Bank robbers used to need masks, getaway cars, and a lot of nerve. On October 29, 2026, someone robbed the world's largest crypto exchange of billions without leaving their desk.
What happened?
On the evening of October 29, hackers drained about $6.3 billion from Binance's hot wallets across roughly 10 blockchains, mostly within about 20 minutes. Hot wallets roughly 10 blockchains, mostly within about 20 minutes. Hot wallets are the wallets an exchange keeps online to pay out customer withdrawals. It is considered the largest crypto theft on record, around four times the $1.5 billion stolen from Bybit in February 2025.
Binance paused deposits and withdrawals while it investigated, and Bitcoin dropped about 3.7% to under $79,000.
The good news: with help from partners, around $3 billion has been frozen on-chain. Tether froze about $1.6 billion in USDT and Circle froze more than $800 million in USDC. Binance said it set aside about $6.34 billion of company funds to cover the losses.
How did it happen?
This wasn't a case of someone guessing a password.
According to Binance's first investigation update, a compromised laptop belonging to a DevOps engineer appears to have let the attacker reach a service container and submit unauthorized withdrawals. Binance later said it had found additional points of breach beyond the laptop but has not yet explained what they were.
The clever part: the attacker probably never stole Binance's keys at all. Analysis suggests they got Binance's own systems to approve their transactions. Because wallets on several networks with different key types all sent funds to the attacker in the same half hour, TRM Labs concluded the attacker most likely controlled Binance's hot wallet signing system. The withdrawals carried valid signatures, so the system that should have blocked them signed them instead.
On Ethereum, the attacker used EIP-7702, a feature that lets a wallet hand its behaviour to a smart contract, to point a Binance hot wallet at a sweeper contract only they controlled.
It was also carefully planned. TRM believes the attackers spent at least 36 hours preparing, testing code and preparing signatures in advance. And because Binance's automated deposit sweeps kept running, new customer deposits kept refilling the wallet the attacker had already compromised.
Who did it?
Blockchain intelligence firm TRM Labs attributes the attack with high confidence to TraderTraitor, the North Korean group the FBI blamed for the Bybit hack. Chainalysis reached the same conclusion, linking it to previous hacks. TraderTraitor is associated with the wider Lazarus Group.
What was the real cause?
The short answer: one compromised person had too much reach.
A single engineer's laptop led to a system that could approve withdrawals across ten blockchains. One security analysis recommends separating signing systems and approval paths by chain and wallet type, so one compromise can't reach everything.
And this isn't just a crypto problem. The same attack chain works against ordinary companies; it just ends at a payment system or a production deployment instead of a crypto wallet.
Why OpenCore Group follows stories like this
We don't build crypto exchanges. But the software we build for clients has the same building blocks: engineer laptops, cloud servers, deployment pipelines, and systems that move money or sensitive data. Big incidents like this show exactly how attackers think, and they're free lessons for anyone paying attention.
Here's what we take from Binance:
Developer machines are part of the attack surface. We treat engineer laptops as sensitive systems, with strong authentication, up-to-date software, and caution with unexpected files, links, and "job offers," a classic TraderTraitor trick.
No single person or system should be able to do everything. We limit access to only what each person and service needs, and keep critical actions like payments and production deployments behind separate approvals.
Automation needs brakes. Binance's automation sweeps kept feeding the attacker. Automated systems we build should have limits and the ability to stop instantly when something looks wrong.
Watch for unusual activity. Twenty minutes is fast. Monitoring and alerts on unusual behaviour, like sudden large transfers, can be the difference between a small incident and a disaster.
Have a plan before you need it. Binance's ability to freeze funds quickly came from existing relationships and a response plan. Every team should know what it will do in the first hour of an incident.
Staying up to date isn't about following headlines. It's about making sure the next big lesson doesn't have to be learned the expensive way.
Want a second opinion on how secure your platform is? Talk to OpenCore Group →
References
- Help Net Security: Binance hit by $6.3 billion theft
- NBC: Binance targeted in record crypto heist
- Hackread: Binance probes DevOps engineer’s hacked laptop
- SOCRadar: Inside the $6.3B hot wallet theft
- Gizmodo: How hackers stole $6.3 billion from Binance in minutes
- Asia Financial: Binance battles “complex attack”
- The Next Web: Binance hack involved more than a laptop
- Kuwait Times: Binance confirms $6.3 billion hack, freezes half
