Oct 30, 2026
Binance hack explained: how about $6.3B left its hot wallets in 20 minutes
Binance says a compromised engineer laptop let attackers reach an internal system and send withdrawals that looked official. About $6.3B moved out; about $3B is frozen and Binance says it will cover user losses.
Sir Toastimir
Illustration · Sources: Binance, Chainalysis, TRM Labs
This is a news explainer. It does not describe how to carry out an attack. Figures may change as investigations continue.
Binance, the world's largest crypto exchange, says about $6.3 billion in crypto was taken from its hot wallets on October 29 (US time). Chainalysis puts it at about $6.4 billion. It is the largest crypto theft on record, far above the roughly $1.5 billion Bybit hack in 2025.
What happened, in plain English
- The door: Binance's first findings point to a compromised laptop belonging to a DevOps engineer. That gave the attacker access to a service container, a piece of Binance's internal software.
- The withdrawals: From there the attacker submitted withdrawal transactions that the system treated as legitimate. Co-CEO Richard Teng said it was "not a single one-click action" and that the investigation found additional points of breach.
- The Ethereum trick: According to Chainalysis, on Ethereum the attacker used validly signed authorizations that let a Binance hot wallet run attacker-deployed code (an Ethereum feature known as EIP-7702). The wallet then swept its own funds to attacker addresses. Binance says this delegation did not pass through its normal approval controls.
- No keys leaked: Binance says it has found no evidence that any wallet private key leaked.
- Speed: TRM Labs says the theft took about 20 minutes.
Hot wallets vs cold wallets
A hot wallet is connected to the internet so an exchange can process withdrawals quickly. A cold wallet is kept offline and is much harder to reach, but slower to use. This attack hit the hot side.
What happens now
About $3 billion has been frozen with help from token issuers and blockchain partners. Binance paused withdrawals during its security checks, says user funds are safe, and says it will cover all losses from its SAFU fund and company funds. It plans to publish a full post-mortem and updated proof of reserves. Chainalysis and TRM Labs attribute the attack to TraderTraitor, a North Korea-linked hacking group; that is an analyst assessment, not a law-enforcement finding.
Should exchanges keep billions in hot wallets?
Links
Get your daily slice of AI
One short email with the best new AI tools, robots and AI & tech stock news. Free. Unsubscribe anytime.
We only use your email to send the newsletter.