The largest crypto theft on record did not start with a smart-contract bug. It started with one engineer’s computer.
By Rajan | Published 3 November 2026 | 6 min read
Key takeaways
- About $6.3 billion in crypto was drained from Binance on 29 October 2026, more than four times the $1.5 billion Bybit theft of February 2025.
- Binance says the attack began with a compromised DevOps engineer’s laptop that reached a service container used for withdrawals.
- The FBI has attributed the attack to TraderTraitor, a North Korean hacking unit linked to the Lazarus group.
- Binance froze about $3 billion, says user funds are safe, and is restoring withdrawals in phases.
- The lesson for every business: developer workstations now hold the keys to production systems.
What happened in the Binance hack? On 29 October 2026, attackers moved about $6.3 billion out of Binance, most of it within roughly 20 minutes starting at 20:05 GMT. Binance says the entry point was a single compromised laptop belonging to a DevOps engineer, not a flaw in its wallets or a stolen private key.
How did the attack work?
Binance’s preliminary findings describe a short chain:
- Attackers compromised a DevOps engineer’s laptop.
- That device gave them access to a service container involved in processing withdrawals.
- From there, they submitted unauthorised withdrawals through Binance’s own automated system.
Blockchain analytics firm TRM Labs says preparation began at least 36 hours before the transfers. Security firm Blockaid flagged an unusual batch of 50 EIP-7702 authorisations in a single Ethereum transaction, all delegating to a malicious “sweeper” contract. Binance has not yet published a full technical post-mortem.
Who is behind the Binance hack?
The FBI, working with the US Secret Service and IRS Criminal Investigation, has attributed the attack to TraderTraitor, a North Korean state-backed group tied to the wider Lazarus infrastructure. The FBI says the stolen assets are being converted into Ethereum and warned they may be laundered through DeFi platforms and instant-swap services. Binance itself has not publicly named the attackers.
Are Binance users’ funds safe?
Binance says yes. It froze about $3 billion with blockchain partners, found no evidence that wallet private keys leaked, and says it has already replaced around 95% of affected assets with company funds. Remaining losses will be covered by its Secure Asset Fund for Users (SAFU). Withdrawals are being restored in phases, starting with 15 networks including Bitcoin, Ethereum, Solana and XRP.
| Estimate | Amount |
|---|---|
| Binance | About $6.3 billion |
| TRM Labs | About $6.36 billion across ten networks |
| Chainalysis CEO | About $6.4 billion |
| Frozen so far | About $3 billion |
Why does this matter beyond crypto?
The Binance hack follows a pattern seen in the Bybit theft and in last week’s fake Claude Code extension on Cursor: attackers go after the people and machines with production access. A developer laptop often holds SSH keys, cloud credentials, API tokens and CLI sessions that reach far beyond the device itself.
As secrets-security firm GitGuardian puts it, containing a compromised laptop does not automatically contain the access available through it.
How to protect developer workstations
- Inventory local credentials: check config files, CLI caches, SSH keys, shell history and AI coding agent files.
- Remove plaintext secrets: move credentials into a secrets manager with short-lived tokens.
- Cut standing privileges: no single laptop should be able to authorise high-value actions alone.
- Require multi-party approval: sensitive operations such as large transfers need a second person or device.
- Isolate production access: use dedicated, hardened machines or virtual desktops for admin work.
- Plan the response: know which credentials each machine can expose, and be ready to revoke them fast.
Frequently asked questions
How much was stolen in the Binance hack? Binance estimates about $6.3 billion. Independent estimates range from $6.36 billion (TRM Labs) to $6.4 billion (Chainalysis). About $3 billion has been frozen.
When did the Binance hack happen? On 29 October 2026. Most transfers happened in about 20 minutes starting at 20:05 GMT.
Who hacked Binance? The FBI attributes the attack to TraderTraitor, a North Korean hacking unit linked to the Lazarus group.
Is Binance the biggest crypto hack ever? Yes, by a wide margin. It is more than four times the $1.5 billion Bybit theft of February 2025.
Can I withdraw from Binance now? Withdrawals are being restored in phases, starting with 15 networks including Bitcoin, Ethereum, Solana and XRP. Check Binance’s official announcements for your asset.
