The Binance hack that drained about $6.3 billion from the exchange’s hot wallets on October 29, 2026 appears to have started on an engineer’s computer. In its first statement on October 30, Binance said the incident “may involve a compromised DevOps engineer’s laptop,” which gave an attacker access to a service container that then submitted unauthorized withdrawal transactions.
The Binance Hack Ran Through a Service That Could Already Send Withdrawals
Binance’s co-CEOs, Yi He and Richard Teng, said in a second update on October 30 that the hot wallets were compromised at around 20:05 UTC the previous evening. The company’s initial account describes a chain with three links. An attacker got control of a laptop belonging to a DevOps engineer. From that laptop the attacker reached a container running inside Binance’s infrastructure. From that container the attacker submitted withdrawals, and Binance’s systems processed them. The same update cautioned that the investigation had since “uncovered additional points of breach,” so the laptop is the first confirmed entry point and possibly one of several. Binance has promised a technical post-mortem once the facts are verified.
Binance Found No Leaked Private Keys, and the Theft Did Not Need Them
Binance said twice that it had found no evidence that any wallet private key was leaked. That statement is reassuring about the custody layer and revealing about everything above it. If the account holds, the attacker never touched the signing material. A service that was already authorized to request withdrawals did the requesting, and the systems downstream treated those requests as legitimate. Binance said its first containment steps were to revoke the affected address authorization and suspend withdrawals. Both steps target what a service was allowed to do.
Binance Is Covering the $6.3bn Loss With Its Own Reserves
Binance said it had set aside more than $6.34 billion in company funds, including $5 billion held in the exact tokens that were stolen, such as BTC, ETH, USDT and USDC. Its coverage rose from about 80% on October 30 to 90% on October 31 and 95% on November 1. The money came from a partial draw on its Secure Asset Fund for Users (SAFU), part of its futures insurance fund and its corporate treasury. Binance said it will rebuild SAFU to about $1 billion. The last 5% consists of less liquid tokens outside its top ten, which it is still buying through market and over-the-counter channels. Separately, it said about $3 billion of the stolen assets had been frozen on-chain with the help of blockchain partners. It took a new proof of reserves snapshot at 00:00 UTC on October 31 and expects the full zero-knowledge proof by November 3.
Withdrawals Reopened in Phases, Starting With the Most-Used Networks
Phase one of withdrawals opened between 06:00 and 09:00 UTC on November 1 and covered 15 networks, including Bitcoin, Ethereum, BNB Smart Chain, Tron, Solana, Arbitrum, Base and Optimism. Binance said it ranked networks by user demand over the past week, so each one could pass stability and security checks before reopening. Deposits stayed open throughout. TechCrunch’s Anthony Ha reported that Binance then disclosed $4.6 billion in withdrawals and $1.0 billion in deposits between 6:00 and 15:30 UTC that day, a net outflow of $3.6 billion that the exchange put at 2.1% of the assets it holds.
The FBI Attributes the Theft to North Korea’s TraderTraitor Activity
On October 31, the FBI said North Korea was responsible for taking more than $6 billion in virtual assets from Binance on or about October 29. It uses the name TraderTraitor for this activity, the same label it applied in February 2025 when it attributed the roughly $1.5 billion theft from the Bybit exchange to North Korea. Working with the Secret Service and IRS Criminal Investigation, the FBI said the thieves were converting the assets mainly into Ether, and it asked exchanges, decentralized finance services and blockchain analytics firms to block transactions linked to the theft. The attribution is the FBI’s assessment. No one has been charged.
Why This Matters for Engineering Leadership
Most engineering organizations will never hold $6 billion in a hot wallet. Almost all of them have a DevOps engineer whose laptop can reach production, and a service somewhere that can move money, send data or change customer records on its own authority. Binance’s early findings are a reminder that strong key management protects the key and nothing else. The question to ask of any high-value action is which services can request it, and which machines can reach those services. Treat an engineer’s laptop as an untrusted network, with short-lived, hardware-bound credentials and no standing path into production containers. Give the services that initiate irreversible actions the narrowest authority they need, and put independent limits downstream: per-period caps, anomaly holds and a second approval that the requesting service cannot satisfy by itself. Practice revoking one service’s authority quickly, because that was one of Binance’s first containment steps. And plan the recovery the way Binance did, in phases ranked by what users need most, with the order decided before an incident forces it.
FAQ
How did the Binance hack happen?
Binance’s initial investigation said a compromised DevOps engineer’s laptop may have let an attacker reach a service container and submit unauthorized withdrawals. A later update said investigators had found additional points of breach.
How much was stolen in the Binance hack?
Binance puts the loss at about $6.3 billion in token assets taken from its hot wallets around 20:05 UTC on October 29, 2026. It says about $3 billion has been frozen on-chain.
Were Binance’s private keys stolen?
Binance says it has found no evidence that any wallet private key leaked. The attacker’s withdrawals were submitted through a service that already had authority to send them.
Who does the FBI say was behind the Binance hack?
On October 31 the FBI attributed the theft to North Korea and the activity it calls TraderTraitor. No one has been charged.
Will Binance users lose money?
Binance says it will absorb the loss using its SAFU fund, part of its futures insurance fund and its corporate treasury. As of November 1 it said it had covered about 95% of the stolen assets.
Can Binance users withdraw funds now?
Phase one of withdrawals began on November 1, 2026, covering 15 networks chosen by the previous week’s user demand. Other networks and assets will follow as checks finish.