October 29, 2026, was the day that crypto-currency security assumptions broke. The largest exchange in the world, Binance, was hit with an estimated $6.3 billion security incident, almost four times the size of the Bybit hack of 2025. But the most disturbing thing about it was not its size, but how it happened: not through cracked encryption or stolen private keys, but by compromising a single engineer’s laptop and using a legitimate Ethereum feature to make Binance sign away billions of dollars.
The Attack, Minute by Minute
The operation began quietly the day before. On October 28, an attacker address received 0.1 ETH from Tornado Cash, a mixing service, and deployed a malicious smart contract. Then, at 20:20:59 UTC on October 29, the trap was set.
This transaction used the EIP-7702 standard, an Ethereum feature added in May 2025 with the Pectra upgrade. It enables a regular wallet to delegate control to a smart contract—which is useful for exchanges to batch withdrawals. But delegation requires a signature from the private key, and the attacker had 50 valid signatures, all pointing to their own contract and each targeting a different possible nonce for the hot wallet called “Binance 14.”
As Binance was busy processing transactions, the attackers did not know the wallet’s exact nonce. So they sent 50 authorizations at once. One landed.
Four minutes later, at 20:24:23, the attacker called the contract. The hacker drained Binance 14, transferring a total of 167,464 ETH and 63 other tokens in a single transaction, with a fee of about $0.93. Minutes later, funds from Binance 16 followed, and by 20:41 roughly $2.8 billion had moved on the Ethereum network alone, with the operation spanning ten blockchains, including Bitcoin, Tron, and Solana.
The Entry Point: One Laptop
After investigating the matter, Binance suspects that a compromised DevOps engineer’s laptop was the likely starting point of the incident. According to co-CEO Richard Teng, the compromised device gave the attacker access to a service container, where they submitted unauthorized withdrawal transactions.
Teng cautioned that the attacker did not simply use one engineer’s permissions or carry out a single one-click action, but instead used a more complex attack process. The exchange has found no evidence of wallet private key leakage: the keys were not stolen, but the system that uses them was manipulated.
According to Check Point’s Jayant Dave, the perpetrators did not break the encryption or steal the keys, but took over the system that tells the keys what to sign. Kaspersky’s Georgy Kucherenko noted that exchange employees, especially technical staff, remain a weak link in crypto theft attacks, citing previous cases in which developers downloaded malicious extensions into their development environments.
The Freeze: A Race Against Time
The response was swift and systematic. Tether froze nearly $1.57 billion in USDT. Circle froze over $800 million in USDC. Ripple froze roughly $200 million. Arbitrum’s Security Council froze thousands of ETH and ARB tokens on its network.
According to Binance’s official statement, about $3 billion was frozen on-chain, but roughly $2.4 billion remained beyond any issuer’s reach. According to TRM Labs, the attacker raced the freezes by selling USDT to market makers and borrowing ETH against USDT on Aave, ultimately securing more than 420,000 ETH and 18,270 BTC in assets that cannot be blacklisted.
Binance has pledged to cover all losses with its SAFU fund and company funds, and has assured users that their funds are secure. After the hack, the platform temporarily suspended withdrawals while it revamped its withdrawal service and revoked the affected address authorizations. Deposits have since resumed, with withdrawals expected to follow within 48 hours.
Who Is Behind It?
Two blockchain analytics firms, TRM Labs and Chainalysis, attributed the attack with high confidence to TraderTraitor, a North Korean state-backed hacking group also tracked as Lazarus Group and APT38. The same group was linked to the $1.5 billion Bybit hack in February 2025. However, Binance has not officially attributed the attack, saying its investigation has not attributed responsibility to any individual.
What It Means
The market reaction was sharp: Bitcoin fell to a six-week low around $76,500, Ether dropped roughly 9%, and Binance’s BNB token slid over 8%. But the greater damage was to trust. The attack was not based on a flaw in blockchain cryptography, but on the human and operational layer—the laptops, access controls, and signing infrastructure that exchanges build around their keys.
Solar 4RAYS analyst Vasily Shtyrkov observed that crypto exchanges hold assets worth billions, and the irreversible nature of blockchain transactions means they cannot cancel a transfer and return funds as traditional banks can. The $6.3 billion question is whether the industry can secure this human layer before the next laptop falls.
FINN SHUMMER
FOR MORE…
- BleepingComputer: https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/amp/
- TRM Labs (official analysis report): https://www.trmlabs.com/resources/blog/north-korea-steals-usd-6-36-billion-from-binance-in-the-largest-hack-in-history
- Yahoo Finance: https://finance.yahoo.com/markets/crypto/articles/binance-6-3-billion-hack-064239495.html