Quick answer: On 29 October 2026 attackers drained about US$6.3 billion from Binance hot wallets on 10 blockchains in roughly 20 minutes. Binance says the entry point was a compromised engineer’s laptop, not leaked private keys. Investigators link it to North Korea’s TraderTraitor, the same group blamed for the US$1.5 billion Bybit hack in 2025. Binance says it will cover all losses. For your own account, the strongest upgrade is a physical security key such as a YubiKey, plus a separate, clean device for crypto.
Key takeaways
- It is the largest crypto theft on record, roughly four times Bybit.
- About US$3 billion was frozen within hours by Tether, Circle, Ripple and others. The attacker still controls over 420,000 ETH and 18,270 BTC.
- Ethereum was hit hardest (about US$3.8 billion), then Bitcoin (about US$1.5 billion).
- The pattern matches Bybit: one compromised work computer, then the signing process is turned against the exchange.
- AI did not “hack Binance”, but it makes the fake-recruiter and phishing tricks behind these attacks cheaper. It also helped defenders trace and freeze funds fast.
- A hardware security key protects your login from phishing. It cannot protect funds an exchange loses. Keep long-term holdings in self-custody.
In this article
What happened in the Binance hack?
At 20:05 UTC on Thursday 29 October 2026 (just after midnight in the UAE), XRP began leaving Binance wallets. Within about 20 minutes, Bitcoin, Ether, stablecoins and tokens on Tron, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon followed. TRM Labs counts US$6.36 billion moved out across 10 networks.
Binance founder Changpeng Zhao said it “does look like a hack on Binance”. The exchange paused deposits and withdrawals and called it a security incident. The next morning it pointed to a compromised DevOps engineer’s laptop and put the total impact at US$6.3 billion. It also said it had found no evidence that private keys had leaked (Help Net Security).
| Time (UTC) | What happened |
|---|---|
| 28 Oct | Small Tornado Cash withdrawals fund the attacker’s “operator” wallet. |
| 29 Oct, early | The attacker deploys and tests the theft code on test wallets. |
| 20:05–20:09 | 233 million XRP drained from five Binance wallets. |
| 20:20–20:23 | 18,270 BTC sent out. Binance’s main Ethereum hot wallet is taken over and emptied. |
| 21:01–22:10 | Tether, Circle, Ripple and World Liberty Financial freeze stolen stablecoins. |
| 23:05 | A second wave hits Avalanche and Polygon. |
| 23:35 | Binance reports US$2.54 billion frozen, later about US$3 billion. |
| 30 Oct | Binance blames a compromised engineer’s laptop, sets aside US$6.34 billion to cover losses and targets reopening withdrawals within about 40 hours. |
Timeline from TRM Labs and Cointelegraph’s live coverage. Figures may change as the investigation continues.
How the Binance hack worked, step by step
Binance has not published its full post-mortem yet, so parts of this are still the investigators’ best reading of the blockchain data. Here is what is known so far.
One laptop is compromised
An engineer’s work laptop is taken over. Binance has not said how. Fake job offers and booby-trapped coding tests are this group’s usual method.
The attacker reaches a service container
From the laptop, the attacker gets into an internal service that can submit withdrawals. Binance says no private keys were stolen.
Binance’s own signing does the work
On nine chains the stolen funds left through normal, validly signed transfers. TRM thinks the attacker could make the hot-wallet signing system sign for them.
An Ethereum wallet is hijacked
One transaction carried 50 pre-signed approvals (a new Ethereum feature called EIP-7702). One of them handed control of the hot wallet to the attacker’s code. It kept sweeping new deposits for hours.
In plain words: the thief didn’t steal the safe’s key. They got onto a trusted employee’s computer, then convinced the machine that signs withdrawals to sign theirs. That is why “we found no leaked keys” and “US$6.3 billion is gone” can both be true.
What was hit hardest, and what the effects were
| Network | Stolen (approx.) | Main assets |
|---|---|---|
| Ethereum | US$3.79B | 200,630 ETH, 1.875B USDT, 823M USDC |
| Bitcoin | US$1.47B | 18,270 BTC |
| Tron | US$628M | 612.7M USDT, 46.4M TRX |
| XRP Ledger | US$296M | 233.46M XRP |
| Solana | US$96M | 970,500 SOL |
| Arbitrum, Optimism, Base, Avalanche, Polygon | US$77M | ARB, ETH and others |
Source: TRM Labs, values at the time of transfer.
Effect on the market
Bitcoin fell about 5% to just under US$77,000. BNB dropped about 8% to around US$693 and Ether about 5.7%. DeFi tokens such as AAVE and UNI fell more than 10%, and the crypto Fear & Greed Index slid to 30, “fear” territory. Bitcoin held up better than many expected because Binance quickly promised to cover every loss.
Effect on Binance users
Customers have not lost balances, according to Binance. The real pain is access. Withdrawals have been paused since the night of the attack, and the reopening target slipped from 48 to 45 to about 40 hours. For traders that means money they can see but cannot move. Binance has promised an updated proof of reserves after the clean-up.
Effect on the wider industry
The fastest response came from stablecoin issuers. Tether froze about 971 million USDT within an hour, and Circle froze 823 million USDC. That is roughly US$3 billion the attacker cannot spend, which is why stablecoins with freeze controls cut the damage so sharply. What cannot be frozen is ETH and BTC. Over 420,000 ETH and 18,270 BTC (about US$2.4 billion) remain in the attacker’s hands and are expected to be laundered through bridges, swap services and OTC brokers.
Is the Binance hack like the Bybit hack? Related or not?
The closest case is the Bybit hack of 21 February 2025, when about US$1.5 billion in Ether was stolen from a Bybit cold wallet. A developer machine at Safe{Wallet}, the multi-signature wallet service Bybit used, was compromised. The attackers planted malicious code in Safe’s web interface. When Bybit’s signers approved what looked like a routine transfer, they actually signed a change that handed the wallet to the attackers. The FBI later attributed it to TraderTraitor.
| Bybit (Feb 2025) | Binance (Oct 2026) | |
|---|---|---|
| Amount | ~US$1.5B | ~US$6.3B |
| Attributed to | TraderTraitor / Lazarus (FBI) | TraderTraitor (TRM, Chainalysis) |
| Way in | Compromised developer machine at a supplier (Safe{Wallet}) | Compromised DevOps engineer’s laptop at Binance |
| Wallet type | Cold wallet (multi-signature) | Hot wallets on 10 chains |
| Trick | Tampered signing screen showed a fake transaction | Withdrawal and signing systems made to sign attacker transfers |
| Assets | Mostly ETH | ETH, BTC, stablecoins, XRP, SOL and more |
| Frozen | A small share | About US$3B, mostly stablecoins |
Verdict: related, not identical. It is the same attacker with the same playbook: compromise one trusted person’s computer, wait, then turn the signing process against the company. The technical route is different. Bybit was fooled by a third-party interface. At Binance the attacker got inside the exchange’s own infrastructure. The lesson from both is identical: the weakest point is no longer the cryptography. It is the people and machines allowed to approve transactions.
Binance’s earlier security incidents
- May 2019: about 7,000 BTC (then roughly US$40 million) stolen from a Binance hot wallet using stolen API keys and 2FA codes, as BBC News reported. Binance’s SAFU fund covered it.
- October 2022: about US$570 million in BNB was minted through a bug in the BNB Chain cross-chain bridge, a blockchain flaw rather than an exchange-wallet breach.
- October 2026: US$6.3 billion. This time it was neither customer logins nor a code bug, but internal access and signing.
What role did AI play?
No source so far says AI was used to break into Binance, and Binance has not explained how the laptop was compromised. Claiming “AI hacked Binance” would be guesswork. What is well documented is how AI is changing the methods this group relies on, and how it helps the other side.
How AI helps attackers
- Fake recruiters and fake candidates at scale. North Korean operatives use AI to write tailored CVs, run real-time interview help and present synthetic faces and altered voices. One estimate cited by ASPI counts over 166,000 job applications and 21,000 interviews by 22 operatives.
- Booby-trapped coding tests. A fake job offer asks an engineer to download and run a “take-home test” that quietly installs malware. AI makes these lures more convincing and cheaper to produce.
- Better phishing in any language. Polished emails, messages and fake sites no longer give themselves away with bad grammar.
How AI helps defenders
- Tracing in real time. Blockchain analytics firms such as TRM and Chainalysis use automated clustering to follow stolen funds across chains within minutes. That is how issuers knew which addresses to freeze.
- Anomaly detection. Models that learn normal withdrawal patterns can flag a hot wallet suddenly emptying across 10 chains at once and stop it automatically.
- Transaction checks before signing. Simulation tools show what a transaction will really do before anyone approves it, which is exactly what Bybit’s signers lacked.
The honest take: AI is making social engineering cheaper, not making crypto breakable. The defences that work are still old-fashioned: limit who can sign, check what is being signed, and use authentication that cannot be phished.
What can actually save us?
What exchanges need to do
- Keep most funds in cold storage and cap how much any hot wallet can send per hour.
- Require several people on separate, hardened devices to approve large withdrawals, with hardware-backed signing.
- Separate signing systems by chain and wallet tier, so one breach cannot empty 10 networks.
- Give engineers phishing-resistant security keys and locked-down work laptops, and never let personal downloads touch production access.
- Watch for unexpected wallet delegations and bulk pre-signed approvals, and treat them as an alarm.
What you can do as a user
- Do not keep more on an exchange than you trade. Long-term holdings belong in a hardware wallet you control.
- Replace SMS codes with a physical security key or passkey on your exchange and email accounts.
- Turn on the withdrawal address whitelist and anti-phishing code in your exchange security settings.
- Use a separate, clean device for crypto, with no cracked software and no random browser extensions.
- Ignore “urgent” messages claiming to be Binance support after a hack. Scammers always follow big headlines.
Physical security keys: why they beat SMS and app codes
A physical security key, also called a hardware security key or FIDO2 key, is a small USB or NFC device you tap to log in. It does not show a code you can be tricked into typing. Instead it checks the website’s real address before it answers. On a fake “binance-login” site, the key simply refuses. That makes it phishing-proof, which SMS codes and authenticator apps are not.
| Method | Stops phishing? | Stops SIM swap? | Stops malware on your PC? |
|---|---|---|---|
| SMS code | No | No | No |
| Authenticator app | No | Yes | No |
| Physical security key / passkey | Yes | Yes | Partly |
| Hardware wallet (Ledger, Trezor) | Protects your coins themselves, not a login. Always check the address on the device’s own screen. | ||
Be realistic: a security key protects your account. It could not have stopped Binance’s internal breach, and it does not protect coins held by an exchange. Combine it with self-custody for real safety.
Best physical security keys in 2026
All of these work with Binance, Google, Microsoft, Apple ID and most password managers. Prices are the makers’ list prices as of October 2026 (Vucense comparison). UAE retail prices are usually higher.
| Key | Price | Connects via | Best for |
|---|---|---|---|
| Yubico Security Key C NFC Best value | ~US$29 | USB-C + NFC | Most people: exchange, email and social logins |
| YubiKey 5C NFC Best overall | ~US$58 | USB-C + NFC | Power users: adds OTP, smart card and OpenPGP; up to 100 passkeys |
| YubiKey 5 NFC | ~US$58 | USB-A + NFC | Older laptops and desktops with USB-A ports |
| YubiKey 5C Nano | ~US$68 | USB-C, stays plugged in | A laptop that never leaves your desk |
| YubiKey Bio Fingerprint | ~US$98 | USB-A or USB-C | Fingerprint unlock instead of a PIN |
| Nitrokey 3C NFC Open source | ~€65 | USB-C + NFC | People who want open-source hardware and firmware |
Our pick: buy two Yubico Security Key C NFC keys, one to carry and one as a backup. If you also use SSH, code signing or a password manager that supports OTP, get a YubiKey 5C NFC as your main key instead. Choose USB-C for modern MacBooks and Windows laptops. NFC lets you tap the same key on your phone.
How to use a physical security key: short guide
- Buy two keys. If you lose your only key, recovery is slow and painful.
- Set a PIN. Use the Yubico Authenticator app or your browser’s security-key settings. The PIN stops a thief from using a stolen key.
- Add it to your email first. In Google or Microsoft security settings, add a “security key” or “passkey”. Email is the master key to every other account.
- Add it to Binance. Go to Profile, then Security, then Security Key, and choose Enable. Insert or tap the key, enter its PIN, touch it, and confirm with your email and phone or app codes (step-by-step guide). Repeat for the backup key.
- Remove weak methods. Once both keys work, turn off SMS where the service allows, and save the recovery codes offline.
- Store the backup safely, for example at home or in a safe, never in the same bag as the main key.
- Log in normally. Enter your password, then insert or tap the key and touch it when it blinks. That is it.
Tip: if a site ever asks you to “type the code from your key”, stop. Real security keys never show codes, so it is a phishing page.
The lesson for the rest of us: it started with a laptop
The biggest crypto theft in history did not start with broken encryption. It started with one work laptop. The same is true for most personal crypto losses we hear about from customers. Treat the device you trade on like a bank vault door:
- Use a separate laptop or user account only for crypto and banking.
- Keep Windows or macOS and your browser fully updated, with disk encryption (BitLocker or FileVault) on.
- Never install cracked software, “free” trading bots or unknown browser extensions on it.
- Never run a “coding test” or file from an unexpected recruiter on a machine that holds crypto access.
- Prefer business laptops with a TPM security chip, fingerprint or face login and a webcam shutter.
Frequently asked questions
How was Binance hacked?
Binance says its first findings point to a compromised laptop belonging to one of its DevOps engineers. From there the attacker reached a service container and submitted unauthorised withdrawals from Binance hot wallets on 10 blockchains. Binance says it found no evidence that wallet private keys were leaked. A full technical post-mortem has been promised but not yet published.
How much was stolen in the Binance hack?
About US$6.3 billion (roughly AED 23 billion), according to Binance. Blockchain analytics firm TRM Labs puts it at US$6.36 billion at the time of the transfers. It is the largest crypto theft on record, about four times the US$1.5 billion Bybit hack of February 2025.
Who hacked Binance?
TRM Labs and Chainalysis attribute the attack with high confidence to TraderTraitor, a North Korean state-backed group linked to the Lazarus Group. Binance itself has said its investigation has not attributed responsibility to any individual.
Is my money on Binance safe?
Binance says user funds are safe and that it has set aside more than US$6.34 billion from its SAFU fund and company funds to cover all losses. At the time of writing, deposits work but withdrawals are paused while Binance rebuilds its withdrawal system. It has said it will publish an updated proof of reserves.
Is the Binance hack related to the Bybit hack?
Partly. Investigators link both to the same North Korean group, and both started with a compromised computer belonging to a developer or engineer. The technique was different: Bybit was tricked through a tampered Safe{Wallet} signing screen on a cold wallet, while Binance lost funds from hot wallets through its own withdrawal and signing systems.
Would a YubiKey have prevented the Binance hack?
Not by itself for a customer, because the attacker went after Binance’s internal systems, not customer logins. Phishing-resistant keys do matter for exchange staff, though. Hardware-backed authentication for engineers and signing systems is exactly the kind of control that makes a stolen laptop far less useful to an attacker.
What is the best physical security key in 2026?
For most people, the Yubico Security Key C NFC (about US$29) is enough for exchange and email logins. If you also want OTP, smart-card or OpenPGP support, choose the YubiKey 5C NFC (about US$58). Buy two keys and register both so you have a backup.
Can I use a security key with Binance?
Yes. In Binance go to Profile, then Security, then Security Key, and choose Enable. You must already have an authenticator app or phone verification turned on. Binance also supports passkeys, which can live on a hardware key.
Need a secure laptop for trading or work?
Our business laptops come with TPM security chips, fingerprint login and full manufacturer warranty in the UAE. Message us on WhatsApp (+971 52 569 6022) and we’ll recommend one for your budget.
Sources
- TRM Labs: North Korea steals US$6.36 billion from Binance
- Al Jazeera: Binance says $6.3bn stolen · BBC News coverage, 30 October 2026
- CyberInsider: compromised laptop · Help Net Security
- Cointelegraph: as it happened · CNBC: recovery efforts
- Bybit 2025: BleepingComputer · The Block
- Binance 2019: BBC News · AI and North Korea: ASPI The Strategist
- Security keys: Vucense 2026 comparison · Token2 Binance guide
This article explains a news event and general security practice. It is not financial advice.
