The Binance Hack: The Largest Crypto Heist in History Started With a Laptop (2026)

On Thursday, October 29, 2026, Binance — the world's largest crypto exchange — suffered what is already being called the largest theft of digital assets in history. The company itself estimates the impact at around $6.3 billion. The detail that matters most for anyone in security isn't the size: it's how it started. Per Binance, no cryptography was broken and no keys were leaked — the entry point was an employee's laptop. This post explains what happened, how the attack worked, what's being recovered, who the suspect is, and the lesson — including for companies that have nothing to do with crypto.

What happened

In a matter of hours — and, per reports, with most of it leaving in minutes — an attacker drained Binance's hot wallets (the “hot,” internet-connected wallets used to process withdrawals) across 11 different blockchains. On-chain analytics firm Elliptic estimates the total at $6.43 billion; Binance, around $6.3B. The figures are still being revised as the investigation advances, but the order of magnitude is already unprecedented: for comparison, the Bybit theft in 2025 — until yesterday the largest in history — was $1.46B, more than four times smaller.

Per Elliptic's reconstruction, the damage spread across several assets: about $3.8B in Ethereum (across 186 different tokens), 18,270 bitcoin (around $1.48B), and hundreds of millions in stablecoins(USDT and USDC). It wasn't a specific target: it was a sweep of the exchange's operational reserves, at the highest volume possible, in the shortest time possible.

How the attack worked

Binance stated that its initial investigation “suggests the incident may involve a compromised DevOps engineer's laptop,” which “allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” And it was explicit on one crucial point: “We have found no evidence of any wallet private key leak.” A later statement referred to “additional points of breach” and a “complex attack,” without detailing them.

And that's exactly where the interesting part lives. If no key leaked, how did the money leave? Elliptic's on-chain analysis answers it: the attacker made Binance's own systems sign the malicious transactions. In one case, a single Ethereum transaction carried 50 validly signed authorizations using EIP-7702 — a recent Ethereum feature that lets a wallet temporarily delegate control to a contract. Except the contract control was delegated to was a “sweeper”: a contract built to sweep and empty the wallet. With internal access, the attacker didn't need the key — they needed the system that uses the key to sign what they wanted.

Why “no key leaked” isn't a relief

It's common to read “the keys are safe” and breathe easy. Here it's the opposite: the phrase describes exactly the problem. Protecting the key in a vault (HSM, cold wallet, multisig) solves the theft of the key — but it doesn't stop someone with access to the system that uses the key from telling that system to sign a transfer. The real control wasn't in holding the key; it was in who could request a signature. And that's a pattern we've seen before: in the Bybit theft, in 2025, the mechanics were the same — a developer's machine (at a vendor) was compromised and a legitimate transaction was manipulated before it was signed.

The response: what got frozen (and what can't be)

Binance temporarily suspended withdrawals and deposits while it runs security checks, freezes funds and works with authorities. With help from blockchain partners, about $3 billion was frozen on-chain (Elliptic verified $2.84B, ~44% of the total). Most of what could be frozen is stablecoins: Circle (USDC) froze over $800 million and Tether (USDT) over $1.5B. That's possible because stablecoins have a central issuer that can block addresses.

The problem is the rest. About $3.28 billion in non-freezable assets — Bitcoin, XRP, native Ethereum, among others — remain under the attacker's control, spread across dozens of addresses. Those assets have no “freeze button”: they're decentralized by nature, and no one can reverse them. As for customers, Binance says “user funds are completely safe,” and founder Changpeng Zhao (who no longer runs the company) said he expects, as a shareholder, that funds will be fully covered — his expectation, not a formal commitment the company has detailed.

Who did it?

Caution is warranted here. Elliptic assesses it as likely that the attack was carried out by actors linked to North Korea — the profile of those who turn crypto theft into state financing. The evidence: part of the funds reached the same address associated with an earlier exploit suspected of North Korean ties (the initial lead is from investigator ZachXBT), and the method resembles earlier thefts attributed to the country, such as Bybit's. But it's worth separating fact from suspicion: no government or authority has confirmed attribution, and Binance has not named anyone. There are even atypical signs (the slow conversion of stablecoins isn't these groups' usual pattern). In other words: the hypothesis is strong, but it remains a hypothesis.

What this teaches — even if you're not an exchange

It's tempting to read this as a “crypto problem” and move on. That would be a mistake. Take out the word “blockchain” and what's left is a story that could happen at any company that moves money or data through software:

1. A developer's endpoint is production attack surface. The laptop of someone with access to critical systems is worth as much as a production server. It needs EDR, encrypted disk, least privilege, and separation between the day-to-day machine and access to what's sensitive. Bybit fell this way; Binance, apparently, too.
2. Automation that moves value is a privileged account. A pipeline, a service container or a bot that can sign transactions (or approve payments, or export a database) deserves the same controls as an administrator: least privilege, more-than-one-person approval for high-impact operations, and limits a single compromise can't blow past.
3. Protect the operation, not just the secret. Keeping the key in a vault isn't enough if the system that uses it can be induced to sign whatever the attacker wants. Use destination allowlists, limits per time window, and independent verification of what's being signed — so that “the key is safe” actually means the money is.
4. Blast radius and segmentation. A single laptop shouldn't be able to reach a system capable of draining reserves across 11 blockchains. Segmenting access and isolating what's critical is what turns an incident into a scare rather than a headline.
5. Your response window is short. Billions left in minutes. Detection and containment need to be near real-time — and, as we saw, much of the recovery depended on third parties (stablecoin issuers) acting fast, not on reversing the irreversible.

The closing message is the usual one, just with an extra zero on the bill: big attacks rarely come from a magic technique. They come from a common entry point — an endpoint, a credential, an over-powered piece of automation — that no one treated as critical. Testing your surface the way a real adversary would, including the paths that run from a laptop to what moves value, is what reveals those shortcuts before someone uses them.

If you want to understand where your company has that kind of exposure, talk to a researcher. And, more broadly, a periodic pentest finds the paths between “a compromised access” and “money leaving” — before it becomes the largest theft in some history.

Sources: Binance statement (via AP/PBS), Elliptic, TechCrunch and TRM Labs. The figures are estimates and may be revised as the investigation advances; the attribution to North Korea is an assessment by analytics firms, not an official confirmation.