On the afternoon of October 29, 2026, money started leaving Binance hot wallets very quickly. Within about 20 minutes, according to blockchain analytics firm TRM Labs, most of roughly $6.36 billion had moved out of the world's largest cryptocurrency exchange across ten blockchains. That is about four times the 2025 Bybit theft, which had been the record until now. TRM Labs and Chainalysis both attribute the attack to TraderTraitor, a North Korean state-linked hacking group, with TRM saying it holds that view with high confidence. Binance itself has not attributed responsibility to any individual or group.

The striking part is where Binance says the trail starts: not with a flaw in a blockchain, but with an engineer's corporate laptop.

What Binance says happened

In a statement quoted by Help Net Security, Binance said the incident "may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions." A service container is an isolated software environment that runs one piece of a larger system. In this case it was apparently one that could submit withdrawals.

Binance says it has found no evidence that wallet private keys leaked. It later said further investigation uncovered additional breaches beyond the compromised laptop. Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action." TRM Labs, for its part, says the pattern points to a compromise of Binance's hot wallet signing infrastructure, because wallets on different chains, with different key types and signing schemes, all produced valid signatures for the attacker within about half an hour. (A hot wallet is an online wallet kept ready for routine customer withdrawals, unlike offline "cold" storage.)

How the engineer's laptop was compromised in the first place has not been explained. The Register notes that the scant details make it hard to rule out phishing or a supply-chain attack on a package the developer used. Binance has promised a technical post-mortem.

The timeline

The two analytics firms give slightly different start times, which is normal for reconstructions done from public ledgers:

  • About 20:05 UTC (4:05 p.m. ET), October 29: TRM Labs says most of the outflows happened in roughly 20 minutes starting at this point. Chainalysis puts the start at about 4:20 p.m. ET.
  • By 5:14 p.m. ET: Chainalysis says freezes of stolen assets had begun.
  • About 23:05 UTC: TRM Labs reports a second wave of withdrawals on the Avalanche and Polygon networks.

Binance's own estimate of the damage grew as the night went on. The Register reports the exchange first spoke of freezing $2.5 billion and later raised its at-risk figure to $6.3 billion. The Register also reports that Binance halted trading, deposits and withdrawals.

The race to freeze the money

Unlike bitcoin or ether, many stablecoins and some newer tokens are issued by companies or governed by bodies that can freeze specific balances on-chain. That ability shaped how this attack played out.

According to Help Net Security, Tether froze 1.567 billion USDT and Circle froze more than 800 million USDC. TRM Labs counts about $2.67 billion in frozen stablecoins from Tether, Circle, Ripple and World Liberty Financial. On top of that, the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB, which brings TRM's total to about $2.7 billion. Estimates of the frozen total differ by source: about $2.7 billion (TRM), about $2.8 billion (Chainalysis) and close to $3 billion (Binance, as relayed by Help Net Security and The Record).

The attacker clearly expected this. TRM Labs says the attacker sold USDT to market makers and borrowed ETH against USDT on Aave to get value out of freezable assets before the freezes landed. Chainalysis reports that the attacker swapped $325 million in stablecoins for $285 million in ETH over nearly 20 minutes. The roughly $40 million difference reflects the loss taken by trading in a hurry; TRM describes the discount as steep. Chainalysis also says the laundering shows signs of automation: thousands of transactions in a short period, suggesting scripted tooling rather than an operator moving funds by hand.

That left a large amount out of reach. Help Net Security, citing TRM, reports the attackers still hold more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion. Neither of those assets can be frozen by an issuer.

Why the analysts point to North Korea

TRM Labs and Chainalysis both attribute the theft to TraderTraitor, a cluster of North Korean activity aimed at the cryptocurrency industry. TRM says its attribution rests on on-chain and off-chain intelligence, and notes that features of the attack match earlier North Korea-linked heists, including small Tornado Cash withdrawals funding an operator wallet and signatures obtained in advance, then executed in one burst. Chainalysis cites an on-chain link: stolen Binance funds were seen mixing with proceeds from last month's Bitget theft, which has also been attributed to North Korea. This attribution comes from the analytics firms. Binance has not publicly attributed the attack, and none of the sources cited here include a government attribution of this theft.

What happens to customers

Binance says it will cover all losses using its SAFU fund (Secure Asset Fund for Users, an emergency reserve the exchange keeps for this kind of event) plus company funds. According to The Record, Binance co-founder Yi He said user funds are safe, that Binance will cover the losses, and that the withdrawal suspension would last 48 hours. Help Net Security reports that withdrawals are paused until a security overhaul of the withdrawal service is done, with a restart expected within 48 hours.

Those are Binance's promises. Whether the exchange keeps them will become clear when withdrawals reopen.

What It Means for Defenders

Who is affected. Binance customers are affected directly. Withdrawals were paused, and Binance says it will make users whole. There is no software flaw here to patch and no vendor fixed version. As described so far, this is an operational breach of one company's infrastructure. The lessons still apply to any organization where an engineer's workstation can reach systems that move money, data or production access.

Treat engineer endpoints as privileged infrastructure. Binance's initial account is that one DevOps laptop led to a service container that could submit withdrawals, though it has since said there were additional breaches. In many companies, the laptops of people who build and run production systems hold credentials, tokens and network routes that are more powerful than most servers. These machines should be hardened, monitored and given least-privilege access like the production systems they reach. They should not be managed like general office laptops.

Isolate anything that can authorize value transfers. The service container mattered because it could submit withdrawal transactions. Check which services in your environment can start payments, wire transfers, key operations or bulk data exports, and who or what can reach them. Where possible, require approval from separate systems or people for large or unusual transactions, so one compromised point cannot complete the whole chain.

Plan for both phishing and supply-chain entry. The Register reports that neither can be ruled out as the way the laptop was compromised. Phishing-resistant authentication, review of developer tooling and the packages it pulls in, and endpoint detection on build and operations machines all cover these paths.

Watch for speed. Most of the money left in about 20 minutes, according to TRM Labs. Controls that flag or slow withdrawals by volume, timing or destination give responders time. After-the-fact reviews do not.

Have freeze contacts ready before you need them. About $2.7 billion was frozen, by TRM's count, because issuers such as Tether and Circle and the Arbitrum Security Council moved within hours. The attacker's fast swaps show that hours can be too slow. Organizations holding digital assets should know in advance who to call at each issuer and network.

Expect follow-on scams. Large, well-publicized incidents tend to attract phishing that impersonates the affected company. Binance itself warned customers to be cautious of scams and not to trust unofficial links, messages or requests for account information. Binance users and IT teams supporting them should rely only on Binance's official channels for withdrawal and recovery information.

Sources