Twenty Minutes, Ten Blockchains, $6.3 Billion: Binance Says the Biggest Crypto Theft on Record May Have Started on One Engineer’s Laptop

At 20:05 UTC on Thursday, October 29, which was just after 4 p.m. on the U.S. East Coast, money started leaving Binance. According to blockchain intelligence firm TRM Labs, the bulk of the theft happened within about twenty minutes, spread across ten blockchains. By TRM’s count the total was about $6.36 billion. Binance puts it at roughly $6.3 billion. Either way, it is around four times the $1.5 billion taken from the Bybit exchange in February 2025, which had been the largest crypto theft on record.

This account is based on SecurityWeek’s reporting on the TraderTraitor hallmarks, with additional details from Help Net Security and BleepingComputer.

The way in, as Binance tells it

Binance’s early findings suggest the attack may have begun with a compromised laptop belonging to one of its DevOps engineers. From that machine, the attacker appears to have reached a service container and used it to submit withdrawal transactions that were never authorized. The exchange says it has found no evidence that wallet private keys were leaked.

Co-CEO Richard Teng cautioned against reading this as one person’s mistake. He said the incident was more complex than a single engineer’s permissions or a one-click action, and that Binance is not blaming any individual. The company also said it has uncovered additional points of breach that it believes are linked, and that it revoked authorization for the affected address.

The preparation investigators found

TRM’s analysis suggests this was not improvised. The attackers spent at least a day and a half getting ready, funding an operator wallet through small withdrawals from the Tornado Cash mixing service and testing their code on other wallets first. On Ethereum, they used a feature called EIP-7702, preparing 50 pre-signed authorizations so that one would match the wallet’s transaction count when the moment came. On the other nine chains the transfers looked like ordinary, validly signed transactions, which TRM says points to an attacker who was able to make Binance’s hot wallet signing system sign whatever they wanted.

TRM attributes the theft with high confidence to TraderTraitor, a North Korean state-backed group the FBI previously tied to the Bybit heist. Chainalysis reached the same conclusion, noting that proceeds from last month’s Bitget exploit were mixed with funds taken from Binance. Binance itself has not publicly named the attackers and says it is working with law enforcement. Elliptic, a third analytics firm, has urged caution before settling on attribution, even though it also sees North Korean tradecraft, because the speed and methods used to launder the money differ from past North Korean operations and the root cause is not yet known.

The scramble to freeze funds

Part of the haul was taken in stablecoins, whose issuers can freeze tokens. By 00:30 UTC on October 30, TRM says about $2.7 billion had been frozen, including roughly $1.77 billion in USDT by Tether and about $825 million in USDC by Circle. Binance’s own estimate of frozen assets is closer to $3 billion. The attackers were seen selling USDT at more than 10% below market value to move it before it was locked, and they still hold more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion.

Binance first suspended both deposits and withdrawals for security checks. In a later update it said deposits were working normally and that withdrawals would stay paused until it finished a security overhaul of its withdrawal service, which it expected to take about 48 hours. It says losses will be covered from its Secure Asset Fund for Users and company funds, and that it will update its Proof of Reserves once remediation is complete.

Still open

How the engineer’s laptop was compromised in the first place.
What the “additional points of breach” are.
Final figures. Reported totals for the theft and the frozen amount differ by source and are still moving.

What this means for your company

Most businesses do not hold billions in crypto, but nearly every business has a few people whose laptops can reach the systems that move money or change production settings. Those machines deserve extra protection: strong sign-in, monitoring, fast patching and separation from everyday browsing and email where possible. Just as important, no single account or device should be able to push a large payment or change through on its own. Requiring a second person or a second check for high-value actions is cheap insurance.

Want to know which laptops in your company could move money or change critical systems, and how well they are protected? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.