Binance Says Hack Hit an Estimated $6.3B, and the Laptop Wasn’t the Only Way In

Binance, the world’s biggest crypto exchange by trading volume, says Thursday’s security incident had an “estimated total impact” of about $6.3 billion. In an update posted at about 7:23 p.m. Pacific, the exchange said its initial investigation points to a compromised DevOps engineer’s laptop, that about $3 billion has been frozen on-chain, and that it will cover all losses. If Binance’s estimate holds, the theft is more than four times the roughly $1.5 billion the FBI says North Korean hackers took from Bybit in 2025, the previous record.

Every dollar figure in this story is an estimate. Binance’s $6.3 billion is its own preliminary number, published without a breakdown. Analysts who traced the transfers have reported figures from about $5.9 billion to $6.4 billion, and they measure slightly different things, so we list them separately below instead of picking one. The more revealing part is how it happened: the attacker drained Binance wallets on ten blockchains, most of it in about 20 minutes, according to TRM Labs.

What happened, in Pacific time

This sequence comes from TRM Labs’ on-chain report, which gives times in UTC (we converted them to Pacific), plus Binance’s own posts as reported by news outlets.

• Oct. 28 to early Oct. 29: The attacker’s operator wallet receives small withdrawals from Tornado Cash, a mixing service that hides where crypto came from, then tests and rehearses its attack code on other wallets. TRM says preparation began at least 36 hours before the theft.
• Oct. 29, 1:05 to 1:09 p.m.: Five Binance wallets on the XRP Ledger send 233.46 million XRP to one attacker address. Binance wallets on Solana and Optimism follow just after 1:10 p.m.
• 1:20 p.m.: A Binance Bitcoin hot wallet sends 18,270 BTC to the attacker. On Ethereum, the attacker submits one transaction carrying 50 pre-signed EIP-7702 authorizations that hand control of a Binance hot wallet to the attacker’s own contract. Within two minutes, a Binance hot wallet on Tron sends 612.7 million USDT and 46.4 million TRX.
• About 1:24 p.m.: The hijacked Ethereum hot wallet sends its entire balance, 167,464 ETH and 63 tokens including 1.615 billion USDT, to an attacker address in a single transaction.
• 2:01 and 2:04 p.m.: Tether freezes 971.1 million USDT in the main receiving wallet, and Circle freezes 823 million USDC there “in coordination with law enforcement,” per TRM.
• 2:15 p.m.: Binance founder Changpeng Zhao posts that “it does look like a hack on Binance,” per the Associated Press and an independent on-chain timeline.
• 2:29 p.m.: Binance says it is investigating a “potential security issue.”
• About 3:15 p.m.: Binance halts withdrawals, according to a FinanceFeeds timeline.
• 4:05 p.m.: A second wave reaches Binance wallets on Avalanche and Polygon, TRM says. The attacker also keeps sweeping the hijacked Ethereum wallet as new deposits land, through about 4:56 p.m.
• 4:35 p.m.: Binance says the “verified total frozen” has reached $2.54 billion, per TRM and CNBC.
• Shortly after 5 p.m.: Binance says all deposits and withdrawals are “temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement,” AFP reported via NDTV.
• 7:23 p.m.: Binance’s Security Incident Update gives the $6.3 billion estimate and the laptop explanation.
• 9:17 p.m.: Co-CEO Yi He says Binance expects “to begin resume withdrawal services in the next 48 hours” and that deposits “remain unaffected and continue to operate as normal,” per FinanceFeeds. Binance’s main account repeated the 48-hour timeline about 20 minutes later.

What Binance says, and what it hasn’t said

Binance’s message shifted as the day went on. Its first statements said “Rest assured that user funds are completely safe,” per TechCrunch, and a spokesperson, Ross O’Leary, said the exchange had “temporarily suspended withdrawals on multiple networks following a security incident as a precautionary measure.”

By the evening it was giving specifics. “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” the update says. “We have found no evidence of any wallet private key leak.” It says it has revoked “the affected address authorisation,” brought in law enforcement and blockchain intelligence partners, and will publish a detailed technical post-mortem and an updated Proof of Reserves, its periodic check that customer balances are backed by assets. “Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.”

One contradiction is still open. The 7:23 p.m. update lists suspended deposits among Binance’s precautions; two hours later Yi He said deposits were operating normally. Binance hasn’t said whether deposits were restored in between or the earlier suspension was narrower than stated, FinanceFeeds notes. Zhao, who stepped down as CEO in 2023 but remains the largest shareholder, wrote earlier that “as a shareholder, I expect all user funds will be fully covered,” per NBC News.

What Binance hasn’t said: how its $6.3 billion breaks down, how much of it it expects to recover, how one engineer’s laptop led to valid transactions on ten blockchains, or who it thinks did it.

Why the loss figures don’t match

There is no audited loss figure yet. The public numbers come from different people measuring different things:

• About $6.3 billion (company estimate): Binance’s “estimated total impact,” from its 7:23 p.m. update. No breakdown by asset or chain.
• About $6.36 billion (TRM Labs estimate): every transfer from Binance-attributed wallets to attacker addresses across ten blockchains, valued at the price when each was taken. At prices when TRM published, the same assets were worth about $6.23 billion. TRM puts about $3.79 billion of it on Ethereum, $1.47 billion in bitcoin, $628 million on Tron and $296 million in XRP.
• About $5.91 billion (Chainalysis estimate): Chainalysis’ “current estimate on amount stolen” at the time of theft, quoted by AFP via NDTV.
• About $6.4 billion (Chainalysis CEO estimate): Chainalysis CEO Jonathan Levin later put the theft at $6.4 billion in a post on X, per Cointelegraph, slightly above Binance’s figure.
• Earlier, lower figures (reported): in the first hours, on-chain tallies cited by Decrypt and CoinDesk ran from about $5.5 billion to $5.7 billion, and TechCrunch quoted crypto watchers saying at least $2 billion. Those were snapshots of a theft still in progress.

Frozen is not the same as recovered. Binance says about $3 billion is frozen on-chain. TRM counted about $2.7 billion frozen as of 5:30 p.m. Pacific, and Binance had put the “verified” frozen total at $2.54 billion an hour earlier. Frozen tokens still have to be returned before they offset anything. On the other side of the ledger, TRM estimates the attacker still controls more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer’s reach, while Fundstrat’s Sean Farrell estimated about $3.3 billion remained unfrozen, CNBC reported. Those estimates were made at different times and prices, so we aren’t netting one against another.

Prices keep moving the dollar values, too. Bitcoin fell more than 4%, to below $78,000, as the hack weighed on crypto markets, and Circle shares fell about 5% in after-hours trading on Thursday, CNBC reported.

The frozen money: stablecoins have an off switch

The fastest response didn’t come from Binance. It came from the companies that issue stablecoins, tokens pegged to the U.S. dollar. Unlike ether or bitcoin, a stablecoin has a company behind it that can blacklist an address so its tokens can’t move.

By TRM’s count, Tether froze about 1.77 billion USDT across several attacker wallets, Circle about 825 million USDC, Ripple 40.5 million RLUSD, and World Liberty Financial 27.8 million USD1. Arbitrum’s Security Council, a group that can take emergency action on that network, forced 8,426 ETH and 74.6 million ARB, about $30 million, out of an attacker wallet. Tether CEO Paolo Ardoino and Circle CEO Jeremy Allaire both announced their freezes publicly, per NBC News and CNBC.

The attacker raced the freezes. TRM says it sold about 325 million USDT to market makers through UniswapX and similar contracts for about 122,300 ETH, accepting a discount of more than 10%, and borrowed about 19,760 ETH on the lending protocol Aave against 60 million USDT. For crypto’s “nobody can stop your money” crowd, the irony is thick: the most effective security tools on Thursday were a handful of companies and one emergency council pressing freeze buttons.

How the attacker got in: a laptop, a signing system and EIP-7702

The Ethereum part of the theft used EIP-7702, an upgrade that went live with Ethereum’s Pectra release in May 2025. It lets an ordinary wallet sign an authorization that points it at a smart contract; from then on, the contract’s code runs on the wallet’s own funds. The feature exists for good reasons, such as batching actions or letting someone else pay fees. The specification is blunt about the risk: “The code specified by an authorization has unrestricted access to the account.”

Every wallet keeps a running count of its transactions, called a nonce, and an authorization only works at the count the wallet has reached when it executes. A busy exchange hot wallet’s count moves constantly. So, TRM says, the attacker brought 50 authorizations signed in advance for 50 consecutive counts, guaranteeing one would match. One did. Three minutes and 24 seconds later, the wallet sent its whole balance to the attacker.

Here is the part that matters most. Those authorizations, and the ordinary transfers out of Binance wallets on nine other chains in the same half hour, all carried valid signatures from Binance wallets that use different chains, key types and signing schemes. In TRM’s assessment, the most likely explanation is that the attacker could make Binance’s hot-wallet signing system sign transactions of its choosing. That fits Binance’s own account: no private key leak, but a compromised laptop that reached a service able to “submit unauthorized withdrawal transactions.” Binance says it has since revoked the affected address authorization.

Who did it: a confident attribution, not an official one

TRM attributes the attack to TraderTraitor, a North Korean state hacking unit. “We make this judgment with high confidence,” it wrote, citing on-chain and off-chain intelligence and patterns it says match earlier heists: small Tornado Cash withdrawals funding an operator wallet, staging well ahead of time, and signatures gathered in advance and fired in one burst. The FBI named TraderTraitor as the group behind the Bybit theft. Blockchain investigator ZachXBT also said the attacker was “likely Lazarus,” the broader North Korean hacking group, per CoinDesk. Chainalysis CEO Jonathan Levin also linked the hack to TraderTraitor, citing ties to a previous hack, per Cointelegraph.

No government has publicly confirmed the attribution, and the Justice Department and FBI did not immediately respond to AFP’s requests for comment, per NDTV. Binance told the BBC it is working with law enforcement “to confirm the identity of these criminals.”

How this compares with Bybit

In February 2025, the FBI said TraderTraitor stole about $1.5 billion in virtual assets from Bybit, the previous record. TRM’s $6.36 billion estimate is about four times that. Binance has been hacked before at a far smaller scale: it lost 7,000 bitcoin, about $40 million at the time, in 2019, Decrypt notes.

Whether Binance can absorb this is the question its customers care about. Fundstrat’s Farrell told CNBC the breach “does not currently appear to create meaningful solvency risk for Binance.” He estimated the SAFU emergency fund at about $1.2 billion, enough to cover roughly a third of the remaining losses if frozen stablecoins are returned, with the rest coming from company funds. That is an outside analyst’s estimate; Binance hasn’t said how it will split the bill.

Who this affects

Binance customers come first, and crypto on an exchange is not like money in a bank. Exchange balances are not insured by the government, so any refund is up to the exchange, NBC News notes. Binance says user funds are safe and that it will cover all losses; until it publishes the promised Proof of Reserves, that is a company claim customers can’t independently check. If Binance meets its 48-hour target, withdrawals would start returning by about 9 p.m. Pacific on Saturday, Oct. 31. Binance.US, the separate U.S. platform, says it is not affected, per the BBC.

Then there is everyone who will be targeted by scammers this week. Fake “recovery” and “unlock your funds” messages reliably follow big hacks, and Binance says it will post updates only through its official channels.

This also lands on the same day as a separate Polymarket incident in which researchers say about $2 million was stolen through a compromised third-party tool, per TechCrunch, and the same day we covered attackers knocking the FEC’s filing system offline. There is no public evidence linking any of these.

Our read

Binance’s evening update was more specific than most exchanges manage in the first hours: a cause, a number, a remediation step and a promise to pay. But the cause is labeled “initial,” and it raises a harder question than it answers. How does one engineer’s laptop reach a service that can get valid signatures for hot wallets on ten blockchains within half an hour? The answer decides whether this was one bad machine or a design that put too much signing power behind one door.

The other lesson is about where crypto’s safety net actually sits. On Thursday it wasn’t decentralization. It was Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s emergency council, which together froze roughly $2.7 billion by TRM’s count. Almost everything that wasn’t a stablecoin got away.

What to watch next

• The post-mortem. Binance promised a detailed technical report. The key detail is how the laptop led to signatures on ten chains, and whether the same path reaches its other wallets.
• Withdrawals reopening. Binance’s 48-hour target runs to about 9 p.m. Pacific Saturday. Watch whether networks come back one by one, and with what limits.
• Proof of Reserves. An updated attestation is the closest thing customers will get to proof that “user funds are safe.”
• Where the unfrozen crypto goes. TRM expects the more than 420,000 ETH and 18,270 BTC to move through bridges, swap services and over-the-counter brokers next. Exchanges that screen those addresses will matter.
• An official attribution. TRM’s TraderTraitor call is an outside assessment. An FBI statement, like the one after Bybit, would make it official.
• Signing policies elsewhere. TRM is telling exchanges to reject unexpected EIP-7702 authorizations and treat requests for many of them as a sign of compromise. Expect other custodians to audit who and what can request a signature.

This is a developing story. Figures are as reported by about 10:30 p.m. Pacific on Oct. 29, 2026, and every loss figure in it is a company or analyst estimate.

Hype in. Signal out.

Update (Oct 30, 2026): In a second security update on Friday, Binance said its initial laptop finding is not the whole picture: “our subsequent investigation has uncovered additional points of breach.” The company says it has set aside more than $6.34 billion through SAFU and its corporate treasury to cover the stolen funds, that about $3 billion has been frozen on-chain, and that it now aims to start reopening withdrawals in phases within about 34 hours, subject to security checks, with Proof of Reserves results by Nov. 2. All of those are company statements. Blockchain analytics firm Elliptic has joined TRM Labs in attributing the theft to North Korean hackers, and TRM says it took about 20 minutes, TechCrunch reports. There is still no official government attribution.

Image: Binance T-shirt and tote bag. Photo by Bretwa / Wikimedia Commons, CC BY-SA 4.0; cropped to 16:9.