Binance hack: what we know about the $6.3 billion theft

What happened in the Binance hack?

The Binance hack of 29 October 2026 was a theft of about $6.3 billion in crypto from the exchange's hot wallets, the largest crypto theft on record. A hot wallet is a wallet kept online so an exchange can pay out withdrawals quickly. Binance said its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions" (Binance on X).

That is a preliminary finding, and Binance says it will publish a detailed post-mortem once the facts are verified. It also says it found no evidence that a wallet private key leaked, that about $3 billion has been frozen on-chain, and that it will cover all losses. Short on time? Read the table below or jump to what Binance users should do.

This article covers the facts as they stand, what is not known, and what security and leadership teams can take from an incident that started at an employee's computer.

The Binance hack at a glance

Timeline of the Binance hack

Times are UTC. Preparation and theft times come from the on-chain analysis by TRM Labs. Binance's statements come from its posts on X.

• 28 October, morning. TRM sees three small Tornado Cash withdrawals fund the wallet the attacker later used to operate, at least 36 hours before the theft.
• 29 October, early. The attacker deploys a first version of its code and tests it on two wallets. A final version is rehearsed on a third wallet. About four hours later, the code is installed on a Binance hot wallet.
• 29 October, 20:05 to 20:09. Five Binance XRP Ledger wallets send 233.46 million XRP to one address. Shortly after 20:10, wallets on Solana and Optimism follow.
• 29 October, 20:20. A Bitcoin hot wallet sends 18,270 BTC. In the same window, a transaction with 50 pre-signed Ethereum authorizations is submitted. Within two minutes, a Tron hot wallet sends 612.7 million USDT.
• 29 October, about 20:23. The Ethereum hot wallet is swept: 167,464 ETH and 63 tokens, including 1.615 billion USDT. Further Ethereum sweeps follow at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56.
• 29 October, 21:01 and 21:04. Tether freezes USDT in the main receiving wallet, and Circle freezes USDC.
• 29 October, 22:01 and 22:10. Ripple freezes RLUSD, and World Liberty Financial freezes USD1.
• 29 October, about 23:05. A second wave hits Avalanche and Polygon wallets.
• 30 October, 00:08. Arbitrum's Security Council forces a transfer that freezes about $30 million.
• 30 October, 02:25. Binance publishes its preliminary cause statement and says it will cover all losses.
• 30 October, 04:36. Binance says deposits are unaffected, withdrawals stay paused for "a security revamp of the withdrawal service and its related addresses", and that they should resume within 48 hours.
• 30 October, 10:55. Binance says it has begun recovering affected assets for users and that it reserved over $6.34 billion of company funds for this.

How did the Binance hack work?

The Binance hack worked through Binance's own signing: according to TRM Labs, the attacker did not break a blockchain. On nine of the ten chains, ordinary signed transfers moved funds from Binance's hot wallets to the attacker in the same window. TRM's assessment is that the attacker "likely gained the ability to make Binance's hot wallet signing system sign transactions". Elliptic reaches a similar reading: Binance's own systems signed the transfers, and no keys needed to be stolen (The Hacker News). That fits Binance's statement that it found no wallet private key leak.

On Ethereum the attacker used a newer feature. EIP-7702, part of Ethereum's May 2025 Pectra upgrade, lets a wallet sign an authorization that makes it run a smart contract's code. TRM reports that the attacker pointed the Binance hot wallet to a "sweeper" contract that took instructions only from the attacker's operator wallet. Each authorization is valid for one specific transaction count (a nonce), so the attacker prepared 50 consecutive ones in advance, and one matched. That delegation stayed in place, which allowed the repeated sweeps over the following hours.

In plain terms: someone obtained signatures that Binance's own systems should only have produced for real withdrawals, and used them in one coordinated burst. How they got that ability is the open question. TRM says early indicators of phished authorizations explain only the Ethereum part.

What Binance has confirmed, and what it has not

Confirmed by Binance, in its own words on X:

• The initial investigation suggests a compromised DevOps engineer's laptop, a service container and unauthorized withdrawal transactions. Deposits and withdrawals were suspended and the affected address authorization was revoked (Binance).
• It found "no evidence of any wallet private key leak".
• "The incident stems from multiple factors." Its security team is tracing the full attack path through the compromised computer, which "may be the entry point", and a report with the root cause will follow (Binance).
• Co-CEO Richard Teng wrote that the attacker "did not simply use one engineer's permissions" and that this was not a single one-click action (Richard Teng on X). Binance also said it had uncovered additional points of breach (Binance).

Not confirmed, or not public:

• How the laptop was compromised. Binance has not said. Any claim about phishing, malware or a fake job offer in this case is a guess.
• The full attack path and root cause. A comprehensive report is promised but not published.
• Who at Binance was involved. Binance has not blamed any individual, and we do not either.
• Final loss and recovery numbers. Figures differ by source and will move as freezes and recoveries are completed.

Who is behind the Binance hack?

TRM Labs attributes the theft to TraderTraitor, a North Korean hacking unit, and writes: "We make this judgment with high confidence." Its reasons include that the FBI named TraderTraitor for the February 2025 Bybit theft, and that small Tornado Cash withdrawals funding an operator wallet, early staging and pre-obtained signatures used in one burst also appear in Bybit (TRM). Chainalysis also links it to North Korea with high confidence, citing funds mixed with those from the Bitget exploit of September 2026 (The Hacker News).

Elliptic urges caution. It points to differences in how fast and by what method the funds were laundered compared with earlier North Korean cases, and to the missing root cause.

Two limits matter. This is attribution by blockchain analytics firms, not an official government attribution: no agency has published one for this theft. And the groups have a track record. The FBI attributed the $1.5 billion Bybit theft to TraderTraitor in February 2025, and Bitget said in September 2026 that its $388 million loss resembled known North Korean patterns, a link that researchers have also examined.

Binance hack myths and hype to correct

• "$2.5 billion" or "$5.6 billion was stolen." These were partial counts early on. The $2.5 billion figure matched one Ethereum transaction. Binance's own estimate is about $6.3 billion.
• "Hackers stole Binance's private keys." Binance says it found no evidence of a wallet private key leak, and Elliptic's reading is that Binance's own systems signed the transfers.
• "Users lost their money." Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. The theft hit Binance's hot wallets. We have no independent confirmation yet that every user balance is whole, so watch the official channels.
• "North Korea is confirmed." Two analytics firms say so with high confidence, one urges caution, and no government has attributed it.
• "A hacked laptop is the whole story." Binance itself says multiple factors and additional points of breach are involved. Treat "a laptop" as the reported entry point, not the full cause.
• "It is the biggest theft ever in every measure." It is the largest crypto theft on record in US dollars. In bitcoin terms, the 2014 Mt. Gox loss was larger, as the former Binance CEO pointed out on X. His post is a commentary, not an official statement.

What should Binance users do after the hack?

Binance users should rely only on Binance's official channels, expect a wave of fake support and compensation messages, and secure their accounts. Binance says it covers all losses, so nobody needs to act on a message they received. This is general information, not financial advice.

• Use only official channels. Check Binance's verified accounts and its announcements for updates on withdrawals. Type the address yourself rather than following a link from a message.
• Expect scams. Large incidents bring fake support agents, fake "compensation" or "refund" forms, and fake "withdrawals have resumed" pages. Binance does not need your seed phrase, password or two-factor codes to pay you back, and no real compensation process asks for them.
• Do not move funds in a panic. Binance says deposits work and it covers losses. Withdrawing to an unfamiliar address because of a message you received is how people lose money in the aftermath.
• Secure the account. Use a unique password, a hardware security key or an authenticator app, and anti-phishing codes where offered. Check whether your email appears in stealer logs using our guide on what to do when a password is in a stealer log.

What does the Binance hack mean for security and leadership teams?

The Binance hack started, by Binance's preliminary account, at an employee's computer. That is the part of this story that applies to almost every company, and it matches a pattern the FBI and CISA describe publicly. We do not know how this laptop was compromised, so we do not claim the pattern applies here. It describes how North Korean groups have approached staff with privileged access before.

• They research people first. The FBI says North Korean actors "scout prospective victims by reviewing social media activity" and use details about a person's background and interests (FBI).
• They pose as recruiters. The FBI describes fake recruiters and fake recruiting firms offering new jobs or investment, then asking the target to complete a "pre-employment test" that runs unfamiliar code.
• They aim at administrators and developers. A CISA advisory on TraderTraitor says intrusions begin with many spearphishing messages to employees of crypto companies, often in system administration or DevOps roles, and that the messages often mimic a recruitment effort with high-paying jobs.
• A developer machine was also the start at Bybit. Safe{Wallet}, the wallet provider whose interface Bybit used, said a developer's laptop was compromised through a malicious Docker project, which led to the February 2025 theft (Decrypt).

A message that mentions your role, your skills or your employer, sent by a stranger, is pretexting: the sender builds a believable story before asking for an action. Credentials and sessions stolen from a staff member's device by an infostealer are another way attackers get a foothold, and stolen session cookies can skip the password entirely. Whether either played a part at Binance is unknown.

Controls that limit the damage when one workstation is compromised:

1. Privileged access workstations. Staff who can reach production, cloud consoles or signing infrastructure use a locked-down, dedicated machine. No personal browsing, no coding tests, no side projects.
2. Hardware security keys for administrator and cloud accounts, so a stolen password or a phished code is not enough.
3. Separation of duties. One laptop, one container or one engineer should not be able to reach withdrawal signing. Production signing sits in a separate environment with its own access rules and approvals.
4. Signing policies and limits. Cap the value and number of withdrawals from a hot wallet per period, require extra approval above a limit, and alert on destination addresses that are new. Velocity limits do not stop an intrusion, but they cap how much can leave in 30 minutes.
5. Short-lived, narrowly scoped credentials for service containers and pipelines, so a foothold in one does not open the rest.
6. A rule for outside code. Staff must not run unreviewed code from recruiters, contacts or repositories on company devices. The FBI recommends using a virtual machine on a non-company device for such tests.
7. Know how exposed your key people are. Attackers choose targets from public profiles, old breach data and stolen credentials. The more of that exists about the people with privileged access, the easier it is to approach them convincingly. Know what exists before someone else assembles it: CEM checks your executives' current and past email addresses against breach corpora and leak databases, and EDG3 shows what has been posted about your authorized domain on dark web forums, marketplaces and channels.

For more on how a supplier or staff member becomes the way in, see our articles on the ConnectWise breach, the Polymarket hack from the same day and what leaked in October 2026.

How WebThreat can help

WebThreat does not protect exchange infrastructure, wallets or signing systems. Those controls belong to your security and engineering teams. Our part is the exposure around your people and data, which is where this kind of targeting starts.

• CEM starts from a company name, discovers the leadership team and checks each person's current and past email addresses against breach corpora and leak databases, ranked by what to fix first. It starts with leadership and can extend to managers and employees. See the methodology for how.
• EDG3 is WebThreat's threat intelligence for leaked data. It covers the places where stolen company data, credentials and stealer logs are posted and sold, from dark web forums and marketplaces to Telegram channels and leak databases, so you can see what is circulating about your company, where and by whom.
• Information Removal is a specialist service that removes executives' personal data from public view, which limits the material that approaches and follow-up scams are built from.

To talk through what your leadership team has exposed today, contact us.

This article reflects the sources linked above as of 30 October 2026, 16:30 UTC. Figures are preliminary and Binance's cause is a preliminary finding. We will update it when Binance publishes its post-mortem.