Summary
On 29 October 2026, attackers drained roughly $6.4 billion across multiple blockchains. Most of it left Binance’s hot wallets in about 20 minutes.
The early account from Binance points to a compromised developer’s laptop. The attacker appears to have used the exchange’s own transaction-signing systems rather than simply stealing private keys.
It is hard to picture $6.4 billion. Interestingly, it reminded me of the 640k of memory in the first personal computers all those years ago. The money stolen from Binance is 10,000 times that number.
I’m trying to make sense of the biggest crypto theft ever recorded: what happened, how it happened, whether the money can come back, what it says about the security of even the largest exchanges, separate the confirmed facts from speculation, understand why prevention and recovery are so difficult, and see how this compares with earlier major crypto exploits and thefts.
Elliptic and Chainalysis link the attack to North Korea-linked actors, although no government has formally confirmed the attribution. About $2.8–3 billion has been frozen, largely in stablecoins such as USDC and USDT. The attacker is converting and laundering the rest through decentralised exchanges, bridges, and mixers. Full recovery is far from certain.
The deeper issue isn’t that the blockchain was broken. It is that an organisation entrusted with customer assets may have allowed a single compromised laptop to become a multi-billion-dollar, multi-chain drain. Binance says it will cover customer losses through SAFU and company reserves, but the uncomfortable question remains: if this can happen to Binance, what does it say about the wider crypto industry’s operational security? [1] [2] [3]
What happened?
Funds began leaving Binance hot wallets across Ethereum, Bitcoin, Tron, Solana, XRP Ledger, Avalanche, and several layer-2 networks. Most transfers happened in about 20 minutes before Binance stopped withdrawals.
Elliptic estimates the loss at $6.43 billion. Chainalysis has also called it a $6.4 billion hack. The largest single loss was on Ethereum: about $3.80 billion across 186 tokens. The attacker also took about 18,270 BTC and 612.7 million USDT on Tron. [1] [2]
How?
The attacker did not need to break the cryptography. They needed Binance’s systems to sign for them.
Binance initially said a DevOps engineer’s laptop may have been compromised, allowing an attacker to access a service container and submit unauthorised withdrawals. It later said investigators found additional breach points and described the attack as complex. Binance has not yet published the full technical explanation.
This was not simply a stolen private key. Binance says there is no evidence that wallet private keys were leaked. Instead, the attacker appears to have manipulated Binance’s transaction-signing infrastructure to approve withdrawals.
On Ethereum, Elliptic says the attacker used EIP-7702 delegation. A single transaction, signed by a Binance hot wallet, delegated control of that wallet to an attacker-controlled “sweeper” contract. That contract could then drain the wallet repeatedly without asking for a new signature each time.
The attack was prepared. Attacker wallets received small amounts from Tornado Cash beforehand, and a sweeper contract was deployed and tested hours before the main theft. This resembles the 2025 Bybit hack, where attackers compromised the systems around a wallet rather than breaking the wallet’s cryptography. [1] [3] [4]
Could it have been prevented?
Probably, or at least the damage could have been much smaller.
A single compromised laptop should not be able to open a path to billions of dollars across many blockchains. Stronger separation between employee devices, internal systems, and wallet-signing authority could have contained the breach.
Basic controls matter here: hardware-backed authentication, least-privilege access, withdrawal limits, anomaly detection, delayed processing for unusually large transfers, and independent approval for high-value movements. Binance has not yet confirmed exactly which of these failed, so it would be unfair to call this proven negligence before its post-mortem.
But the scale is the problem. If one endpoint compromise can lead to a multi-chain drain of $6.4 billion, the control architecture was clearly broken. [3] [4]
What controls were lacking?
Based on public reporting, the likely gaps were:
- Endpoint security: A developer laptop may have been compromised, giving attackers a foothold.
- Access segmentation: The attacker appears to have reached a service container and triggered withdrawals, suggesting excessive access or weak separation between environments.
- Signing controls: Binance’s own systems authorised the transfers, so the attacker didn’t need stolen private keys.
- Real-time limits: The attacker drained wallets quickly across many chains, suggesting withdrawal limits, anomaly detection, or emergency controls did not stop the first wave.
- Full visibility: Binance has found additional breach points but has not explained them, so the complete control failure remains unknown. [1] [3] [4]
Can the stolen money be recovered? Why not?
Roughly $3 billion is frozen. The rest is moving. Recovery is possible. It is not guaranteed.
Some can be recovered. Much may not be. About $2.8–3 billion has been frozen because it was mainly in stablecoins and tokens with issuers that can blacklist addresses.
The rest is harder because the attacker is converting assets into ETH, BTC, XRP, and TRX, which have no central issuer that can freeze them. The attacker is also splitting funds, using decentralised exchanges, bridges, and mixers, and moving value across blockchains to obscure its origin.
Recovery is still possible if stolen funds reach a regulated exchange or another service that identifies them and freezes the account. Elliptic expects laundering to take months, and every swap or transfer creates an interception point. But there is no guarantee. [1] [2] [5]
Why do these things keep happening?
Crypto exchanges hold enormous value in internet-connected systems, making them prime targets. Hot wallets must process withdrawals quickly, which creates a constant trade-off between convenience and security.
The industry also depends on complex software, multiple blockchains, bridges, smart contracts, and staff with powerful technical access. One compromised laptop, phishing attack, malicious update, or misconfigured permission can expose a path to catastrophic losses.
North Korean-linked groups are repeatedly implicated because crypto theft appears to be a major source of state funding. Elliptic and Chainalysis link this attack to North Korea’s TraderTraitor group, although no government has yet issued a formal attribution. [1] [2]
What’s different now and how does it compare?
This is not a DeFi story. In my view, it is a colossal operational-security failure, the kind that keeps repeating in both crypto and traditional finance.
The scale is unprecedented. It also shows that attackers are targeting the operational layer: developer machines, signing services, permissions, and internal workflows. The blockchain may be secure, but the organisation operating it may not be.
This follows the same pattern as the KelpDAO exploit I covered earlier this year. In KelpDAO, a weak bridge design allowed one crafted message to release $292 million in receipts, and panic then wiped out about $13 billion in connected markets. The failure was not the blockchain itself; it was the verifier setup and missing economic and consensus safeguards. [6]
In the KelpDAO post-mortem, I identified the same recurring actor and playbook: Lazarus or TraderTraitor, careful preparation, cross-chain movement, mixers, partial freezing, and poor recovery prospects. I argued that attribution is not prosecution and that crypto theft has become a national-security issue rather than merely a DeFi problem. [7]
The Binance case takes that argument further. KelpDAO exposed weaknesses in decentralised infrastructure; Binance shows that even a centralised exchange with enormous resources can fail at the human and operational layer. In both cases, the attacker did not need to defeat cryptography. They needed to compromise the process around it.
Elliptic also pointed out that this theft is more than four times larger than Bybit’s $1.46 billion loss in 2025. And before Bybit, that record was held by Saddam Hussein, who took $1 billion from the Central Bank of Iraq in Baghdad on the eve of the 2003 Iraq War. The Binance theft is more than six times larger. [1] [2]
Comparison with similar crimes in traditional fiat money
In traditional finance, a thief must usually move stolen money through banks, payment networks, or cash-out points. Banks can freeze accounts, reverse some transactions, preserve audit trails, and work with regulators and police.
Crypto is different because blockchain transfers are irreversible. There is no bank that can simply undo a transaction, although issuers of certain tokens, especially stablecoins, can freeze addresses.
The closest fiat comparison is a large cyber-enabled theft or fraudulent wire-transfer scheme: criminals compromise systems or people, move money rapidly through intermediaries, and launder it before it can be stopped.
It reminded me of an incident in February 2016, where hackers attempted to transfer close to $1 billion from the Federal Reserve Bank of New York account belonging to the Bangladesh Central Bank. They successfully transferred about $81–101 million before their instructions were blocked because a misspelt instruction raised suspicions. [8]
The Binance case is far larger than most such incidents, and the assets are harder to reverse.
Could it be an inside job?
It could involve insider access or a compromised insider device, but that is not the same as proving an insider deliberately stole the money. Binance’s initial theory was that an engineer’s laptop was compromised, meaning an employee’s access may have been abused. Binance has not blamed any individual.
Binance’s CEO said the attacker did not simply use one engineer’s permissions and that the attack was more complex than a single “one-click” action. That leaves several possibilities: a sophisticated external attacker using an insider’s access, multiple compromised access points, or insider assistance. The public evidence does not yet settle the question. [3] [4]
Could Binance have staged it? A strange, funny question I was asked
A lot of people I know are asking whether this could be a staged event: could Binance have taken the money itself and blamed hackers?
There is no public evidence for that. Binance says it will cover all customer losses using SAFU and company funds, has reserved more than $6.34 billion, and has engaged law enforcement and blockchain-analytics firms.
A staged theft would also be very difficult to conceal. The funds are visible on public blockchains, independent firms are tracing them, token issuers have frozen billions, and outside journalists and investigators are reviewing the evidence.
Still, scepticism is healthy. The right response is not to accept the story blindly, but to wait for Binance’s promised technical post-mortem and independent confirmation of the breach path. [3] [5]
Conclusion
This was not a blockchain failure. It was an operational security failure at the world’s largest crypto exchange.
Binance may reimburse users, and billions have been frozen, but the deeper issue remains: an organisation entrusted with customer assets allowed a possible laptop compromise to become a multi-billion-dollar, multi-chain drain. Until exchanges treat signing authority with the same discipline that banks apply to payment systems, the next record-breaking theft is only a matter of time.
Sources
- Elliptic: The largest theft in history
- Chainalysis: The $6.4 Billion Binance Hack
- Binance: Security Incident Update
- Yahoo Finance: Binance Finds Additional Points of Breach
- CNBC: Binance’s $6.3 billion hack
- Grey Orbits: 2026’s biggest crypto exploit
- Grey Orbits: KelpDAO exploit post-mortem
- Bangladesh Bank robbery
About the Author
Viren Mantri is the founder of Grey Orbits in Singapore, Senior Instructor at Quantum Academy, and Executive Faculty at Singapore Management University Executive Development. Three decades across Standard Chartered, SC Ventures, UBS, McAfee, and KPMG inform his advisory work on AI, digital currencies, and quantum readiness. He authored the PETALS™ Framework for AI Governance, the Cybersecurity Model for Startups, and the Framework for Cyber Insurance.
© 2026 Viren Mantri, Grey Orbits. Licensed under a Creative Commons Attribution 4.0 International License.
Disclaimer: All views expressed here are entirely mine.