On 29 October 2026, Binance, the world's largest cryptocurrency exchange by users, said it was investigating a security issue after about $6.3 billion in crypto left its wallets. Blockchain analytics firm TRM Labs says most of the funds moved in about 20 minutes from 20:05 UTC across ten blockchains. In an update on 30 October, Binance said its initial investigation suggests that a compromised DevOps engineer's laptop let the attacker reach a service container and submit unauthorised withdrawal transactions, and that it had found no evidence of a wallet private key leak. Binance later said it had found "additional points of breach". It suspended withdrawals, revoked the affected address authorisation and says it will cover all losses. TRM Labs attributes the theft to North Korea's TraderTraitor unit, and Chainalysis supports that view. Binance has not named an attacker, and a full post-mortem has not yet been published.
Key takeaways
- Binance estimates the impact at about $6.3 billion; TRM Labs puts the outflow at about $6.36 billion across ten blockchains and calls it the largest crypto theft on record.
- According to Binance's initial findings, a DevOps engineer's compromised laptop gave the attacker a route to a service container that could submit withdrawals. Binance says it found no evidence of a wallet private key leak.
- About $2.7 billion had been frozen by stablecoin issuers and Arbitrum's Security Council by early 30 October, according to TRM Labs, leaving about $2.4 billion under the attacker's control.
- The investigation is ongoing. TRM Labs attributes the attack to TraderTraitor "with high confidence" and Chainalysis concurs; Binance itself has not attributed it, and co-CEO Richard Teng says the attack "did not simply use one engineer's permissions".
- The identity lesson: a service that can submit withdrawals is a machine identity with direct access to money. If it can be reached from an engineer's laptop, the laptop becomes part of the wallet's security boundary.
At a glance
| Organisation | Binance, a cryptocurrency exchange (Binance.US and Coinbase said they were not affected, according to Reuters) |
|---|---|
| When | Theft from 20:05 UTC on 29 October 2026, with a second wave around 23:05 UTC (TRM Labs); first Binance statements 29 October 2026; Binance security incident update 30 October 2026 |
| Attacker | Not named by Binance. TRM Labs attributes the attack to TraderTraitor, a North Korean state-backed unit, with high confidence; Chainalysis confirmed TRM's findings, according to BleepingComputer |
| Entry point | A compromised DevOps engineer's laptop, according to Binance's initial investigation; how the laptop was compromised has not been disclosed, and Binance later found additional points of breach |
| Identities abused | Access to a service container able to submit withdrawal transactions; hot wallet authorisations. Binance says there is no evidence of a private key leak, while TRM's analysis points to a compromise of hot wallet signing infrastructure |
| Impact | About $6.3 billion withdrawn (Binance estimate); about $2.7 billion to $3 billion frozen; withdrawals suspended; Binance says user funds are safe and losses will be covered |
| Category | NHI. Incident class: confirmed NHI breach (service container withdrawal authority abused; root cause still under investigation) |
What happened
Binance runs hot wallets on many blockchains so that customer withdrawals can be processed automatically. On the evening of 29 October 2026, funds began to leave those wallets. TRM Labs says most of the money moved in about 20 minutes starting at 20:05 UTC, across Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon, with a second wave around 23:05 UTC reaching Avalanche and Polygon wallets. Binance said it was investigating a potential security issue and temporarily suspended withdrawals on multiple networks as a precaution, according to TRM's summary of its statements.
Binance's security incident update, first published on 30 October, gave the early picture. Its initial investigation suggests that a compromised laptop belonging to a DevOps engineer allowed the attacker to access a service container and submit unauthorised withdrawal transactions. Binance says "We have found no evidence of any wallet private key leak", as quoted by Decrypt. It estimated the total impact at about $6.3 billion, said about $3 billion had been frozen on-chain, and said it would cover losses from its SAFU fund and company funds. "User funds are safe," the update says. Reuters, in a report carried by Khaleej Times, quoted Binance as saying "all deposits and withdrawals are temporarily suspended while our security teams conduct checks"; Binance's own update later notes that deposits were unaffected and operating normally.
TRM Labs' analysis, published on 29 October, describes how the Ethereum wallet was taken over. The attacker used EIP-7702 to make a Binance hot wallet run a sweeper contract, submitting 50 pre-signed authorisations, one of which matched the wallet's transaction count. "In TRM's assessment, this points to a compromise of Binance's hot wallet signing infrastructure," the firm writes. On the other nine chains, funds left through ordinary signed transfers. That view sits alongside Binance's statement that it has seen no evidence of a private key leak: one plausible reading is that the attacker made the signing service sign for it rather than stealing keys, but neither party has published that conclusion, and this page does not assume it.
The story moved quickly. Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action", and that "Our investigation has not attributed responsibility to any individual", according to Decrypt. Binance said it had found "additional points of breach" beyond the laptop, without saying what they were. TRM attributes the theft to TraderTraitor, the North Korean unit the FBI linked to the 2025 Bybit hack, and BleepingComputer reports that Chainalysis confirmed TRM's findings "with a high degree of confidence." Binance says a detailed technical post-mortem will follow once its findings are verified.
Timeline
| Date | Event |
|---|---|
| 29 October 2026 | From 20:05 UTC, about $6.36 billion leaves Binance wallets across ten chains, most within 20 minutes; a second wave follows around 23:05 UTC (TRM Labs). Binance says it is investigating and suspends withdrawals on multiple networks. |
| 29 October 2026 | TRM Labs publishes its analysis attributing the theft to TraderTraitor. |
| 30 October 2026 | By 00:30 UTC about $2.7 billion has been frozen by Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council (TRM Labs). |
| 30 October 2026 | Binance publishes its security incident update naming a compromised DevOps engineer's laptop and a service container as the initial findings, and says it will cover losses. |
| 30 October 2026 | Binance reports additional points of breach; Richard Teng says the attack was not a single one-click action. Chainalysis backs TRM's attribution. |
How it happened: the identity attack path
- Engineer endpoint compromised. A DevOps engineer's laptop was compromised, according to Binance's initial investigation. Binance has not said how, and TRM notes the operator wallet was prepared in advance with small Tornado Cash withdrawals and test runs.
- Access to a service container. From the laptop, the attacker reached a service container inside Binance's environment. Binance's co-CEO says the attack went beyond one engineer's permissions, and Binance has found further points of breach.
- Withdrawal authority abused. The service container could submit withdrawal transactions, and the attacker used it to submit unauthorised ones. This is the machine identity at the centre of the incident: a workload trusted to move funds.
- Signing produced without a key leak. Binance says there is no evidence of a private key leak. TRM's analysis of 50 pre-signed EIP-7702 authorisations points to a compromise of hot wallet signing infrastructure.
- Funds swept across ten chains. Most of the money moved in about 20 minutes, faster than manual review could stop it. Stablecoin issuers and Arbitrum's Security Council then froze about $2.7 billion.
Impact
- Confirmed by Binance: about $6.3 billion in estimated impact, about $3 billion frozen on-chain, withdrawals suspended and the affected address authorisation revoked. Binance says user funds are safe and that losses will be covered from the SAFU fund and company funds.
- Reported by TRM Labs: about $6.36 billion stolen across ten chains; about $2.4 billion still controlled by the attacker, including more than 420,000 ETH and 18,270 BTC that cannot be frozen, according to BleepingComputer's report of TRM's figures.
- Not yet known: how the laptop was compromised, what the additional points of breach were, and exactly how valid signatures were produced. Binance has promised a technical post-mortem.
- Market: Reuters reported bitcoin and ether each fell more than 3% and BNB about 5% after the news.
- Wider: TRM calls it the largest crypto theft on record, about four times the $1.5 billion Bybit theft of February 2025, which was also attributed to TraderTraitor.
What this means for NHI and AI agent security
This is on an NHI list because, on Binance's own account, the money did not move because someone stole a wallet key. It moved because an attacker reached a service that was already trusted to submit withdrawals. That service container is a non-human identity with direct financial authority, and its protection depended on the machines and people who could reach it. The same pattern ran through the Bybit hack of 2025, where a developer's access to cloud infrastructure opened the path to the signing flow. Exchanges invest heavily in key custody, but signing services, withdrawal workers and the credentials that reach them deserve the same rigour, as our Crypto Exchange Identity and Key Security Guide sets out.
The second lesson concerns engineer endpoints. A DevOps laptop typically holds cloud sessions, cluster credentials and deployment tokens, which makes it a store of machine identities, not just a user device. Our guide to Developer endpoints as NHI stores covers how to treat it that way. Teng's comment that the attack was not a single action using one engineer's permissions points to several weak links, so the defence has to be layered: no single engineer, workload or session should be enough to authorise a large withdrawal.
Speed is the third point. Most of the funds moved in about 20 minutes. Controls that depend on a person noticing are too slow at that pace; velocity limits and independent approval on the signing path, described in our guide to Dual control and four-eyes approval for privileged and agent actions, have to act automatically.
Recommendations
- Treat withdrawal and signing services as top-tier identities. Inventory every workload that can request or produce a signature, give each its own narrowly scoped identity and review who and what can reach it. See our Crypto Exchange Identity and Key Security Guide.
- Separate engineer access from production money paths. Do not let credentials on a developer or DevOps laptop reach containers that can move funds; require privileged access workstations and just-in-time elevation for that tier. See our guide to Developer endpoints as NHI stores.
- Enforce independent policy checks before signing. Have the signer validate each transaction against limits, allowlists and expected patterns, separately from the service that requests it, so a compromised requester cannot get arbitrary transactions signed.
- Add automatic velocity limits and circuit breakers. Cap value moved per wallet and per time window, and pause automatically on anomalies, because a 20-minute drain leaves no time for manual response. See our guide to Dual control and four-eyes approval for privileged and agent actions.
- Watch for state-backed tradecraft against engineers. TraderTraitor has repeatedly targeted developers and DevOps staff at crypto firms. Brief those teams and monitor their endpoints closely. See our TraderTraitor (Jade Sleet) threat actor profile.
- Prepare revocation for workload credentials. Know how to revoke a service's authorisations and rotate its credentials within minutes, as Binance did with the affected address. See our Leaked Credential Response Playbook.
Frequently asked questions
How much was stolen in the Binance hack of October 2026?
Binance estimates the total impact at about $6.3 billion. TRM Labs puts the outflow at about $6.36 billion across ten blockchains on 29 October 2026 and says about $2.7 billion was frozen by early 30 October, leaving the attacker with about $2.4 billion. Binance says it will cover all losses and that user funds are safe.
How did hackers get into Binance?
Binance's initial investigation suggests a DevOps engineer's compromised laptop let the attacker access a service container and submit unauthorised withdrawal transactions. Binance says it found no evidence of a wallet private key leak, and later found additional points of breach. It has not said how the laptop was compromised; a technical post-mortem is promised.
Was North Korea behind the Binance hack?
TRM Labs attributes the attack to TraderTraitor, a North Korean state-backed unit, with high confidence, and Chainalysis confirmed TRM's findings, according to BleepingComputer. Binance has not publicly named an attacker and says its investigation has not attributed responsibility to any individual. The attribution therefore rests on the blockchain analytics firms' assessments.
Related NHI Mgmt Group resources
Bybit hack 2025 · BitMart hot wallet hack 2021 · TraderTraitor (Jade Sleet) threat actor profile · Crypto Exchange Identity and Key Security Guide · Developer endpoints as NHI stores
How NHI Mgmt Group can help
Incidents like this one turn on machine identities that sit close to money: signing services, withdrawal workers and the engineer credentials that can reach them. We help organisations find those identities, cut the paths that lead to them and design approval and velocity controls that act faster than an attacker can. See our NHI and AI agent security training.
References
- TRM Labs: North Korea steals USD 6.36 billion from Binance in the largest hack in history (29 October 2026)
- Binance: Security Incident Update (30 October 2026)
- Khaleej Times (Reuters): Crypto exchange Binance freezes assets after $6.3 billion security breach (30 October 2026)
- Decrypt: Binance finds additional points of breach in $6.3B hack (30 October 2026)
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop (30 October 2026)