Binance theft: the trail of an engineer's laptop

On October 29, 2026, at 20:05 UTC, an attacker moved about 6.3 billion dollars in cryptocurrency out of Binance, most of it in about 20 minutes and across ten blockchains. According to the firm TRM, it is the largest crypto theft on record, about four times the one Bybit suffered in February 2025.

What is known: the laptop trail

According to Binance, the attack may have started on the compromised laptop of one of its DevOps engineers, the team that runs its infrastructure: from that access, the attackers would have reached a service container and submitted unauthorized withdrawals. The company describes it as a complex hack, says its investigation uncovered additional points of breach and that so far it has found no leak of its wallets' private keys. The firm TRM is following another trail: a compromise of the infrastructure that signs transactions for the hot wallets, the ones connected to the internet.

TRM and Chainalysis attribute the attack to TraderTraitor, a North Korean state hacking group. Binance suspended withdrawals while deposits kept working; it said its users' funds are safe and that it will cover the losses with its SAFU insurance fund and its own resources. According to TRM, stablecoin issuers such as Tether, Circle and Ripple froze about 2.7 billion dollars; Binance puts the total frozen at about 3 billion. The investigation is still open, so these figures may change.

The lesson for any business

You do not need to handle cryptocurrency to learn from this theft. The laptops of the people who administer servers, cloud or financial systems are the keys to the whole company: if an attacker controls them, the attacker inherits that access.

1. Use admin accounts that are separate from everyday ones, such as email and browsing.
2. Turn on phishing-resistant two-factor authentication, such as physical security keys, for critical consoles.
3. Grant access only when needed and for a limited time, instead of permanent permissions.
4. Require approval from two people for sensitive operations, such as large payments or withdrawals.
5. Install advanced protection (EDR) on computers and watch for unusual access.

October 31 update: Binance replenished 90%

On October 31, Binance reported that it had already replenished 90% of the stolen assets using its SAFU fund, its futures insurance fund and its treasury, published a proof-of-reserves snapshot and expects to reopen withdrawals on November 1. We also checked this article against Binance's notices and the TRM and Chainalysis reports: we corrected that only withdrawals were suspended and clarified that the engineer's laptop is Binance's main hypothesis, not a confirmed fact.

How we help you

In our IT consulting we review who has access to what in your company and design controls for admin accounts, and with our IT support we keep your staff's computers protected. Book a review.

Sources

• Binance: security incident update (October 30, 2026)
• Binance: security incident update #2 (October 30, 2026)
• Binance: recovery update #3, 90% replenished (October 31, 2026)
• TRM Labs: North Korea and the Binance theft (October 30, 2026)
• Chainalysis: tracing the North Korea link (October 30, 2026)