Binance Hack: What We Know About the $6.3B Breach

The Short Version

On the night of October 29, 2026, an attacker drained Binance hot wallets across as many as nine blockchains in under four hours. Binance first pointed to a compromised DevOps engineer's laptop, but a later update says investigators have found additional points of breach. The estimated impact is around $6.3 billion, with about $3 billion frozen on-chain so far.

Binance says it has found no evidence of a wallet private key leak, and that it will cover all losses from its SAFU fund and company funds. Several outlets already call it the largest theft in crypto history.

For users, the message is reassuring: balances are covered. For every security team in Web3, the message is harder. If attackers can find several ways into the world's largest exchange at once, which of your controls are actually resilient, and which ones are you simply trusting until someone tests them?

Timeline of The Binance Hack

The attack ran from about 20:04 to 23:56 UTC on October 29 and hit Binance wallets on ten blockchains: Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Avalanche, Optimism, Base, and Polygon. Most of the funds were left in about 20 minutes, starting at 20:05 UTC; the attacker then swept the compromised wallets again at 20:41, 20:59, 21:04, 21:44, 22:39, and 23:56 UTC. Stablecoin issuers started freezing funds within an hour; Binance paused withdrawals roughly two hours after the first on-chain activity.

Early loss estimates varied widely as analysts tracked different chains: ~$3.3B for Ethereum alone, $5.5–5.8B in on-chain analyst tallies, and ~$6.3B in multi-chain tracking, which matches Binance's official figure. Ripple and the Arbitrum Security Council also joined the freezes, and Aave froze its Avalanche markets.

How The Attack Worked

The attacker never needed Binance's private keys. They needed a machine that was allowed to ask for signatures. A compromised DevOps laptop was the first route Binance identified, and its latest update says there were others.

In Binance's initial findings, the attack ran as below. A later update says investigators have since found additional points of breach, so treat this as one confirmed route in, not the full picture:

1. Endpoint compromise. A DevOps engineer's laptop was compromised. How it happened (phishing, malware, a poisoned dependency) has not been disclosed.
2. Lateral movement into production. From the laptop, the attacker reached a service container inside Binance's withdrawal infrastructure.
3. Abuse of a trusted service. The container could submit withdrawal transactions, so the attacker submitted unauthorized ones. The wallet system signed them because they came from a trusted source.
4. Fast, multi-chain extraction. TRM Labs says about $6.36B left Binance wallets across 10 blockchains. Most of it went in about 20 minutes from 20:05 UTC, followed by smaller sweeps until 23:56 UTC

On Ethereum, on-chain evidence shows a Tornado Cash-funded address switched a Binance hot wallet to run its own contract through an EIP-7702 delegation, which requires a valid signature from the wallet. That fits Binance's "no private key leak" line: the keys stayed put, but the service that uses them was turned against them.

Co-CEO Richard Teng stressed that this was not one engineer's permissions or a single "one-click" action, but a more complex attack process, and that the investigation has not blamed any individual. Binance's latest update backs this up: it calls the incident a complex attack and says investigators have found additional points of breach beyond the laptop.

TRM Labs and Chainalysis attribute the theft to TraderTraitor, a North Korean state-linked unit, and Chainalysis says it spotted funds from September's Bitget exploit mixing with the Binance proceeds.

The pattern is familiar. The $1.5B Bybit hack in February 2025 also started on a single developer machine, at wallet provider Safe, which was used to push a malicious transaction that Bybit's signers approved. In both of the two largest exchange thefts on record, a compromised engineer's computer was part of the way in, not broken cryptography.

How Binance And The Ecosystem Responded

The response limited the damage to roughly half the stolen amount, mostly thanks to stablecoin issuers who could freeze tokens at the contract level.

• Freezes. About $3B is frozen on-chain so far. Tether alone reported more than 1.567B USDT frozen, and Circle more than 800M USDC. Ripple, World Liberty, the Arbitrum Security Council, and others froze smaller amounts.
• What can't be frozen. Native BTC and ETH have no issuer to freeze them. TRM Labs says the attacker now holds more than 420,000 ETH and 18,270 BTC, about $2.4B beyond any issuer's reach. CryptoQuant tracked the BTC split into 19 fresh addresses, untouched as of its post.
• Withdrawals paused. Binance suspended withdrawals while it rebuilds the withdrawal service and its related addresses, and revoked the affected address authorizations. Binance says outflows stopped once withdrawals were paused, that it is on track to resume them in about 45 hours, and that deposits remain unaffected.
• Coverage. Binance says it will cover all losses from the SAFU fund and company funds. SAFU holds about 15,000 BTC, roughly $1.17B, so the balance sheet carries the rest.
• Next disclosures. A full technical post-mortem once facts are verified, and an updated Proof of Reserves after remediation. Law enforcement and blockchain intelligence partners are tracing the funds.

Crypto Times reports Binance.US was not affected and that Binance Alpha trading was also paused as a precaution.

Within hours, Binance had paused the withdrawal path, put out a cause and a loss estimate, committed to covering losses, and was working with issuers to freeze about half the stolen funds. HackenProof's CTO sees that as the part of the story worth learning from:

"No system is immune to vulnerabilities. No codebase is guaranteed to be bug-free. How a team responds when things go wrong matters. Credit to the Binance team for their handling of this incident—strong incident response deserves recognition."
— Alex Horlan, CTO at HackenProof

Security Lessons From The Binance Breach

The core lesson: strong key storage is not enough if the systems allowed to request signatures can be reached from an ordinary laptop. The full post-mortem will add detail, but the known facts already point to six controls every exchange, custodian, and Web3 platform should re-test now.

Where HackenProof Helps

No single service would have guaranteed this attack failed. What reduces the odds is layered, adversarial testing that follows the same path an attacker takes, from people and endpoints to infrastructure to on-chain logic. That is the work HackenProof does for crypto exchanges, custodians, and Web3 platforms.

Exchanges are where HackenProof started. Platforms such as OKX have run programs on HackenProof, and the platform reports more than $95B in digital assets protected. The lesson here is simple: the attacker tested Binance's real-world chain of trust before anyone else did. Make sure researchers you trust test yours first.

FAQ