On the evening of 29 October, an attacker started moving funds out of Binance's hot wallets. TRM Labs puts the total at about $6.36 billion across ten blockchains, most of it gone within roughly 20 minutes of the first transaction at around 20:05 UTC. Other trackers give slightly different totals depending on how they price the assets, which is why you'll see figures between $6.3 and $6.4 billion. We use "approximately $6.3 billion", the number Binance itself has used.
A quick note on terms. A hot wallet is one that stays connected to the internet so an exchange can process deposits and withdrawals quickly. That convenience is also what makes it a target. Binance's co-CEO Richard Teng has said the vast majority of customer assets sit in offline cold storage and are only moved into a hot wallet when someone makes a withdrawal.
Binance's first update said the attack may have started with a compromised DevOps engineer's laptop, which gave the attacker access to a service container and let them push through unauthorized withdrawals. The company also said it had seen no sign that wallet private keys had leaked. In a later update, Binance said its investigation had uncovered additional points of breach, so this was not a single-laptop incident. Teng has said it was not a "one-click" action. As of today, Binance hasn't published a root cause, so the full chain of events is still open.
TRM Labs has published a technical analysis worth reading. On Ethereum, it says, the attacker used an EIP-7702 delegation, a feature that lets an ordinary wallet run smart contract code, to turn a Binance hot wallet into a sweeper the attacker controlled. The attacker had prepared 50 pre-signed authorizations in advance. TRM's reading is that this points to a compromise of Binance's hot wallet signing infrastructure.
This is TRM's assessment based on what it can see on-chain, not a confirmed finding from Binance. We mention it because it fits a pattern we see often: the weak point is the machinery around the keys, not the keys.
TRM Labs and Chainalysis both pointed to TraderTraitor within days. On 31 October the FBI made it official, attributing the theft to the North Korean group. The bureau said that, together with the Secret Service and IRS Criminal Investigation, it had watched TraderTraitor actors converting stolen assets mainly into Ethereum. It expects them to push the funds through DeFi platforms and instant swap services next, and it asked crypto businesses to block transactions linked to the addresses it published. North Korea has denied any role.
This is the same group the FBI blamed for the Bybit theft last year.
Attribution is useful, but it doesn't tell you how the attackers got in or which control failed. Only logs, endpoint forensics and access records can answer that, which is why Binance's eventual post-incident report will matter.
Binance has said it will absorb the loss rather than pass it on to users, using its SAFU emergency fund and company money. About $3 billion of the stolen assets has been traced and frozen on-chain, much of it by stablecoin issuers such as Tether and Circle, which can freeze their own tokens. Assets like Bitcoin and Ether have no central issuer who can do the same.
Binance began reopening withdrawals in phases on 1 November, starting with 15 networks including Bitcoin, Ethereum and Solana, and has been adding more assets since. It says it has now restored backing for about 95% of the affected assets, up from 90% in an earlier update. Note the wording: restoring backing means Binance has bought replacement assets. It is not the same as recovering the stolen funds from the attacker.
Having the money to cover a loss is not the same as having secure systems. A company can be solvent after a breach and still face weeks of disruption and a long road back to customer trust. On the first day withdrawals reopened, Binance reported about $3.6 billion in net outflows as customers moved funds elsewhere. Users are right to look for transparent reporting and independently verifiable proof of reserves.
The investigation is ongoing, but a few lessons are already clear.
An engineer's machine that can reach production is as sensitive as the production servers. Use endpoint detection, patch quickly, and keep the devices used for privileged work locked down more tightly than everyday ones. Watch for odd logins, unexpected remote access and unusual processes.
Every person, service account and application should have the minimum access its job requires. Keep admin accounts separate from day-to-day accounts, review permissions on a schedule, and remove accounts nobody uses. The goal is to limit what an attacker can do after taking over a single identity.
High-value transfers should need independent approval, whether that's multiple approvers, limits, allowlisted addresses or delays for unusual activity. If one compromised component can authorize everything, you have a single point of failure sitting in front of billions of dollars.
Know what normal looks like for admin activity, wallet operations and withdrawal volumes, then alert on the exceptions: sudden privilege changes, logins from new devices, edits to transaction policy, withdrawals above threshold. Alerts only help if someone can act on them fast.
In an incident, nobody wants to be asking who has the authority to pause withdrawals. Write down who decides, how systems get isolated and when critical services can be paused. Then rehearse it. Speed matters here: how much of a theft becomes permanent often depends on the first 24 to 72 hours of coordination between exchanges, issuers and analytics firms.
Banks, fintechs, payment processors, cloud providers and any company holding sensitive data face the same basic risk. Attackers go after the people and systems that control valuable assets, because that's usually easier than attacking the assets directly. One compromised administrator account can expose databases, change production systems or knock out services the business depends on.
Security has to cover the whole chain of trust: endpoints, identities, internal networks, privileged access, approval workflows and monitoring. Strengthening only the most visible piece leaves the other routes open.
If this incident has you wondering how your own setup would hold up, start here:
All of this should be done as part of an authorized security assessment or your internal security program. The point isn't just to collect a list of vulnerabilities. It's to understand how an attacker could get from a small foothold to a major business impact.
The Binance theft shows how far a breach of internal infrastructure can go. A company can have strong individual controls and still lose enormous sums if access management, approval workflows and monitoring don't back them up. The coming weeks should bring more detail on exactly how it happened, and we'll update this post as the facts firm up.
One Cover Pvt. Ltd. helps organizations with security assessments, VAPT and risk-based recommendations. If you'd like to talk about where your own exposure might be, get in touch.
Contact One CoverSources
Disclaimer: This article reflects publicly reported information as of 4 November 2026. The investigation is ongoing and details may change.