Binance Lost $6.3 Billion in About 20 Minutes. The Attack Started With One Laptop

The biggest crypto theft in history took about 20 minutes. On the evening of 29 October 2026, on chain trackers started flagging strange outflows from Binance hot wallets, the internet connected wallets an exchange uses to move deposits and withdrawals. Within the hour, roughly $6.3 billion was gone, and blockchain analytics firm TRM Labs traced about $6.36 billion leaving across 10 different blockchains. For scale, the previous record, the Bybit hack in February 2025, was about $1.5 billion. This one was 4 times larger.

I want to walk through the mechanics, because the how is more interesting than the number, and the number is enormous.

Where this sits against the previous record thefts. It is about 4 times the Bybit hack. Source: public post-incident reporting, 2021 to 2026

They did not break down the front door

Binance runs one of the best funded security operations in the industry, so the attackers did not attack the vault directly. Per Binance’s initial findings, the breach started with a compromised laptop belonging to one of its DevOps engineers, the people who maintain the company’s internal infrastructure. From that laptop, the attackers reached a service container, a piece of Binance’s back end that had the ability to submit withdrawals.

Binance has since said it found additional breach points but has not detailed them, and it maintains that no wallet private keys or cold storage were touched. That distinction matters. The attackers did not steal the master keys. They got into a system that was already trusted to move money, and used it.

The clever part, turning a wallet into a self emptying machine

The piece that makes this hack different is how the Ethereum funds left. The attackers used EIP-7702, a feature that shipped with Ethereum’s Pectra upgrade on 7 May 2025 and lets an ordinary wallet temporarily borrow the behavior of a smart contract. Normally a plain wallet just holds and sends funds. EIP-7702 lets it run code for a transaction, which is genuinely useful for things like paying fees in stablecoins, batching several actions into one, or adding spending limits and recovery options.

The attackers pointed that feature at a Binance hot wallet labeled Binance 14. They installed a malicious contract on it that turned the wallet into an automatic sweeper, one that drained the existing balance and forwarded any new deposits to the attacker too. According to Blockaid, the attack transaction carried 50 EIP-7702 authorizations at once, fired across 50 consecutive transaction counters to raise the odds that one would land. Only 1 needed to succeed, and 1 did.

I want to be fair to the Ethereum feature here, because the easy headline is that a new upgrade got exchanges hacked. EIP-7702 has real safeguards built in. An authorization is specific to one chain by default, it can be tied to the account’s transaction counter, and the account owner can revoke it. The feature did what it was designed to do. The failure was that whoever controlled Binance 14 was in a position to sign an authorization at all, which comes back to the laptop and the service container, not to Ethereum. A powerful tool handed to the wrong signer is the whole story.

At 20:24 UTC a single sweep call emptied Binance 14. Within 24 seconds, Binance 16 sent another 28,005 ETH to the same address. The attacker had effectively reprogrammed the wallets so that one operator could drain them with a click. Soon after, 780 million USDC left another hot wallet, and the Bitcoin and Tron wallets were drained too. About 18,270 BTC left a Binance Bitcoin hot wallet. Etherscan relabeled the receiving address Binance Hot Wallet Exploiter, which is about as blunt as on chain labeling gets.

The attack chain, from a single compromised laptop to self emptying wallets, in about 20 minutes. Source: Binance findings and Blockaid analysis, Oct 2026

Binance went from business as usual to a full stop

The public response came fast. Former CEO Changpeng Zhao, known as CZ, posted that it did look like a hack, and Binance paused deposits and withdrawals globally. At 02:23 UTC on 30 October, Binance formally confirmed the incident, put the impact at about $6.3 billion, and said it was working with law enforcement. Reuters reported the exchange is cooperating with the FBI and the US Secret Service. Binance US, which runs as a separate company, said it was unaffected.

Binance’s promise to users was that nobody would lose money. CEO Richard Teng and the company said all losses would be covered from its SAFU fund, the Secure Asset Fund for Users that Binance keeps for exactly this, plus the company’s own balance sheet. Binance reserved over $6.34 billion to cover it, roughly $5 billion already held in the same tokens that were stolen and the rest being bought through market and OTC channels. Co-founder Yi He said the company’s annual revenue alone is enough to absorb the hit.

Run the math and the scale becomes clearer. Binance reportedly holds somewhere around $160 billion in customer assets, so a $6.3 billion loss is close to 4% of custody. Painful, and survivable for a company this size. A smaller exchange taking the same hit in percentage terms would simply be gone.

The industry froze half of it within hours

The part that would not have happened a few years ago is what came next. Within hours, the companies that issue stablecoins started freezing the stolen funds on chain.

This works because of how stablecoins are built. A stablecoin like USDT or USDC is issued by a company that controls the token’s contract, and that company can blacklist an address, which makes the tokens sitting in it stop moving entirely. Tether, led by CEO Paolo Ardoino, froze more than 1.567 billion USDT. Circle froze over 800 million USDC. World Liberty Financial froze 27 million of its USD1, and the Arbitrum Security Council froze about 30.5 million on Arbitrum. Binance said roughly $3 billion in total has been frozen, close to half the haul, locked up before the attacker could move it.

For an industry that usually watches stolen money vanish into mixers, freezing half of a record theft within hours is a real shift. It also exposes something the crypto world does not always like to say out loud. The ability to freeze those funds means the biggest stablecoins are not censorship resistant. The same power that stopped a North Korean operation from cashing out is a power the issuers hold over everyone, every day.

Roughly half the stolen funds were frozen within hours. The rest, mostly ETH, is beyond any issuer’s reach. Source: TRM Labs, Tether, Circle, Reuters, Oct 2026

The money that got away

The freeze had a hard limit. Native ETH and BTC are not issued by a company, so nobody can blacklist them. The attacker moved 195,460 ETH, worth around $450 million at the time, to a fresh wallet during the first sweep, and on chain trackers estimate the attacker still controls somewhere near 480,720 ETH, over $1 billion, that no issuer can touch. That is the portion headed for mixers and cross chain bridges, the usual path for laundering funds that cannot be frozen.

So the honest scoreboard is split. Roughly $3 billion frozen, roughly $3.3 billion still in the attacker’s hands, much of it in assets that will be hard to recover. The freeze cut the attacker’s winnings by about half. It did not undo the theft.

Who did it, as far as anyone can say

No government or exchange has officially named the attacker. What exists is attribution from blockchain intelligence firms, which is informed analysis rather than a verdict. TRM Labs said it tied the attack with high confidence to TraderTraitor, a North Korean unit linked to the Lazarus Group. The independent investigator ZachXBT named Lazarus as the likely attacker. Binance CEO Richard Teng has said the investigation has not identified the attackers.

The case for North Korea is circumstantial but strong. The Bybit hack in February 2025, the previous record, was attributed by the FBI to North Korea, and TRM says this attack shares traits with it. Two days before this hack, Binance said it had blocked a week of North Korea linked attacks that used fake job interviews to target employees, a known Lazarus tactic. None of that is proof, and I will not state it as fact, but it is why serious firms are pointing the same direction.

The reason this attribution carries weight beyond a whodunit is what the money reportedly pays for. United Nations Security Council panels have for years documented North Korea using stolen crypto to fund its nuclear and missile programs, estimating the regime pulled in around $3 billion from crypto theft over a span of years and relied on it for a large share of its foreign currency. If the same pattern holds here, the stolen billions are a state financing weapons by draining an exchange, which is exactly why the freeze response matters as more than money recovery. Every dollar locked before it reaches North Korea is a dollar that does not reach the program behind it.

What it did to Bitcoin

The hack landed on an already shaky market. For weeks Bitcoin had been holding around the $80,000 level, with buyers defending every dip. When the drain started on the Thursday evening, BTC was near $81,000. Within about an hour it was below $80,000, and once that floor broke, the leverage stacked on top of it unwound fast.

CoinGlass data shows about $1.53 billion in derivatives positions liquidated over 24 hours. About 83.8% of that was long positions, traders betting the price would rise, getting force closed as it fell. Binance alone accounted for $754.6 million of the liquidations. Bitcoin printed a low near $76,460, right around its 200 day moving average, its weakest level in weeks, before clawing back toward $78,500.

So it took the single largest theft in crypto history to finally knock Bitcoin through the floor it had defended for weeks. The recovery since then is the more interesting signal. A $6.3 billion exchange hack moved the price by single digit percentages and the market kept functioning.

Why this did not break crypto

A few years ago, a $6.3 billion theft from the largest exchange would have been close to an extinction event for the industry. This time Binance absorbed it from reserves, stablecoin issuers froze half of it within hours, and Bitcoin fell a single digit percentage and started recovering the same week.

That resilience is real, and it comes with a bill. The hack worked because a single engineer’s laptop could reach a system trusted to move billions, which is a centralization problem Binance will have to answer for. The recovery worked because a handful of companies can freeze money on command, which is a decentralization problem the whole industry has to sit with. The money is safe for Binance’s users this time, and the two things that saved them are the two things crypto was supposed to make unnecessary.