Binance: a $6.3 billion theft that started with one employee's laptop

On the evening of Thursday, October 29, 2026, Binance, the world’s largest cryptocurrency exchange, had part of its “hot” wallets drained, the ones used for customers’ day-to-day withdrawals. Binance puts the affected assets at about US$6.3 billion. Blockchain analytics firms give similar figures, from $5.9 to $6.4 billion depending on the method.

It is the largest cryptocurrency theft on record: roughly four times the Bybit hack, which cost $1.5 billion in February 2025.

The facts are changing by the hour. This news piece sums up what is established as of October 30; we will come back to it once Binance publishes its technical report.

What we know

• The starting point, according to Binance: its initial investigation points to the compromised laptop of a DevOps engineer. It allegedly gave the attacker access to an internal service container, where unauthorized withdrawal transactions were submitted.
• More than one machine: Binance later said the incident stemmed from “multiple factors” and that it had uncovered additional points of breach. Its co-CEO, Richard Teng, was explicit: “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action.”
• No private key leak: Binance says it has found no evidence that its wallets’ private keys were leaked. Analysts at TRM Labs and Elliptic believe instead that the attacker managed to get Binance’s own systems to sign the transactions.
• A prepared operation: according to TRM Labs, preparation began at least 36 hours before the theft. The transfers themselves were very fast, about twenty minutes according to TRM. Bitquery counts 17 drained wallets.
• The suspected perpetrators: TRM Labs attributes the attack, with high confidence, to TraderTraitor, a group linked to North Korea that was already blamed for the Bybit theft. Chainalysis and Elliptic also point to North Korea. These are assessments by private firms: Binance has not named anyone, and the FBI only says it is aware of the incident.

What was blocked

About $3 billion was frozen quickly, mainly because a large share of the loot was in stablecoins, which their issuers can block. Tether froze more than 1.5 billion USDT, Circle more than 800 million USDC, and other issuers followed.

Binance has promised to cover all losses from its SAFU emergency fund and its own funds. Deposits are working, but withdrawals are suspended while their security is overhauled; the exchange expects to resume them within 48 hours, followed by an updated proof of reserves.

What usually follows: scams

A hack this size opens the door to other fraudsters. Millions of worried customers want to know whether their funds are affected and how to get them back. Binance itself warned its customers about scams within the first hours.

The patterns are well known, and they are the ones we take down every day for our clients’ brands:

• fake websites imitating the exchange, with a “verification” or “refund” form that asks for login details or the wallet’s recovery phrase;
• fake support accounts on X, Facebook, Telegram or Instagram, which reply to worried customers and steer them to those sites;
• paid ads on social media and search engines that buy the brand’s name to place a fake link above the real one.

These pages multiply in the hours after the announcement. The longer they stay online, the more victims they make, and the more trust in the real brand erodes.

The lesson for every company

The attack did not target a vault, but a person. According to Elliptic, social engineering is likely, for example through fake job offers or fake coding tests sent to employees, a method already attributed to the same groups.

• A workstation is a way in: a technical employee’s access can be worth more than any customer password.
• Major operations should require several independent approvals, which a single compromised device cannot provide.
• Prepare the response before the crisis: know who monitors impersonations of your brand and who requests their takedown, from the very first hour.

At AgencePDN, we continuously monitor fake websites, fake accounts and fake ads that use our clients’ names, and we get them taken down by platforms, hosting providers and Google.

Sources

• TechCrunch (October 30, 2026): techcrunch.com
• Help Net Security (October 30, 2026): helpnetsecurity.com
• The Hacker News (October 30, 2026): thehackernews.com
• CNBC (October 29, 2026): cnbc.com
• Euronews (October 30, 2026): euronews.com