Hacked laptop glowing red in a dark office, Standpoint Operator Note on the Binance hack

The Binance Hack: $6.3 Billion, One Laptop, and What It Means for Your Crypto

ByStandpoint

Developing story · updated 30 October 2026

Short answer: On 29 October 2026, attackers took an estimated $6.3 billion from Binance, the world’s largest crypto exchange. It is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Binance says it started with a compromised laptop belonging to one of its DevOps engineers, which gave the attacker access to an internal service that could send withdrawals from Binance’s hot wallets. About $3 billion has been frozen. Binance says it will cover all losses. TRM Labs attributes the attack to North Korea’s TraderTraitor group with high confidence; Binance has not confirmed that.

The Binance hack in 30 seconds.

What happened

  • When: Thursday, 29 October 2026. According to TRM Labs, most of the transfers happened in about 20 minutes starting at 20:05 UTC, with a second wave around 23:05 UTC.
  • How much: Binance estimates the impact at about $6.3 billion. TRM Labs puts it at $6.36 billion at the time of theft; Chainalysis at about $5.9 billion.
  • Where the money went: funds left Binance hot wallets on ten blockchains, including Ethereum, Bitcoin, Tron, Solana and the XRP Ledger. On Bitcoin alone, 18,270 BTC (about $1.47 billion) left one hot wallet and was quickly split into smaller pieces.

How one laptop led to $6.3 billion

Binance’s first findings point to a DevOps engineer’s laptop that was compromised. From that laptop, the attacker reached an internal service and used it to submit withdrawals that Binance’s systems treated as legitimate.

Two terms explain why this matters:

  • Hot wallet: the part of an exchange’s funds kept online so customer withdrawals can go out quickly. Convenient, and always the most exposed.
  • Private keys: the secrets that control a wallet. Binance says it has found no evidence that any private keys leaked. The attacker didn’t need them: they used Binance’s own withdrawal process from the inside.

That is the uncomfortable lesson. The weak point wasn’t the cryptography. It was one person’s device with access to a system that could move money.

The response so far

  • Frozen: Binance says about $3 billion has been frozen. Tether froze more than $1.5 billion in USDT, Circle more than $800 million in USDC, with smaller freezes by Ripple, World Liberty Financial and the Arbitrum Security Council.
  • Covered: Binance co-CEO Yi He said the exchange will cover “all hacking losses,” using its SAFU emergency fund (about $1 billion in bitcoin) plus company funds.
  • Paused: withdrawals were suspended while the security issue is fixed.
  • CZ: former CEO Changpeng Zhao wrote that “User funds are safe,” adding that he no longer runs Binance but expects user funds to be fully covered.

The irony many people have pointed out: the fastest recovery came from the most centralized part of crypto. Stablecoin issuers can freeze tokens, and they froze close to half the stolen value within hours. Bitcoin and ether can’t be frozen that way.

Who did it

TRM Labs attributes the attack to TraderTraitor, a North Korean state hacking unit, with “high confidence.” On-chain investigator ZachXBT pointed to the Lazarus Group. Binance has not confirmed any attribution. The money is being moved through peel chains on Bitcoin and through lending protocols such as Aave and JustLend, a different pattern from the Bybit laundering in 2025.

How the market reacted

Prices dipped as the news spread. CoinDesk reported bitcoin down 4.8% to below $77,000, ether down 5.7% and BNB down 8%. Binance’s promise to cover losses limited the panic.

Binance has been here before

In May 2019, hackers took about 7,000 BTC (then roughly $40 million) from a Binance hot wallet. Binance covered it from the SAFU fund and reopened deposits and withdrawals about a week later. The playbook is the same; the size is about 150 times larger in dollar terms.

What this means for you

If you hold crypto

  1. An exchange account is a promise from the exchange, not money in your hand. Keep only what you actively trade there.
  2. For long-term holdings, consider a wallet where you hold the keys, such as a hardware wallet, and learn how its recovery phrase works before you need it.
  3. Turn on app-based two-factor authentication and withdrawal address allow-lists wherever your exchange offers them.

If you run a business

This hack is a reminder that the most expensive systems usually fail at the most ordinary point: a laptop.

  1. Give staff only the access their job needs, and remove it when the job changes.
  2. Put money-moving actions (payments, refunds, payouts, withdrawals) behind a second approval from a second person.
  3. Treat work laptops as keys to the business: device encryption, automatic updates, and app-based two-factor on everything.

Not sure where your own single point of failure is? Book a short call and we’ll walk through it with you. For more on AI and security in small business, read what a business run with AI agents looks like.

This note is information, not financial advice.

Common questions

How much was stolen from Binance?

Binance estimates the total impact at about $6.3 billion. TRM Labs puts it at $6.36 billion at the time of theft; Chainalysis at about $5.9 billion. About $3 billion has since been frozen.

Is this the biggest crypto hack ever?

Yes. It is about four times the previous record, the $1.5 billion Bybit hack in February 2025.

How did the Binance hack happen?

Binance’s initial findings point to a compromised laptop belonging to a DevOps engineer. The attacker used that access to reach an internal service and submit unauthorized withdrawals from Binance hot wallets. Binance says there is no evidence that private keys were leaked.

Are Binance users’ funds safe?

Binance says user funds are safe and that it will cover all hacking losses with its SAFU fund and company funds. Withdrawals were paused while the issue is fixed.

Who was behind the Binance hack?

TRM Labs attributes it with high confidence to TraderTraitor, a North Korean hacking unit. Binance has not confirmed the attribution.

What is a hot wallet?

A wallet an exchange keeps connected to the internet so it can process withdrawals quickly. It is convenient and also the most exposed part of an exchange’s funds, which is why most exchanges keep the majority of assets offline in cold storage.

Checked 30 October 2026. This is a developing story; figures may change as the investigation continues.

Sources

Want one short note like this a month?

Practical notes on AI, e-commerce and growth, from businesses we run. No spam. Unsubscribe anytime.

Similar Posts