Hackers stole approximately $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what is believed to be the biggest crypto theft in history.
The majority of the stolen assets were transferred within approximately 20 minutes on October 29. Binance initially suspected a compromised employee laptop but subsequently identified additional points of breach.
Blockchain intelligence firm TRM Labs reported that attackers compromised Binance’s transaction-signing infrastructure, allowing them to authorize unauthorized transfers from the exchange’s wallets.
TRM Labs and Chainalysis linked the attack to North Korean hackers, citing similarities to previous cryptocurrency thefts, including the $1.5 billion Bybit breach in 2025. Binance has not independently confirmed who was responsible.
Stablecoin issuers including Tether, Circle, Ripple and World Liberty Financial moved to freeze approximately half of the stolen assets, with Tether freezing nearly $1.57 billion and Circle more than $800 million. However, researchers estimate approximately $2.4 billion in bitcoin and ether remains beyond the reach of issuer-level freezes. Binance temporarily suspended withdrawals and pledged to cover customer losses using its $1 billion protection fund and company resources.
John Strand, Owner, Black Hills Information Security
“Initially, it appeared that this attack started with a compromised DevOps engineer’s laptop. But as Binance shares more information, it’s becoming clear that wasn’t the entire story. Once again, we’re going to have to wait to find out what actually happened.
“The initial explanation concerns me. It’s very common for large organizations to find one person they can blame, and anybody working in security should watch for that. If compromising one employee’s laptop can bring down your entire security structure, you have problems that go well beyond that employee.
“The movement of Ethereum, the access required, and what Binance is describing as multiple points of entry also raise questions about how the attackers operated. Looking at the speed of execution, I suspect AI may have been involved alongside some very talented human beings. That hasn’t been established, and speed alone doesn’t prove AI involvement. But it certainly raises questions about the automation used to carry out the attack.
“And here we are again. Another massive breach where the rest of us have to wait for the details so we can understand what failed and build better defenses.”
ㅤExpect this to be the first of many. And you may not hear that organizations get hacked. That’s not good for us.
Hackers steal $6.3 billion from Binance in 20 minutes
Posted in Commentary with tags Binance on October 31, 2026 by itnerdHackers stole approximately $6.3 billion in cryptocurrency from Binance, the world’s largest cryptocurrency exchange, in what is believed to be the biggest crypto theft in history.
The majority of the stolen assets were transferred within approximately 20 minutes on October 29. Binance initially suspected a compromised employee laptop but subsequently identified additional points of breach.
Blockchain intelligence firm TRM Labs reported that attackers compromised Binance’s transaction-signing infrastructure, allowing them to authorize unauthorized transfers from the exchange’s wallets.
TRM Labs and Chainalysis linked the attack to North Korean hackers, citing similarities to previous cryptocurrency thefts, including the $1.5 billion Bybit breach in 2025. Binance has not independently confirmed who was responsible.
Stablecoin issuers including Tether, Circle, Ripple and World Liberty Financial moved to freeze approximately half of the stolen assets, with Tether freezing nearly $1.57 billion and Circle more than $800 million. However, researchers estimate approximately $2.4 billion in bitcoin and ether remains beyond the reach of issuer-level freezes. Binance temporarily suspended withdrawals and pledged to cover customer losses using its $1 billion protection fund and company resources.
John Strand, Owner, Black Hills Information Security
“Initially, it appeared that this attack started with a compromised DevOps engineer’s laptop. But as Binance shares more information, it’s becoming clear that wasn’t the entire story. Once again, we’re going to have to wait to find out what actually happened.
“The initial explanation concerns me. It’s very common for large organizations to find one person they can blame, and anybody working in security should watch for that. If compromising one employee’s laptop can bring down your entire security structure, you have problems that go well beyond that employee.
“The movement of Ethereum, the access required, and what Binance is describing as multiple points of entry also raise questions about how the attackers operated. Looking at the speed of execution, I suspect AI may have been involved alongside some very talented human beings. That hasn’t been established, and speed alone doesn’t prove AI involvement. But it certainly raises questions about the automation used to carry out the attack.
“And here we are again. Another massive breach where the rest of us have to wait for the details so we can understand what failed and build better defenses.”
ㅤExpect this to be the first of many. And you may not hear that organizations get hacked. That’s not good for us.
Leave a comment »