How did hackers steal $6.3 billion from Binance?

What happened on 29 October?

On the evening of 29 October 2026 (UTC), crypto assets worth about $6.3 billion left Binance's hot wallets, the wallets kept online so withdrawals can be paid out. Binance puts the loss at $6.34 billion, TRM Labs at $6.36 billion and Elliptic at $6.43 billion, depending on the prices used. It is the largest crypto theft on record. The previous record was Bybit, at about $1.5 billion in February 2025.

Binance has promised to cover the losses from its SAFU fund and its own money, and said on 3 November that 98 percent of the reserves had been restored. Withdrawals were paused and reopened in stages from 1 November.

Step by step: how the attackers got in

Most of what we know comes from Binance's initial findings, published on 3 November. The investigation is ongoing, so details may change.

June: a tampered developer tool

It started in June. An engineer working on the wallet infrastructure was looking for an AI coding tool and installed a tampered version of Homebrew, a common tool for installing software on a Mac. The laptop was replaced, but by then the attackers knew who the engineer was and who their colleagues were.

September: the job interview

In September, a different software engineer was approached on a job site by a fake project director. In the first round, a video call, a fake HR person shared a social media account full of personal photos and videos to seem genuine. In the second round, someone claiming to be the CEO of a company that didn't exist got in touch. The engineer was given a take-home test to download, and it ended up on the work laptop.

When the test was set up, the file for a tool called pyenv was swapped for a copy only 70 bytes larger than the original: 3,414 bytes instead of 3,344. The copy connected to a server the attackers controlled. The malware had not been seen before, and the laptop's security software didn't detect it.

20 October: an internal AI tool

From that laptop, the attackers used an internal AI tool to take control of two more computers: the first engineer's new laptop and the computer of a third engineer who worked on the wallet software. The first held a token with permission to deploy containers. Binance hasn't said how the AI tool was used.

29 October: the signing service

Between 17:15 and 19:56 UTC, the attackers logged in to the third engineer's computer with the first engineer's stolen credentials, deployed a container and ran a script. That gave them access to an internal service that signs wallet transactions, so they could create transactions outside the normal withdrawal flow and its controls.

Between 20:05 and 20:09 UTC, 233.46 million XRP, worth about $296 million, left five hot wallets. Bitcoin, ether, stablecoins such as USDT and USDC, and assets on several other chains followed. The last unauthorised transfers went out just before midnight.

Why wasn't pausing withdrawals enough?

Since the Pectra upgrade in May 2025, Ethereum has a feature called EIP-7702. It lets an ordinary wallet hand some of its powers to a smart contract, but only if the wallet itself signs it. The attackers used Binance's own signing service to produce those signatures and gave their own contract partial rights to act for one of Binance's hot wallets.

That permission lived on the blockchain, independent of Binance's own systems, so pausing withdrawals didn't remove it. Removing it takes a new transaction signed by the wallet itself. Binance's wallets use MPC, where the key is split into parts that are never put together. There was no single key to use straight away, and a special procedure was needed. The delegation was active from about 20:20 UTC and was cleared at 00:10 on 30 October, almost four hours later.

Several security researchers point out that EIP-7702 isn't the flaw itself. The delegation needed valid signatures, and the attackers got them from Binance's own service. The feature did, however, make it easier to drain the wallet in one sweep, and harder to stop.

Who is behind it, and where is the money?

On 31 October the FBI named North Korea and the group known as TraderTraitor. The blockchain analytics firms TRM Labs and Chainalysis had already reached the same conclusion. North Korea denies any involvement, and Binance itself hasn't named anyone.

Tether and Circle froze about $1.8 billion in stablecoins within roughly an hour. According to Binance, about $2.85 billion had been frozen or stopped by 3 November. The rest is still moving between addresses and services, and the FBI expects more attempts to launder it.

What can an ordinary company learn?

Binance is a crypto exchange, but the way in was an ordinary work laptop. The same methods work against any company where a few people hold the keys to something important: customer data, payments, the production environment or the website.

• Never run take-home tests, demo projects or files from recruiters or strangers on a computer that can reach work systems. Use a separate machine or a virtual machine.
• Install developer tools only from sources you have checked, and make sure you notice when files in those tools change.
• Give tokens and permissions the shortest life and the narrowest reach you can. A token that can deploy something shouldn't sit on an everyday laptop.
• Make anything that can move money or data need approval from more than one person, and log everything.
• Treat internal AI tools with access to systems like any other account: limit what they can do and review how they are used.
• Make sure the emergency stop stops everything. Permissions outside your own systems, such as a delegation on a blockchain or an OAuth connection, must be quick to revoke.

Binance has replaced the affected devices, revoked credentials and tokens, rebuilt the wallet system and the AI tool, and checked every employee's device. A full report hasn't been published yet.