--- title: "Binance Hacked: How One Laptop May Have Led to a $6.36B Theft" url: https://syntaxradar.com/radar/binance-hacked-engineer-laptop-theft author: "Abdul Rehman, Lead Systems Architect and Technical Director" publishedAt: 2026-10-30T07:38:48.000Z dateModified: 2026-10-30T07:38:48.000Z category: "#EMERGING-TECH" topic: "binance hacked" primarySource: https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history summary: "Binance hacked: how one compromised laptop may have led to a $6.3B theft, why only part was frozen, who TraderTraitor is, and what to do now." --- # Binance Hacked: How One Laptop May Have Led to a $6.36B Theft **Short answer:** On Oct 29, 2026, attackers drained Binance hot wallets across ten blockchains. TRM Labs counts about $6.36B stolen and links it to North Korea's TraderTraitor; Binance blames a compromised engineer laptop and says it will cover all losses. **Takeaway:** The record Binance theft did not need a leaked private key: by Binance's early account, one compromised laptop reached the system that submits withdrawals, and only part of the loot, mostly stablecoins, could be frozen. **Key figures (as reported by the source):** - Stolen, per TRM Labs (theft-time prices): $6.36B - Frozen by 00:30 UTC Oct 30, per TRM: ~$2.7B - Blockchains hit: 10 According to blockchain analytics firm TRM Labs and its [analysis of the Binance hack](https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history), money started leaving Binance's hot wallets at 20:05 UTC on October 29, 2026, and most of the outflows were done about 20 minutes later. By October 30, TRM had counted about $6.36 billion stolen across ten blockchains, roughly four times the $1.5 billion Bybit hack of February 2025. Is Binance hacked? Yes, and by TRM's count it is the largest crypto theft on record. The surprising part is the entry point. Binance's early explanation points to one compromised laptop belonging to a DevOps engineer. ### What happened with Binance? On October 29, Binance was hacked: users began reporting funds draining from Binance wallets, and Binance suspended deposits and withdrawals. [TechCrunch's report that Binance paused withdrawals](https://techcrunch.com/2026/10/29/binance-pauses-withdrawals-as-hackers-suspected-of-stealing-billions-in-crypto/), published at 3:27 PM Pacific time, quoted Binance spokesperson Ross O'Leary saying Binance withdrawals were suspended on multiple networks as a precaution and that user funds were "completely safe." At that point nobody had a firm number. TechCrunch relayed that crypto watchers estimated at least $2 billion had left Binance's hot wallets, and that CoinDesk put it at upward of $5.7 billion, unconfirmed and possibly still growing. By October 30 the picture had sharpened. In a [statement on the Binance hack reported by CoinLaw](https://coinlaw.io/binance-halts-withdrawals-6-3-billion-hack/), Binance said about $6.3 billion in assets were affected and about $3 billion had been frozen on-chain. It said it would cover all losses from its SAFU fund (its emergency reserve for users) and company funds, that it had revoked the affected address authorization, and that it had brought in law enforcement. The same day, TRM Labs published its own analysis and attributed the theft, with high confidence, to North Korea's TraderTraitor group. Binance.US and Coinbase both said they were not affected. Binance said the breach involves Binance.com only. ### How was Binance hacked? By Binance's early account, the Binance hack began on one DevOps engineer's laptop and ended in a hot wallet. An exchange keeps most customer crypto offline but needs a pool of coins online to pay out withdrawals quickly. That online pool is the hot wallet, and a piece of software decides when coins leave it. Binance said its early checks suggest the attacker compromised the laptop and used it to reach a service container: a small, isolated piece of Binance's infrastructure whose job is to submit withdrawals. From there, the attacker sent withdrawal requests that the system treated as legitimate. Binance also said it found no evidence that a wallet private key leaked. That detail matters. Think of a bank where nobody stole the vault key. Instead, someone got onto the computer that sends instructions to the vault, and the vault obeyed because the instructions came from the right place. The chain data shows how fast and how organized the payout was. On Ethereum, TRM reports that the attacker used EIP-7702, an Ethereum feature that lets an ordinary wallet hand its powers to a piece of smart contract code, along with 50 pre-signed authorizations. A single transaction at 20:20 UTC moved 167,464 ETH and 63 different tokens, including 1.615 billion USDT. TRM puts Ethereum's share at about $3.79 billion. Bitcoin went at the same minute. TRM says 18,270 BTC, worth about $1.47 billion, left a Binance Bitcoin hot wallet at 20:20 UTC and was split through a peel chain, a laundering pattern where a large balance moves through a long series of wallets, shaving off smaller amounts at each hop. TRM's breakdown of the rest of the Binance attack lists Tron (about $628 million), the XRP Ledger (about $296 million), Solana (about $96 million), Arbitrum, Optimism and Base (about $39 million combined), Avalanche (about $28 million) and Polygon (about $10 million). TRM reports that withdrawals from Tornado Cash, a crypto mixer, funded the attacker's operator wallet starting October 28, at least 36 hours before the theft. ![Timeline of the Binance hack: Tornado Cash funding on Oct 28, first transfer at 20:05 UTC, 167,464 ETH and 18,270 BTC moved at 20:20 UTC, most funds gone by 20:25 UTC and about 2.7B USD frozen at 00:30 UTC on Oct 30, per TRM Labs](/uploads/blog/binance-hacked-engineer-laptop-theft/img1.webp) ### Why do Binance hack numbers range from $2 billion to $6.36 billion? The Binance hack totals in different headlines differ mostly by timing and wording, so nobody is necessarily wrong. The table lines up each figure with its source.
FigureWho said itWhat it measures
At least $2 billionCrypto watchers, via TechCrunch (Oct 29)First partial estimate, now superseded
Upward of $5.7 billionCoinDesk, via TechCrunch (Oct 29)Early estimate, unconfirmed at the time
About $6.3 billionBinance (Oct 30)Assets "affected"
About $6.36 billionTRM Labs (Oct 30)Assets stolen, at prices when taken (about $6.23 billion at current prices)
About $3 billionBinanceFrozen on-chain so far
About $2.7 billionTRM LabsFrozen as of 00:30 UTC Oct 30
About $2.4 billionTether and Circle CEOsFrozen by those two issuers only
The $2 billion figure came in the first hours, before anyone had traced all ten chains. The $6.3 billion and $6.36 billion figures are the full count, with Binance saying "affected" and TRM saying "stolen." The frozen totals differ because they were measured at different times and include different issuers. One more comparison you will see: TRM and Reuters put the Bybit hack at about $1.5 billion, while TechCrunch says $1.4 billion. Either way, by TRM's count this Binance exchange hack is roughly four times larger. ### Can stolen Binance crypto be frozen? Only part of it can. Stablecoins such as USDT and USDC are issued by companies, Tether and Circle, and their token contracts let the issuer block an address. Tether CEO Paolo Ardoino said Tether froze about $1.6 billion, and Circle CEO Jeremy Allaire said Circle froze more than $800 million in USDC, according to CoinLaw. TRM's tally as of 00:30 UTC on October 30 was about $2.7 billion frozen, including about 1.77 billion USDT, 825 million USDC, 40.5 million RLUSD and 27.8 million USD1. There was one more lever. On Arbitrum, a network that runs on top of Ethereum, TRM says the Arbitrum Security Council forced transfers of 8,426 ETH and 74.6 million ARB at 00:08 UTC. Bitcoin and ETH on Ethereum's main network have no issuer and no council with an off switch. Once they leave, nobody can claw them back on-chain. TRM says the attacker still holds more than 420,000 ETH plus the 18,270 BTC, all beyond any issuer's reach. ![Bar chart of why Binance hack numbers differ: loss estimates from at least 2B USD to about 6.36B USD next to frozen totals of about 3B, 2.7B and 2.4B USD](/uploads/blog/binance-hacked-engineer-laptop-theft/img2.webp) ### Who is TraderTraitor, the North Korea group blamed for the Binance hack? TraderTraitor is a hacking group that TRM Labs links to North Korea, and TRM attributes the Binance theft to it with high confidence. The FBI named the same group as responsible for the Bybit hack in February 2025. Attribution here is TRM's assessment; Binance has said it is working with law enforcement, and an official finding may come later. TRM's chain analysis of this North Korea crypto hack describes a planned operation. The Ethereum withdrawals were bundled using 50 pre-signed authorizations. Most of the money moved inside about 20 minutes, across ten blockchains. Then came a peel chain for the Bitcoin and a swap of stablecoins into ETH. Both thefts, tied to North Korean crypto hackers by TRM in this case and by the FBI for Bybit, hit major exchanges. If Binance's early account holds, this one started with one engineer's laptop. ### Is Binance safe? Binance says user funds are safe: the company said customer deposits were untouched and that it would cover all losses from the SAFU fund and company funds. Co-CEO Yi He said Binance would absorb all hacking losses, according to [Reuters, as syndicated by globetv.app](https://globetv.app/news/north-korean-hackers-steal-63-billion-from-binance-in-largest-crypto-heist-firms-say-6ae43869ad113). Those are Binance's statements. Outsiders cannot yet verify its balance sheet, so treat them as promises to watch rather than settled facts. On whether Binance is insolvent, none of the sources used here say so. They say Binance has committed to covering the loss itself, and the real test is whether withdrawals reopen and process normally. On timing, Binance said its suspended withdrawals should resume within 48 hours and that a detailed technical post-mortem will follow. Yi He also said withdrawals stay disabled until Binance confirms its environment is secure, so the second statement can override the first. Whether Binance is safe from hackers in future is a separate matter, and no exchange can promise that. By Binance's early account, the entry point was an engineer's laptop and the systems it could reach, and that kind of risk exists at any custodial platform. #### Was my Binance account hacked? No report so far says a Binance account was hacked or that individual customer accounts were breached. Binance and TRM describe a drain of Binance's own hot wallets through its internal systems, and Binance said customer deposits were untouched. Still, events like this attract scammers. A few sensible steps: - Get updates only from Binance's official app, website and verified social accounts. - Ignore messages offering "refunds," "wallet verification" or help recovering funds. Real support never asks for your password, 2FA codes or seed phrase. - Use an authenticator app or hardware security key for 2FA rather than SMS. - Turn on a withdrawal address allowlist if your exchange offers one, so new addresses need extra approval. - If you use Binance.US or Coinbase, both said they were not affected. ### Binance hacked today: what happens next? Four things are still open after the Binance hack. **Withdrawals.** Binance said they should be back within 48 hours. Whether they reopen smoothly will be the clearest early test of Binance's promise to cover losses. **The post-mortem.** Binance has promised a detailed technical write-up. The key question is how one laptop could reach a container that submits withdrawals, and which checks a single transaction moving 167,464 ETH passed on its way out. **The untouchable coins.** TRM says more than 420,000 ETH and 18,270 BTC sit outside any freeze. Watch for how much more gets traced, and whether more of the laundering trail can be blocked. **Not just Binance.** On the same day, Polymarket briefly halted trading and paused withdrawals after a third-party company was compromised; researchers estimate about $2 million in user funds was stolen via DebugBear software. Different scale, similar weak point: a person or a third-party tool. ## Frequently asked questions ### Is Binance hacked? Yes. On October 29, 2026, attackers drained Binance.com hot wallets across ten blockchains. TRM Labs counts about $6.36 billion stolen, the largest crypto theft on record, and Binance says about $6.3 billion in assets were affected. Binance's early checks point to a compromised DevOps engineer's laptop, with no evidence of a private key leak. ### Is Binance safe from hackers? No exchange can promise that. By Binance's early account, the weak point was a compromised engineer laptop and the systems it could reach, and that kind of risk exists at any custodial platform. Binance says customer deposits were untouched and that it will cover all losses, but those are its own statements and outsiders cannot yet verify them. ### How was Binance hacked? Binance's early checks suggest a compromised DevOps engineer's laptop gave an attacker access to a service container used to submit withdrawals, which the system then treated as legitimate. Binance said it found no evidence that a wallet private key leaked. TRM Labs attributes the theft to North Korea's TraderTraitor group with high confidence. ### Is Binance insolvent? None of the sources reviewed say so. Binance says it will cover all losses from its SAFU emergency fund and company funds, and that customer deposits were untouched. Those are Binance's own statements, and outsiders cannot yet check its finances, so the practical test is whether withdrawals reopen and process normally. ### When will Binance withdrawals resume? Binance said withdrawals should resume within 48 hours, according to Reuters, and that a detailed technical post-mortem will follow. Co-CEO Yi He also said withdrawals stay disabled until Binance confirms its environment is secure, so the timing depends on that check rather than on a fixed date. ### Is Binance US safe? Binance.US and Coinbase both said they are not affected. Binance has said the breach involves Binance.com only, the global exchange. If you hold funds on Binance.US or Coinbase, there is no reported loss there. Wherever you hold funds, the main risk this week is scam messages pretending to offer refunds or account recovery, so rely only on official channels. ## Source Based on TRM Labs' analysis and Binance's statements. https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history --- Published on SyntaxRadar (https://syntaxradar.com). Canonical URL: https://syntaxradar.com/radar/binance-hacked-engineer-laptop-theft. Last modified 2026-10-30T07:38:48.000Z.