Ing. Calogero Bono
On October 29, Binance, the largest cryptocurrency exchange in the world, suffered what sources describe as the largest crypto theft ever recorded. According to TRM Labs' analysis, about $6.36 billion was moved, mostly within roughly twenty minutes. The exchange has suspended deposits and withdrawals, says users' funds are safe and promises to cover every loss. For anyone running servers, access systems and payment infrastructure, this story matters, because the attack reportedly started from an engineer's laptop.
A few terms before we get into the facts. A hot wallet is a crypto wallet connected to the internet, which exchanges use to process customer withdrawals. A stablecoin is a digital currency pegged to the value of a dollar, such as USDT or USDC. A DevOps engineer is the technical role that manages a company's software and infrastructure. A private key is the secret code that authorizes movements from a wallet. TraderTraitor is the name several analysts use for a North Korean hacking group that specializes in targeting crypto companies.
What happened at Binance on October 29?
As Wired reconstructs it, on Thursday, starting at 4 pm US Eastern time, the attackers began rapidly withdrawing about $6.3 billion in cryptocurrencies from Binance wallets spread across multiple blockchains. Binance suspended deposits and withdrawals almost immediately while it investigated.
TRM Labs' analysis, reported by BleepingComputer, puts the figure at about $6.36 billion pulled from wallets on ten blockchains, almost all of it in about 20 minutes. The networks involved include Ethereum, Bitcoin, Tron and Solana. The funds ended up in several addresses controlled by a single attacker.
The amount is the highest ever seen. According to The Verge, it is roughly four times the previous record, the $1.46 billion stolen from Bybit last year. Binance had already been hit in 2019, when it lost 40 million dollars at the time.
Be careful with the numbers, which vary from source to source. Tom's Hardware initially reported $5.6 billion and noted that the totals were provisional. Later estimates, from TRM and Binance, converge on $6.3 to $6.4 billion.
How was the attack carried out?
An engineer's laptop
Binance explained that the incident reportedly involved the laptop of one of its DevOps engineers. That access allegedly let the attacker reach a service container and send unauthorized withdrawal transactions. The affected address had its authorization revoked right away.
The picture then grew wider. The company wrote on X that the follow-up investigation found additional points of compromise and that this is a complex attack, being handled together with law enforcement. Co-CEO Richard Teng clarified that the attacker did not simply use an engineer's permissions and that it was not a single click. So far, he added, there is no evidence of a leak of wallet private keys.
Days of preparation
According to TRM, cited by Wired, the preparation began at least 36 hours before the theft. One of the attacker's wallets received three small withdrawals during a testing phase. Early on October 29, the attack code was tried on two wallets. Later, the final version was tested on a third, with the test funds sent back to the sender. Four hours later the same code was installed on a Binance hot wallet.
Tom's Hardware adds that hot wallets named Binance 14, Binance 16 and Hot Wallet 34, which hold pooled customer funds, were drained. The same article stresses that it is not known whether this happened with stolen keys, a compromised signing process or some other method. This part remains open.
Who is behind the theft?
Binance has not attributed responsibility to any group. Teng said the investigation had not attributed it to any individual. Neither the company nor law enforcement, according to Wired, has indicated any links to North Korean hackers.
Blockchain analytics firms, however, point in that direction. TRM and Chainalysis attribute the attack to TraderTraitor, a North Korean state unit that BleepingComputer also refers to as Lazarus Group and APT38. Chainalysis reports a high level of confidence. Elliptic says it has not tied the attack specifically to the group, but sees overlaps. According to its co-founder Tom Robinson, if North Korea is really behind the attack, this single theft would roughly double everything the regime has stolen in crypto so far.
The clues cited by sources are several. Chainalysis observed in real time Binance funds being mixed with those from an attack on Bitget last month, already attributed to North Korean actors. Elliptic recalls that targeting crypto company staff is a TraderTraitor hallmark, that the attacker funded the wallet through Tornado Cash and that they tested the attack in advance, as in the Bybit case. According to Wired, the FBI had attributed that Bybit attack to TraderTraitor.
These are attributions from private companies, based on analysis of activity both on and off the blockchain. They are not a judicial conclusion.
How much has been frozen and how much is lost?
Estimates do not agree here, because the situation changes by the hour. The frozen funds range from about $2.4 billion (Tom's Hardware) to $2.7 billion (TRM, via BleepingComputer), $2.8 billion (Elliptic), and up to about $3 billion (Binance, reported by The Verge).
Freezing does not mean recovering. Stablecoin issuers can blacklist the thief's address, so the thief can no longer move or swap those tokens. According to TRM, Tether, Circle, Ripple and World Liberty Financial took action, while the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB on its own network. Tom's Hardware notes that, as a rule, returns come only after owners prove their rights, often over long timeframes.
The core problem is cryptocurrencies with no authority to freeze them. Robinson estimates that the remaining $3.3 billion is mostly Bitcoin, Ether and XRP, which no one can freeze. They can be stopped only when they reach an exchange or another service. He believes something will be intercepted in the coming months, but the frozen share should not rise much.
TRM also describes the race against the freezes. The attacker reportedly sold USDT to market makers and borrowed ETH against USDT on Aave. Now, again according to TRM, they control more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond the reach of issuers. Chainalysis flags money laundering patterns never seen before and thousands of automated transactions designed to obscure the trail.
Could users lose money?
According to Binance, no. The company says it will cover all losses using the SAFU fund and its own resources, and that it will publish an updated Proof of Reserves once the cleanup is complete. It also says it set aside over $6.34 billion in corporate funds for this incident, of which $5 billion is already held in the same affected tokens. These are the company's statements, not independent verifications.
The SAFU fund, created in 2018 and funded with 10% of trading fees, contains according to Tom's Hardware 15,000 BTC, about $1.17 billion at the price cited. The Verge describes an emergency reserve of about $1.3 billion at the latest valuation. The two figures depend on the Bitcoin price. In any case the fund covers only part of the loss, which is why the corporate funds matter. In 2019 Binance covered the 7,000 BTC stolen entirely with SAFU. Former CEO Changpeng Zhao, Tom's Hardware recalls, also expects users to be compensated. The Binance.us site, the same source reports, appears untouched so far.
Binance also warns of scams exploiting the episode, with emails, SMS messages and calls imitating the company. Offers of compensation or withdrawal restoration should be treated with suspicion, received links should not be opened, and only the official site and app should be used.
Limits to keep in mind
- The figures are not final. The total stolen and the frozen amount vary depending on the source and the time.
- The attribution to North Korea comes from analytics firms, not from Binance or the authorities. Elliptic itself distinguishes between attribution and overlaps.
- We do not yet know the exact method. Binance mentions multiple points of compromise beyond the laptop and no evidence of a private key leak. Other hypotheses remain open.
- Refund promises are the company's statements. We do not know the timing or procedures, or the outcome of the Proof of Reserves.
- We do not know how much will be recovered. Estimates for the non-freezable portion come from individual analysts.
What changes for anyone working in digital
You do not need to hold cryptocurrencies to learn something from this. Binance's account involves a laptop, a service container and withdrawals authorized with valid credentials. It is the same pattern every company with technical staff and privileged access faces, even small ones.
First, the devices of people with sensitive access are part of your infrastructure. A developer's laptop with access to production servers deserves the same level of protection as the server itself. If you manage your systems through managed hosting and servers with security updates, part of this work is already delegated, but access and permissions remain your responsibility.
Second, limit what a single access can do. Teng stressed that the attack was not a single click, but the example shows how much it matters to separate roles, require multiple approvals for sensitive operations and monitor unusual movements in real time. Twenty minutes is too short to react by hand.
Third, time and automation, which The Verge also touches on when it recalls OpenAI's report on a model of its own capable of stealing fake crypto on an Ethereum test network. We have written about this topic in an autonomous hacker and what it means for Italian SMEs. Attackers increasingly use automated tools, and manual defenses are getting slower.
Fourth, the human factor. Elliptic points out that North Koreans target staff, and Sophos, cited by Wired, notes that the group has in the past created fake applications to get into companies. The risk also covers account scams, like those we covered when discussing hackers using Meta's AI to steal accounts. Anyone installing third-party software, including open source, should read the guide on open source compliance and security for business use.
Finally, your relationship with vendors. If a service holds your customers' funds or data, ask how it protects staff accounts and laptops, and what happens in case of an incident.
Our take
The most interesting point is not the amount, but the mismatch between the sophistication of the attack and its entry point. To drain wallets on ten blockchains, at least initially, it was enough to reach one person and one laptop. The most refined cryptography and architectures are worth little if the human and operational perimeter is fragile. On this, Binance has so far shared few details, which is understandable while the investigation is open.
We find the speed of communications and the coverage promise positive, but we approach them with caution. Saying users' funds are safe when over two billion are in the attacker's hands and cannot be frozen requires seeing the numbers. The promised Proof of Reserves will be the real test, since third parties can verify it.
There is also a critique for the sector. Hot wallets holding pooled customer funds are, by definition, a target, and after Bybit in 2025 the same playbook repeated itself at four times the scale. An attack prepared over 36 hours and tested several times may have left signals. We are waiting to understand whether they were ignored. And there is a limit on our side as well. The attributions come from private companies, which have an interest in showing their capabilities, and should be treated as authoritative hypotheses rather than verdicts.
Frequently asked questions
How much was stolen from Binance?
About $6.3 billion according to Binance and most sources, $6.36 billion according to TRM. An early count by Tom's Hardware said $5.6 billion, but it was provisional. The theft would be the largest in crypto history.
Will I lose my money if I have an account on Binance?
According to Binance, no, because it says it will cover all losses using the SAFU fund and corporate funds. This is the company's statement. For now deposits and withdrawals are suspended, so funds are not accessible until the checks are completed.
Who attacked Binance?
It has not been officially confirmed. TRM and Chainalysis attribute the attack to TraderTraitor, a North Korean group, while Elliptic sees overlaps without tying it specifically to them. Binance and law enforcement have not named anyone responsible.
How did the hackers get in?
Binance refers to the compromised laptop of a DevOps engineer, which allegedly gave access to a service container and to unauthorized withdrawals. It then said it found other points of compromise. It has not confirmed any leak of private keys.
Can the stolen funds be recovered?
Only partially. Estimates of frozen funds range from about $2.4 to $3 billion, mostly stablecoins, but frozen does not mean returned. Bitcoin, Ether and XRP cannot be frozen and, according to Elliptic, the blocked share should not rise much.
What to watch in the coming weeks
Three developments are worth following. How much Binance publishes about the attack method, the outcome of the updated Proof of Reserves, and the movements of the roughly $2.4 billion that cannot be frozen, which could be intercepted once they pass through an exchange. In the meantime, there are three practical steps.
- Check who has privileged access in your company, reduce permissions to what is necessary and protect the devices of anyone working on servers and production. For concrete help, you can look at the services of the Meteora Web agency.
- Be wary of emails, SMS and calls that mention the Binance attack or offer compensation. Enter only through the official site and app, without clicking received links.
- Do not keep funds or critical data in a single place. If you use an exchange, keep only what you need and read the Proof of Reserves once it is published.
Sources
- BleepingComputer, Binance links $6.3 billion crypto theft to compromised DevOps laptop
- Wired, The $6.3 Billion Binance Hack Was Pulled Off in Just 20 Minutes
- The Verge, Binance hackers stole $6.3 billion in record-breaking crypto heist
- Tom's Hardware, Suspected North Korean hackers steal $5.6 billion in crypto
