The biggest crypto theft on record took about as long as a coffee break. Binance, the world’s largest exchange, said roughly $6.3 billion in digital assets left its wallets on Thursday, October 29, 2026, with the bulk of the outflow starting shortly after 20:00 GMT and wrapping up in around 20 minutes, according to CTV News. This Binance hack is a story about money, but it is also a story about code, because the people who analyzed it keep pointing at one system: the machinery that authorizes transactions.
This piece looks at the incident from an engineering seat. We lay out what has been reported, separate confirmed facts from open questions, and pull out the practical lessons for any team that runs signing services, CI/CD pipelines or developer laptops with production reach. Where the record is thin, we say so.
One caution before the details. Several threads in this story remain preliminary, including the suspected entry point and the attribution. Our earlier coverage of the DevOps laptop finding and the $3 billion freeze tracked the first hours of the investigation, and this analysis builds on it.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
The 20-minute window: what happened in the Binance hack
The timeline is short, and that is the point. Reports place the start of the main theft shortly after 20:00 GMT on Thursday, and the bulk of the funds moved in about 20 minutes. Greensboro’s news site carried a story under the headline “Gone in 20 minutes: How the biggest heist in crypto history unfolded,” which captures how little time defenders had to react.
The scale matters just as much as the speed. TRM Labs, the blockchain-analytics firm, reported that attackers hit 10 blockchains. A single-chain smart-contract bug would not produce that footprint. Wallets on different networks, with different address formats and different signature schemes, all emitted transactions the attacker wanted, and they did it inside the same short span.
Binance put the loss at about $6.3 billion, an estimate built on the exchange’s statements and blockchain analysis. Other outlets used slightly different rounding, and we cover those differences in the next section. The figure should be treated as an estimate until Binance or a forensic report gives a final, audited loss number.
The reaction was equally fast on the other side. Within hours, stablecoin issuers and other market participants began freezing assets tied to the outflow. Binance said it had located or frozen about $3 billion, which means roughly half of the stolen value never reached a clean exit.
The numbers reported so far
Headlines disagree on rounding, so it helps to line up the figures by outlet. The table below lists what each source reported and how we treat it. When sources conflict, we use the more conservative number.
| Data point | Reported figure | Source | Status |
|---|---|---|---|
| Total stolen | About $6.3 billion | RTE | Estimate from Binance statements and chain analysis |
| Total moved (analytics) | About $6.36 billion | TRM Labs, as reported by multiple outlets | Analytics-firm calculation |
| Headline rounding | $6.4 billion | 24/7 Wall St. | Rounded up, not a separate measurement |
| Duration of main theft | About 20 minutes | Multiple outlets | Consistently reported |
| Blockchains targeted | 10 | TRM Labs | Reported by analytics firm |
| Located or frozen | About $3 billion | Binance, via CTV News | Company statement |
| Prior record (Bybit) | About $1.5 billion | Reports | Earlier theft this one surpassed |
Two things stand out. First, the gap between $6.3 billion and $6.36 billion is a methodology difference, not a dispute. Second, the freeze figure is a company statement, so independent confirmation will take longer. Our own tracking of what is known and unknown about the 4.2x Bybit comparison goes through the same caveats.
Why “signing infrastructure” is the phrase that matters
TRM Labs described the compromised system as “signing infrastructure,” the stack that authorizes outgoing transactions. For developers, that phrase changes the whole threat model. An attacker who steals a private key can sign anything, but an attacker who controls the service that asks the key to sign gets the same result without ever touching the key.
Signing is not the same as key custody
Most teams spend their security budget on keeping keys secret. Hardware security modules, multi-party computation and cold storage all answer one question: can someone extract the key? They do not answer a second question: should this particular signature request have been approved? A hot wallet exists to sign quickly and automatically, so its policy layer is the real gate.
That distinction explains why Binance could say it found no sign of a leaked wallet private key while still losing billions. If the system that decides what to sign has been taken over, every signature it produces is valid on-chain. The blockchain cannot tell a legitimate withdrawal from a malicious one.
What ten chains in twenty minutes implies
Ten networks means ten sets of tooling, address formats and signing schemes. An attacker who pushed valid transactions across all of them within minutes was most likely sitting upstream of the chain-specific code, at a shared orchestration layer. That is an inference from the reported facts, not a confirmed finding, but it matches what TRM described: wallets on different chains and with different key types all producing attacker-chosen signatures.
For engineering leads, the uncomfortable lesson is about shared components. A common signing service reduces operational cost and also concentrates risk. When one service can reach every chain, one compromise can reach every chain.
The DevOps laptop: a preliminary finding, not a verdict
Binance’s early investigation pointed to a compromised laptop belonging to a DevOps engineer as the way in. Reports say the access let the attacker reach a service container and submit unauthorized withdrawal transactions. Treat this as an initial finding. Nobody has presented it as the confirmed entry point, and the investigation is still running.
Binance’s co-CEO Richard Teng added an important qualifier. He said the attacker did not simply borrow one engineer’s permissions and that the event was not a single one-click action. Per his statement, it involved a more complex attack process. That wording suggests a chain of steps: the laptop, a container, and then whatever controls sat between that container and the signer.
Every software team should read that sequence as a warning about trust paths. A developer machine often holds cloud credentials, kubectl contexts, SSH agents and API tokens. We covered the same class of problem on the editor side in our guide to keeping secrets out of Cursor and VS Code, and the logic scales up: whatever your laptop can reach, malware on your laptop can reach.
The same applies to AI coding agents that run with broad shell access. Our report on Claude Code v2.1.311 letting agents run rm unasked shows how quickly convenience settings can widen the blast radius of a single workstation.
North Korea attribution: what TRM Labs and Chainalysis said
Both TRM Labs and Chainalysis have pointed to North Korea. TRM named TraderTraitor, a North Korean hacking unit, and said in its words that it made the call with high confidence. Chainalysis reached a similar view. This is attribution by analytics firms, not a finding announced by Binance, and it is not an established fact in the legal sense.
Analysts usually build these calls from on-chain behavior, laundering patterns, infrastructure overlaps and prior campaigns. High confidence is a professional judgment and carries weight, but it has been wrong before in other cases across the security industry. We have a separate walkthrough of the TRM Labs attribution and the $6.36 billion movement for readers who want the analytics side.
An unnamed industry insider told Sky News the theft was “the largest bank heist in human history,” a line that Manx Radio repeated in its headline. The speaker’s identity has not been provided, so read it as color, not as evidence.
The freeze: roughly half the money stopped
The response side of this story is where the industry looks strongest. Reports say Tether, Circle and World Liberty Financial were among the entities that froze assets, and Binance said it had located or frozen around $3 billion. That is about half of the stolen total. The rest remains unaccounted for in the coverage we reviewed.
Freezing works only for assets with a central issuer who can blacklist an address. Stablecoins fit that description. Native Bitcoin and Ether do not, so the portion that sat in those assets carries a harder recovery path. Attackers know this, which is why stolen funds often get swapped into assets that no one can freeze.
For builders, the lesson is operational. The half that got frozen was frozen because issuers and exchanges could be reached fast. Teams that custody user assets should keep a tested contact tree for issuers and partner exchanges, with named humans and a clear escalation process, before any incident happens.
Binance hack vs Bybit: the historical yardstick
The previous record belonged to the Bybit theft, valued at about $1.5 billion in reports. By that measure, the Binance hack is roughly four times larger, and reports say it surpassed the earlier record. The size jump reflects both the asset base Binance holds and the speed of the extraction.
The pattern across both cases is worth stating plainly. Attackers have shifted from hunting individual wallets to targeting the operational layer around them: engineers, internal tooling and approval workflows. The cryptography held up. The humans and the software around the cryptography did not.
The same shift shows up elsewhere in our coverage. The Keystone wallet key theft affecting 18,835 devices was another reminder that the weak point sits in the tooling and supply chain, not in the math.
What Binance and security experts have said
Five statements anchor the technical debate. We quote them exactly as published and link each to its source.
- Binance co-CEO Richard Teng, describing the preliminary finding: “Our initial investigation suggests that the security incident may have involved a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” (source)
- Teng again, on the scope of the attack: “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single “one-click” action. It involved a more complex attack process.” (source)
- Binance, on keys: “We have found no evidence of any wallet private key leak.” (CoinDesk live updates)
- Ilan Ben-Natan, CEO of Blockaid: “It seems to be … a compromise of signing infrastructure. We don’t think a key was leaked.” (Cointelegraph)
- Jayant Dave, cybersecurity expert at Check Point: “The attacker took over the system that tells the keys what to sign.” (Blockchain Reporter)
Read together, the quotes form a coherent picture. Binance says the keys stayed safe. Outside experts say the system that commands the keys did not. Both statements can be true at once, and that is precisely the gap that engineering teams should study.
Control failures and the fixes engineers should consider
We cannot say which controls failed at Binance, because the post-incident report does not exist yet. We can map the reported attack path to the controls that usually break such a path. The table below is our analysis, built on the reported sequence of laptop, container and signer.
| Reported step | Typical weak control | Control that breaks the chain |
|---|---|---|
| Developer laptop compromised | Long-lived credentials stored locally | Short-lived tokens, phishing-resistant MFA, endpoint detection |
| Access to a service container | Broad network reach from engineering devices | Per-service identity, no direct laptop-to-production path |
| Unauthorized withdrawals submitted | Service can request and approve its own transfers | Separate approval domain with quorum sign-off |
| Valid signatures on 10 chains | One shared signing path for every network | Per-chain, per-asset signer scopes and limits |
| Bulk outflow in about 20 minutes | No velocity or destination checks at the signer | Rate limits, destination allowlists, automatic pause |
No single row would have stopped the attack alone. The value comes from layers. If the laptop falls, short-lived tokens limit what the attacker carries away. If the container falls, the approval domain refuses to sign. If both fall, velocity limits throttle the damage to a fraction of the total.
Policy checks outside the signer: a developer pattern
The strongest takeaway for software teams is simple to state. Never let the component that requests a signature also decide whether the signature is allowed. Put an independent policy engine in front of the signer, run it in a separate trust domain, and make it deny by default.
The snippet below is an illustrative pattern, not Binance’s architecture and not production code. It shows the shape of an out-of-band check that refuses unusual withdrawals even when the caller holds valid credentials.
def approve_withdrawal(req, state):
# runs in a separate service and trust domain from the signer
if req.destination not in state.allowlist[req.chain]:
return deny("destination not allowlisted")
if req.amount_usd > state.per_tx_limit[req.asset]:
return deny("per-transaction limit exceeded")
window = state.recent_outflow_usd(req.chain, minutes=15)
if window + req.amount_usd > state.window_limit[req.chain]:
state.trip_circuit_breaker(req.chain)
return deny("velocity limit, chain paused")
if req.amount_usd > state.human_approval_threshold:
return require_quorum(req, signers=2)
return allow(req)Three design choices matter here. The allowlist lives outside the service that submits requests, so a compromised container cannot edit it. The circuit breaker acts per chain, which limits cross-chain spread. And large transfers need a human quorum that no automated caller can satisfy.
Host hardening still counts too. Baseline audits catch drift on the machines that sit closest to production, and our walkthrough of a Lynis Linux security audit in 13 steps is a practical starting point for engineering fleets. Teams managing exchange or wallet integrations should also review the six API key checks we published after the earlier freeze.
Market impact: trust, custody and the cost of speed
The immediate market effect is a trust shock for centralized custody. A $6.3 billion loss at the largest exchange forces every large holder to ask how much of their balance sits in hot wallets and how fast it could move. Expect compliance teams and treasury desks to demand custody disclosures that were previously optional.
Stablecoin issuers gained visibility too. Tether, Circle and World Liberty Financial showed that a cooperative freeze can claw back a meaningful share of stolen funds within hours. That strengthens the argument for regulated, freezable issuance, while it sharpens the privacy and censorship concerns that come with it.
The security vendor market also has a fresh case study. Vendors selling signing-policy engines, MPC custody and transaction simulation now have a headline example that explains their pitch in one sentence. We expect procurement conversations to move faster, though we have no sales data to quantify that.
Custody architectures compared
Readers often ask which custody design would have resisted this kind of attack. No design is immune, but they fail differently. The comparison below summarizes common architectures by what an attacker must control to move funds. It reflects general industry practice, not any single vendor’s specifications.
| Architecture | What an attacker must control | Main strength | Main weakness |
|---|---|---|---|
| Hot wallet with automated signer | The service that submits requests | Fast withdrawals | Policy layer is the only gate |
| HSM-backed signing | The caller plus policy configuration | Keys cannot be exported | Valid requests still get signed |
| MPC custody | Enough key shares or the coordinator | No single key exists | Coordinator becomes the target |
| Multisig with human approvers | A quorum of approvers’ devices | Independent sign-off | Slower, vulnerable to what approvers see |
| Cold storage | Physical or procedural access | Offline by default | Not suited for high-volume withdrawals |
The pattern is that every row has a coordinator or policy component an attacker can aim at. The lesson is to harden that component, display what is being signed in a way humans can verify, and keep hot balances small enough that a total loss is survivable.
Five predictions for the next 90 days
These are our judgments, not reported facts, and any of them could miss.
- A detailed post-incident report will shift the debate. Binance has given only a preliminary account so far. A fuller technical write-up should clarify the laptop theory and the role of the service container.
- Exchanges will shrink hot-wallet balances. Pressure from large clients and regulators should push operators to hold less in automated signers and say so publicly.
- Independent signing policy becomes a standard audit item. Security reviewers will start asking whether the requester and approver of a transaction share a trust domain.
- Developer workstation controls tighten at crypto firms. Expect hardware-bound credentials, privileged-access workstations and stricter limits on local production secrets.
- Attribution will stay contested in public. Analytics firms will keep publishing evidence, while formal government statements may lag, so the North Korea link will remain a high-confidence judgment rather than a legal finding for some time.
What engineering teams should do this week
You do not need to run an exchange to act on this. Any company that moves money, tokens or high-value data through an automated service shares the same structural risk. Start with an inventory: list every service that can trigger a privileged action without a human in the loop.
Next, check who can reach those services from a laptop. If an engineer’s device can talk directly to a production container that holds signing power, break that path. Use short-lived workload identity, route access through a hardened bastion, and require a second approver for any change to signing policy.
Finally, rehearse the response. Time how long it takes your team to pause withdrawals, revoke a service identity and reach your issuer contacts. The Binance hack ran about 20 minutes, so a runbook that needs an hour to execute is already too slow. For wider context on developer tooling and security practice, browse our software coverage.
Frequently asked questions
How much was stolen in the Binance hack?
Binance put the loss at about $6.3 billion, and TRM Labs calculated roughly $6.36 billion. Both are estimates based on company statements and blockchain analysis.
How long did the theft take?
Reports say the bulk of the funds moved in about 20 minutes, starting shortly after 20:00 GMT on Thursday, October 29, 2026.
Were private keys stolen?
Binance said it found no evidence of a wallet private key leak. TRM Labs described the compromised system as signing infrastructure, which suggests the attacker abused the system that authorizes transactions instead of extracting keys.
Who is blamed for the attack?
TRM Labs and Chainalysis attribute it to North Korea, and TRM names the TraderTraitor unit with high confidence. Binance has not confirmed that attribution as a public finding, so it remains unconfirmed as established fact.
How did the attackers get in?
Binance’s preliminary investigation pointed to a compromised DevOps engineer’s laptop, which allegedly gave access to a service container. That is an initial finding and not a confirmed entry point.
How much money has been frozen or recovered?
Binance said about $3 billion was located or frozen, roughly half of the total. Tether, Circle and World Liberty Financial were among the entities reported to have frozen assets.
How does this compare with the Bybit theft?
The Bybit theft was valued at about $1.5 billion in reports, so this incident is roughly four times larger and now ranks as the biggest crypto theft on record.
What should developers take from this?
Treat signing as a high-risk production control, keep approval separate from execution, scope signer authority tightly, and assume developer laptops are an attack path into production.
