave with a large hole of unpaid loans. Stani Kulechov, Aave's founder, said this time was different: "there is no bad debt, in fact its over collateralized with stable collateral, kelp was different." He added that Aave "wasn't impacted" and that its freeze still lets borrowers repay. The tracking accounts PeckShield and Lookonchain reported the attacker selling tokens and swapping them into ether through the night.

Who did it

No government agency has named a suspect. TRM Labs has attributed the theft to North Korea, in a report titled "North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History". The investigator ZachXBT replied to a question on X that it was "Likely Lazarus Group (DPRK)", North Korea's state hacking group, and Blockaid's chief executive pointed to North Korea because of how carefully the attack had been prepared. North Korea was behind the Bybit theft, according to the FBI. Those are the firms' assessments, not findings by law enforcement.

One claim spreading during the crash, that Binance had "blocked North Korea-linked attacks with no losses", was about something else. Binance said that on 27 October, two days earlier, about a fake job-offer campaign.

What Binance says

Binance's first post, at 21:29 UTC, said it was investigating "a potential security issue" and that "User funds are completely safe." The post was later edited. Its spokesperson told TechCrunch that withdrawals had been "temporarily suspended on multiple networks following a security incident as a precautionary measure." Changpeng Zhao, the founder who no longer runs Binance but remains its biggest shareholder, wrote: "User funds are safe! It does look like a hack on Binance." He added that he expected all user funds to be "fully covered".

At 01:36 UTC Binance posted: "Binance will cover all losses. As a precaution, all deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement." At 02:25 UTC it said it would cover all losses "from the SAFU fund and the company's funds" and would publish an updated proof of reserves, a public check that it still holds its customers' coins. Its emergency fund, known as SAFU, was last reported at about $1 billion to $1.27 billion in bitcoin, well below the loss, so most of it would have to come from Binance's own money. Binance.US, a separate company, said it was not affected, and so did Bybit.

The crash

Bitcoin was already falling when the news broke. It was about $80,600 on Thursday afternoon and dropped below $77,000 by 01:15 UTC on Friday. Ether fell about 6% and BNB, the token Binance created, about 8%. Traders who had borrowed to bet on rising prices were forced out: CoinGlass data showed about $628 million of such bets wiped out in one hour and about $1.4 billion in a day. Not all of the fall was Binance. Prices had already slipped below $80,000 before the first reports.

Brian Armstrong, the chief executive of Coinbase, said his exchange was blocking transfers to the attacker's wallets and had offered Binance help.

What is still unknown

How the attacker got into the engineer's laptop, and why one machine could ask for billions in withdrawals. How much of the frozen $3 billion will come back. Whether law enforcement agrees with TRM that North Korea did it. And when customers will be able to withdraw again. Binance says its full technical report will answer the first questions once the facts are verified.