the money is safe as long as the keys never leave

what everyone assumed

Crypto custody has spent a decade on one idea: protect the private key. Hardware security modules, multi-party signing, cold storage, key ceremonies. The reasoning is sound as far as it goes. A transaction on a blockchain is only valid with a signature, the signature needs the key, and a key that never leaves its vault cannot be copied. Exchanges offer this as reassurance and customers repeat it, because it is true. If the keys are safe, the money is safe.

what happened

On 28 October 2026, according to TRM Labs’ on-chain analysis, a wallet controlled by the attacker received three small withdrawals from Tornado Cash, a mixing service. On the morning of 29 October the same operator tested attack code on two wallets of its own, then rehearsed the final version on a third. About four hours after the rehearsal, TRM found the code on a Binance hot wallet.

At 20:05 UTC on 29 October, TRM’s timeline shows five Binance wallets on the XRP Ledger sending 233.46 million XRP to a single address. Solana and Optimism followed. At 20:20 the Bitcoin hot wallet sent 18,270 BTC, and one Ethereum transaction carried 50 authorisations signed in advance. About three minutes later the Ethereum hot wallet sent its entire balance in one transaction. TRM counts about $6.36 billion leaving Binance across ten blockchains, most of it in roughly 20 minutes, with a second wave on Avalanche and Polygon at 23:05.

On 30 October Binance’s co-CEO Richard Teng gave the first account of the cause. The initial investigation pointed to a compromised laptop belonging to a DevOps engineer. The laptop gave the attacker access to a service container, and from that container the attacker submitted unauthorised withdrawal transactions. Binance said it had found no evidence that any wallet private key leaked.

Later the same day the account widened. Binance said the investigation had found additional points of breach, and Teng said the attacker had not simply used one engineer’s permissions and that the theft was not a single one-click action. Binance has not said how the laptop was compromised or what the other points of breach were.

TRM Labs attributes the theft to TraderTraitor, a North Korean state group, and says it makes that judgement with high confidence. Chainalysis calls TraderTraitor the likely culprit. Binance has not attributed the attack, and these are assessments by analytics firms. The same group was named by the FBI for the Bybit theft in February 2025, which started on another company’s developer laptop.

how it surfaced

The money moved on public ledgers, so the theft was visible as it happened. The blockchain security firm Blockaid flagged billions in outflows from Binance hot wallets, Binance confirmed a security incident, and withdrawals were suspended.

Stablecoin issuers can freeze their own tokens wherever they sit, and they did. TRM’s timeline has Tether freezing 971.1 million USDT at 21:01 UTC, 56 minutes after the first outflow, and Circle freezing 823 million USDC at 21:04. Binance said partners froze about $3 billion in total; TRM’s own count at 00:30 UTC on 30 October was about $2.7 billion. TRM also traced the attacker selling stolen USDT to market makers at a discount of more than 10% to turn it into ether before it could be frozen.

Binance put the loss at about $6.3 billion and, according to The Block, set aside $6.34 billion of its own funds and reserves to cover it. TechCrunch reported it as the largest known theft of cryptocurrency. The previous record, Bybit, was about $1.5 billion according to the FBI. Binance has promised a full post-mortem and an updated proof of reserves. As of 30 October 2026 neither has been published, so the laptop is the entry point Binance named on the first day, and the rest of the chain is still open.

Whatever is allowed to ask for a signature can spend the money.

The key can stay in its vault and still sign for the attacker, if the attacker controls something the vault is built to obey. Every service that can request a withdrawal, and every laptop that can reach that service, sits inside the same perimeter as the key.