North Korea Is Blamed for Binance's $6.3 Billion Hack. A Compromised Laptop May Have Opened the Door.

Hackers stole about $6.3 billion in cryptocurrency from Binance on October 29, 2026. Investigators call it the largest crypto theft ever recorded. Binance puts the impact at roughly $6.3 billion, and blockchain intelligence firm TRM Labs counts $6.36 billion. TRM, Chainalysis and Elliptic have linked the attack to North Korean hackers. Binance says a compromised employee laptop may have given the attackers their first way in, and it has promised to cover all customer losses.

According to TRM Labs, most of the assets left Binance wallets within about 20 minutes, across ten blockchains. Binance paused withdrawals, and token issuers rushed to freeze the stolen funds.

The size of the theft is extraordinary. For businesses, though, the bigger question may be how attackers took control of systems built to approve transactions worth billions of dollars.

What Happened to Binance on October 29?

The attack began at about 20:05 UTC on Thursday, October 29, when five Binance wallets on the XRP Ledger sent funds to an attacker address, according to TRM Labs. Transfers on Solana, Optimism and other networks followed within minutes.

At 20:20 UTC, a Binance Bitcoin hot wallet sent 18,270 BTC to an address the attacker controlled. Large amounts of stablecoins and other assets then moved out of Binance wallets on Ethereum and Tron.

A second wave hit at about 23:05 UTC and drained wallets on Avalanche and Polygon.

Binance first acknowledged a potential security issue. It then confirmed unauthorized withdrawals and paused withdrawals. In its October 30 statement, it estimated the impact at about $6.3 billion and said it was working with law enforcement and blockchain intelligence partners to trace the assets.

The incident shows how fast a coordinated attack can move through financial infrastructure once the systems that approve transactions are compromised.

How Much Cryptocurrency Was Stolen From Binance?

TRM Labs calculated about $6.36 billion, using market prices at the time of each transfer.

Elliptic, in an analysis updated October 30 at 08:00 UTC, put the figure at $6.43 billion across 11 blockchains, compared with TRM's ten. Chainalysis has cited about $5.9 billion and Arkham about $6.01 billion. The estimates differ because the firms count and price assets in different ways.

They all agree on the main point: this theft is far larger than any before it.

Breakdown of the stolen assets

Blockchain	Estimated stolen value
Ethereum	$3.79 billion
Bitcoin	$1.47 billion
Tron	$628 million
XRP Ledger	$296 million
Solana	$96 million
Arbitrum, Optimism and Base	$39 million
Avalanche	$28 million
Polygon	$10 million
Total	Approximately $6.36 billion

Source: TRM Labs, October 29, 2026. Figures are rounded and valued at the time of theft.

Ethereum accounted for the largest share. TRM says about $3.79 billion was taken there, in Ether, USDT, USDC and other tokens.

The previous record was the February 2025 hack of the exchange Bybit, where about $1.5 billion was stolen. The FBI attributed that theft to North Korea on February 26, 2025.

The Binance theft is more than four times larger. Elliptic goes further and calls it "almost certainly the largest theft of any kind in history."

Did a Compromised Laptop Cause the Binance Hack?

Binance's preliminary findings point to a compromised laptop belonging to a DevOps engineer.

DevOps engineers run the systems that connect software development to live operations. Depending on their role, they may have access to cloud environments, deployment pipelines and automated processes.

Binance said the device may have let the attacker reach a service container and submit unauthorized withdrawals. It found no evidence that wallet private keys had been leaked.

That distinction matters. A private key is the cryptographic credential that approves blockchain transactions. But an attacker doesn't need to steal a key if they can get a legitimate system to sign transactions for them.

The laptop is unlikely to be the whole story. Co-CEO Richard Teng said the attack involved "a more complex attack process" and was not a single "one-click" action. Binance later said its investigation had found "additional points of breach," Reuters reported. The company has promised a detailed technical post-mortem.

The lesson for business owners is simple. A well-protected account or database can still be exposed if the people and devices allowed to access it are compromised.

How the Hackers Used Ethereum's EIP-7702 Feature

On Ethereum, the attacker used a feature called EIP-7702, introduced in the Pectra upgrade in May 2025. It lets an ordinary wallet hand its behavior over to smart contract code. It is a legitimate feature, designed to make accounts more programmable.

According to TRM Labs, the attacker submitted 50 pre-signed authorizations that handed control of a Binance Ethereum hot wallet to a malicious "sweeper" contract. A hot wallet is one connected to live systems. Exchanges use them to process withdrawals.

About three minutes later, the wallet was swept: 167,464 ETH and 63 other tokens, including about 1.615 billion USDT. The delegation stayed active, so funds that arrived in the wallet afterward were swept too.

The Ethereum feature itself was not broken. The attacker misused a legitimate approval mechanism after apparently getting into systems that could produce valid signatures. TRM's assessment is that Binance's hot wallet signing infrastructure was likely compromised. On the other blockchains, funds were drained through ordinary signed transactions.

This matters for any company using APIs, automated payments, AI agents or cloud tools. Security isn't only about what software can do. It is also about who can approve an action, how that approval is checked, and what limits apply when a trusted system is compromised.

Why Investigators Believe North Korea Was Behind the Binance Hack

TRM Labs attributes the theft with high confidence to TraderTraitor, a North Korean state-linked hacking group, and Chainalysis has pointed to the same group. TRM sees the same methods as in the Bybit hack and the April 2026 KelpDAO hack: small Tornado Cash withdrawals, preparation well before the theft, and pre-obtained signatures used in one burst.

Elliptic found that some Binance funds reached an address that also received money from the September 2026 Bitget exploit, which it considers highly likely to be North Korea-linked. Elliptic also noted the overlap was small, about $39,000, and that professional money launderers serve several clients.

As of October 30, no government or law enforcement agency had publicly confirmed who was behind the attack, and Binance had not named anyone.

North Korean hackers do have a documented history of targeting crypto businesses. In December 2024, the FBI and Japanese authorities described how TraderTraitor used a fake LinkedIn recruiter to compromise an employee at the crypto wallet provider Ginco. The employee was given a malicious Python script disguised as a coding test. Investigators linked that compromise to the theft of about $308 million from DMM Bitcoin.

The pattern is the same each time: go after people and trusted business relationships to get into financial systems.

Almost $3 Billion Has Been Frozen. What Happens to the Rest?

Other crypto companies responded fast. Tether, Circle, Ripple, World Liberty Financial, Paxos and First Digital froze stablecoins linked to the theft, and the Arbitrum Security Council moved assets out of the attacker's reach. According to Elliptic, Tether froze the attacker's main Ethereum wallet 37 minutes after the USDT arrived.

Elliptic had verified $2.84 billion frozen on-chain as of about 07:00 UTC on October 30, roughly 44% of the theft. Binance reported about $3 billion. Both are snapshots, not final recovery totals.

Freezing is not the same as recovering. A frozen token can still sit at the attacker's address. It just can't be moved, and Binance doesn't have it back.

Before the freezes, the attacker converted about $786 million of stablecoins into ETH and TRX, according to Elliptic. Bitcoin and Ether can't be frozen by an issuer. Elliptic estimated the attacker still controlled about $3.33 billion in assets that can only be stopped when they reach an exchange or other service.

How much will eventually be recovered is still unknown.

Will Binance Customers Lose Money?

Binance says it will cover all losses from its Secure Asset Fund for Users (SAFU) and its own funds. The exchange says it has set aside more than $6.34 billion. About $5 billion of that is already held in the same tokens that were stolen, and the rest is being bought through market and over-the-counter trades. It plans to publish an updated Proof of Reserves once that is done.

Deposits are working normally. Withdrawals are paused while Binance rebuilds its withdrawal service, and the exchange later said it was on track to restart them in about 45 hours.

Those commitments matter, but they don't settle the question of trust on their own. Customers need to believe an exchange can both repay losses and prevent a repeat. The real test will be independently verifiable reserves, a credible explanation of the breach, and proof that the weaknesses have been fixed.

Why the Binance Hack Matters for UAE and Gulf Businesses

The incident hits close to home in the UAE. Reuters reported that Abu Dhabi's Financial Services Regulatory Authority, which issued Binance's main operating license, said it was in close contact with the exchange and monitoring the situation. Binance says it already sends the FSRA weekly reports on company funds.

For businesses in Dubai, Abu Dhabi and the wider Gulf, the concern goes beyond crypto prices. Many companies now run on connected digital systems.

An e-commerce site may link its storefront to a payment processor, an inventory platform, a CRM and cloud hosting. A real estate firm may connect its website to listing feeds, lead tools and messaging automation. Every connection adds features, and every connection is another way in.

A typical business website doesn't face the same threat as Binance. But the principle is the same: access to a trusted system can be worth more to an attacker than a flaw in the software.

What Website Owners and Digital Businesses Should Learn

Security conversations often focus on software flaws. Is the website updated? Does the server have a firewall? Is customer data encrypted?

Those questions still matter, but they are not enough. A fully patched website can still be taken over with stolen admin credentials. A secure payment platform can still carry out a fraudulent instruction sent through a compromised integration. An AI automation can do real damage if it has too many permissions.

The FBI's TraderTraitor cases show that attackers reach employees through ordinary work contact, such as recruitment messages and coding tasks. Businesses should treat these as possible ways into their systems, especially when staff have access to live systems or finances.

Agencies and development partners carry responsibility too. A website's security doesn't end at launch. Hosting permissions, API keys, deployment pipelines, CMS accounts and plugins need regular review, and access to one client's project should never open the door to another's.

Ten Security Measures Businesses Should Prioritize

The US National Institute of Standards and Technology's Cybersecurity Framework 2.0 groups security into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Its point is that prevention alone isn't enough.

For websites, e-commerce platforms and connected businesses, these are practical priorities:

• Use phishing-resistant sign-in: Passkeys or hardware security keys for critical admin accounts.
• Limit admin privileges: Staff, agencies and contractors get only the access their work requires.
• Separate environments: Development, testing and live systems should not share credentials.
• Protect API keys: Store them securely, limit what they can do, rotate them and monitor their use.
• Add approval controls: High-value payments and sensitive changes should need a second check.
• Watch for unusual activity: Unexpected logins, permission changes, large data exports and unusual automated transactions.
• Keep platforms updated: Remove unused plugins and integrations.
• Audit outside access: Review who can get into your systems, especially after a contract ends.
• Test recovery: Keep secure backups and confirm that restores actually work.
• Plan communications: Decide in advance how customers, staff and authorities will be told.

None of these will stop every threat. They do make it less likely that one compromised device turns into a much bigger failure.

The Bigger Story Is Not Just the Money. It Is Digital Trust.

Key questions are still open. How did the attacker first get into Binance's systems? Which approval systems failed? How much will be recovered? What will change?

Binance has promised a technical post-mortem, and investigators are still tracing the funds.

For business leaders, the lesson is wider than crypto. Modern businesses run on sophisticated systems, but those systems still depend on people, permissions and devices.

The answer is not to stop using digital tools or automation. It is to build security in from the start, review access regularly and plan for the day a trusted component is compromised.

The largest crypto theft in history involved billions of dollars and complex blockchain operations. Its suspected starting point was ordinary: a company laptop.

That contrast is the warning for every business building its future online.

Sources:

• TRM Labs: North Korea Steals USD 6.36 Billion From Binance
• Elliptic: The largest theft in history
• Cointelegraph via TradingView: Binance says $6.34B set aside
• CyberInsider: Binance links incident to compromised laptop
• The Globe and Mail (Reuters): Hackers steal $6.3 billion from Binance
• Yahoo Finance (Reuters)
• CNBC: Binance's $6.3 billion hack
• NBC News
• Crypto Times: Withdrawals to restart in 45 hours
• TechNadu: TraderTraitor blamed
• Bitbase: TRM and Chainalysis link hack to TraderTraitor