The Binance hack of 29 October 2026 involved approximately $6.3 billion in affected cryptocurrency assets, making it potentially the largest crypto theft on record. Binance’s initial investigation identified a compromised DevOps engineer’s laptop as a possible entry point, although subsequent findings suggest a more complex attack. Around $3 billion has reportedly been frozen.
What Happened at Binance?
On 29 October 2026, attackers transferred an estimated $6.36 billion from Binance wallets across ten blockchain networks, according to blockchain intelligence firm TRM Labs (opens in a new tab). Most of the transactions occurred within approximately 20 minutes.
In its official security incident statement (opens in a new tab), Binance reported an estimated impact of $6.3 billion and said its initial investigation pointed to a compromised DevOps engineer’s laptop.
Investigators believe the compromise may have enabled attackers to access an internal service container and initiate unauthorised withdrawals.
However, Binance has since acknowledged additional points of breach. Co-CEO Richard Teng also clarified that the attack was more complex than the misuse of a single engineer’s permissions.
Crucially, Binance says it has found no evidence that wallet private keys were leaked.
Who Was Responsible, and How Much Has Been Recovered?
TRM Labs attributes the attack with high confidence (opens in a new tab) to North Korea’s TraderTraitor group, based on blockchain analysis and other intelligence.
The group has been linked to previous cryptocurrency thefts, including the $1.5 billion Bybit attack in February 2025, which the FBI attributed to North Korean actors (opens in a new tab).
Binance has not independently confirmed the perpetrators.
Approximately $3 billion in affected assets has been frozen, according to Binance. Stablecoin issuers Tether and Circle have contributed to that effort, freezing approximately $1.6 billion in USDT and more than $800 million in USDC respectively, as reported by AFP (opens in a new tab).
Binance temporarily suspended deposits and withdrawals, with withdrawals remaining paused during additional security work. The company says it will cover customer losses using its Secure Asset Fund for Users (SAFU) and company funds.
The Bigger Cyber Security Question: How Was This Possible?
What interests me most isn’t simply the scale of the theft, but how attackers apparently gained sufficient authority to move billions in digital assets.
If the initial findings are confirmed, this may not have involved stealing cryptographic keys directly.
Instead, the attackers may have compromised infrastructure trusted to authorise transactions.
TRM Labs’ technical analysis (opens in a new tab) describes transactions involving valid signatures, including an Ethereum EIP-7702 delegation that enabled attacker-controlled transaction execution.
The precise relationship between those transactions and Binance’s compromised infrastructure remains under investigation.
But the broader security issue is clear.
You can protect cryptographic keys, enforce multi-factor authentication and restrict administrative access. Yet if an attacker compromises a trusted service responsible for authorising sensitive operations, those protections may not be sufficient.
And this isn’t a problem unique to cryptocurrency.
The same principle applies to financial systems, cloud infrastructure, privileged service accounts and automated business processes.
A technically valid transaction is not necessarily a legitimate business instruction.
What Should Organisations Learn From the Binance Hack?
We don’t yet know the complete attack path, so declaring which controls failed would be premature.
Nevertheless, there are four questions worth asking:
- Could a compromised employee device provide access to critical production systems?
- Can privileged service accounts initiate sensitive actions without independent authorisation?
- Would monitoring detect unusual transactions performed using legitimate credentials?
- How quickly could the organisation identify, contain and recover from a similar compromise?
These are the kinds of scenarios that effective penetration testing (opens in a new tab) and incident response planning (opens in a new tab) should examine.
Binance has promised a detailed technical post-mortem, which should help establish how the attackers progressed through its systems and which controls were bypassed.
Until then, the most important question for other organisations isn’t whether they use cryptocurrency.
It’s whether they understand what an attacker could do if one of their trusted systems was compromised.
That’s a question worth answering before an incident provides the evidence.