In what is being called the largest financial heist in history, crypto exchange Binance reported a staggering $6.3 billion theft. The incident has sent shockwaves through the market, raising urgent questions about the security of even its biggest players.
A Heist Measured in Minutes
On October 29, 2026, the world's largest cryptocurrency exchange, Binance, detected a series of massive, unauthorized transactions. Within a window of about 20 minutes, attackers drained an estimated $6.3 billion in various digital assets, including Bitcoin and Ethereum, from the exchange's hot wallets across ten different blockchains. The sheer speed and scale of the attack prompted an immediate response: Binance halted all withdrawals and launched a full-scale investigation, alerting law enforcement and the wider crypto community. The breach was not a simple smash-and-grab but the culmination of what Binance later described as a months-long, complex campaign.
A Multi-Stage Social Engineering Attack
Initial reports pointed to a single compromised laptop belonging to a DevOps engineer. However, a deeper investigation by Binance revealed a far more intricate plot. The attack reportedly began months earlier, in June 2026, when an engineer downloaded malicious software disguised as a popular AI coding tool. While Binance's security detected this anomaly and replaced the device, the attackers had already gathered crucial information about the wallet infrastructure team. The hackers then escalated their efforts, using social engineering tactics that included fake job interviews. In one instance, another engineer was tricked into downloading a malicious file during a fraudulent recruitment process, which went undetected and gave the attackers a persistent foothold within Binance's systems.
The Internal System Breach
With access secured, the hackers moved laterally inside the network. They reportedly leveraged a compromised internal AI tool to gain control of additional employee devices, eventually finding a crucial deployment permission token on a wallet engineer's computer. This was the key they needed. The attackers didn't steal private keys directly; instead, they used the stolen credentials to access and misuse an internal wallet-signing service. This allowed them to authorize the massive withdrawal transactions themselves, effectively making Binance's own systems execute the theft. The operation was meticulously planned, with attackers preparing dozens of transaction authorizations in advance.
The Aftermath and Market Reaction
The news sent tremors across the financial world. Bitcoin's price dropped nearly 5%, with other major cryptocurrencies like Ethereum and Binance's own BNB token seeing even steeper declines. In the immediate aftermath, Binance worked quickly with stablecoin issuers like Tether and Circle and other partners to trace and freeze the stolen assets. Reports indicate that roughly half of the stolen funds, around $3 billion, were successfully frozen. Co-CEO Richard Teng assured the public that all user losses would be covered by the company, utilizing corporate funds and its Secure Asset Fund for Users (SAFU). Despite the reassurance, the exchange saw net outflows of $3.6 billion as withdrawals were cautiously reopened.
Suspicions Point to North Korea
Multiple blockchain intelligence firms, including TRM Labs and Chainalysis, along with the FBI, have attributed the attack to TraderTraitor, a hacking group with known links to North Korea. Investigators noted that the complex, patient, and multi stage nature of the attack bears the hallmarks of previous state sponsored campaigns, such as the 2025 hack of the Bybit exchange. While Binance has not officially attributed blame, it acknowledged it had detected and stopped 57 separate cyber threats linked to North Korea in 2026 alone, highlighting the persistent threat these groups pose to the industry. North Korea has publicly denied its involvement.
