On October 29, 2026, attackers moved roughly $6.3 billion worth of digital assets from Binance’s hot wallets in a window of about 20 minutes. Hot wallets are internet‑connected accounts used for day‑to‑day withdrawals.
Timeline and suspected preparation
Opsek founder Pablo Sabbatella’s review of the incident suggests the operation was methodical. Staging activity linked to the hack began at least 36 hours before the cash‑out, and Sabbatella believes the intruders may have gained initial access weeks earlier to map Binance’s internal systems.
Likely entry point
The breach is thought to have started with a compromised laptop belonging to a DevOps engineer. From that foothold, attackers accessed a service container—a self‑contained software component—allowing them to execute unauthorized withdrawals.
Attribution
Security analytics firms TRM Labs and Chainalysis, together with the FBI, have attributed the attack to the group TraderTraitor, which is linked to North Korea.
Impact and response
The Binance theft surpasses the previous record of about $1.5 billion tied to Bybit. Binance worked with stablecoin issuers to freeze approximately $2.7 to $3 billion of the stolen funds. The exchange also pledged to cover roughly 90‑95% of the loss using corporate reserves and has begun cautiously resuming withdrawals.
Implications for security
Sabbatella’s analysis highlights that the visible 20‑minute drain may have been the final stage of a longer intrusion. The incident underscores the importance of securing staff devices and internal access controls, prompting a shift toward an “assume compromise” security posture where a single compromised machine cannot reach funds.
