$6.3 billion in minutes: inside the Binance hot-wallet heist

On Thursday 29 October, users noticed money draining out of Binance's hot wallets [4]. By the next day the world's largest crypto exchange had confirmed a security incident affecting about $6.3 billion in assets [1][2]. That makes it the largest crypto theft on record, about four times the roughly $1.5 billion stolen from Bybit in February 2025, and more than double the $2.87 billion that TRM Labs says was stolen across nearly 150 crypto hacks in the whole of 2025 [3].

This is a fast-moving story and the numbers are still changing. What follows is what was publicly known on 30 October. Binance has promised a detailed technical post-mortem once its investigation ends [3].

What happened

According to TRM Labs, preparation started at least 36 hours before the theft. Three small withdrawals from Tornado Cash funded an operator wallet. At 20:20 UTC, that operator submitted a single transaction containing 50 authorisations that had been signed in advance by the Binance hot wallet, each pointing to a "sweeper" contract. Three minutes and 24 seconds later, the hot wallet was told to send its entire balance to an address the attacker controlled [1].

Binance suspended deposits and withdrawals, revoked the affected authorisation and said it would cover all losses from its SAFU fund and its own money [1][2][5]. Stablecoin issuers moved quickly: Tether froze more than 1.567 billion USDT and Circle froze 800 million USDC. Ripple, World Liberty Financial and the Arbitrum Security Council froze smaller amounts [1].

Elliptic estimates that about $2.84 billion has been frozen and about $3.33 billion remains with the attacker in assets no issuer can freeze, spread across roughly 43 addresses [1]. The attacker has been converting funds through swaps, market makers and lending protocols, including borrowing about 20,000 WETH on Aave against stolen USDT [1][2]. Markets reacted immediately: bitcoin fell about 5% to below $77,000 and BNB fell 8% [2].

How it appears to have worked

Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer. From there the attacker reached a service container able to submit withdrawals. Binance says it has found no evidence that any wallet private key leaked, and co-CEO Richard Teng said the attack "was not a single 'one-click' action." Binance has since said it found additional points of breach [1].

Elliptic's reading is that the attacker got Binance's own systems to sign the transactions rather than stealing keys, the same pattern seen in the Bybit theft, where the infrastructure and people around the wallet were compromised rather than the wallet itself. It suggests social engineering, such as a fake coding test or a bogus project, as a likely way in, though that is not confirmed [1].

TRM Labs and Chainalysis attribute the attack with high confidence to North Korea's TraderTraitor group, the unit also linked to Bybit. Elliptic urges caution until the root cause is published, pointing to differences in how quickly and how the funds are being laundered [1].

Why this matters if you don't run an exchange

Strip away the crypto and this is the same story we told about India's NBFC payout heists: the attacker never needed the key itself, only control of a system that was allowed to use it. In the NBFC cases, banks trusted the lender's payout server. At Binance, the wallet trusted its own signing pipeline. In both, once that trusted system was in the wrong hands, every transfer looked legitimate.

Three lessons carry over to any company that moves money or holds sensitive data:

• Engineer laptops are production. A DevOps machine with a path to a container that can move money is part of the payment system, and needs to be protected and monitored like one.

• Signing is not approval. If a service can sign or submit a transfer, the controls that matter are the ones on that service: limits, a second approval for unusual amounts, and alerts on bulk or full-balance movements.

• Preparation leaves traces. The attacker needed at least a day and a half to stage 50 pre-signed authorisations. Unusual signing activity, new contracts and access from new places are visible beforehand, if someone is watching.

A checklist for your own setup

• Which laptops and accounts have a path, however indirect, to systems that can move money or sign transactions?

• Do those systems enforce their own limits and second approvals, or do they trust whatever reaches them?

• Would we notice a request to move an entire balance, or many pre-approved transfers, within minutes?

• Are developer tools, CI runners and service containers separated from production signing?

• Do we train engineers to spot fake job tests and project invitations, a common first step in these attacks?

• Have we rehearsed freezing, revoking and notifying partners in the first hour?

Get your complete exposure report

Large thefts now start with an ordinary foothold: a laptop, a test environment, a forgotten service with too much access. NexusVoid maps what you expose to the internet and the paths from it to the systems that matter, tests whether those paths can be used to move money, and gives you a fix for each finding. Our 24/7 monitoring then tests every newly disclosed vulnerability against your stack as it appears. Get your complete exposure report →

References

1. The Hacker News. "Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen." 30 Oct 2026. thehackernews.com

2. CoinDesk. "Binance loses over $6 billion in the largest crypto hack to date." 29 Oct 2026, updated 30 Oct. coindesk.com

3. Al Jazeera. "Binance says $6.3bn stolen in biggest crypto heist in history." 30 Oct 2026. aljazeera.com

4. TechCrunch. "Binance pauses withdrawals as hackers suspected of stealing billions in crypto." 29 Oct 2026. techcrunch.com

5. Axios. "Binance halts trading after biggest-ever crypto hack." 29 Oct 2026. axios.com