The Binance hack: $6.3 billion in twenty minutes from an engineer's laptop

Yesterday evening, 29 October, Binance, the world’s largest cryptocurrency exchange, suffered the largest crypto theft on record: according to the company itself, around $6.3 billion. The figure is still moving (Chainalysis puts it at about $5.9 billion and TRM Labs at $6.36 billion), but either way it’s four times the previous record, the $1.5 billion stolen from Bybit in February 2025.

What interests me is less the numbers than the how. There are two accounts that fit together: Binance’s, which explains how the attacker got in, and TRM Labs’, which reconstructs it from the transactions on the different chains.

How they got in

According to Binance’s initial investigation, it all started with a DevOps engineer’s compromised laptop. From there, the attacker gained access to a service container and used it to submit unauthorised withdrawal transactions. Binance says it has found no evidence that any wallet private key leaked, and that it will publish a detailed technical post-mortem once the investigation concludes.

TRM reaches a compatible conclusion: the attacker managed to get the system that signs transactions for Binance’s hot wallets to sign whatever they wanted. Both things can be true at once. The keys can be perfectly stored in an HSM or a signing service, and it still doesn’t help if someone manages to ask that service to sign.

flowchart LR
    A["An engineer's laptop"] --> B["Service container"]
    B --> C["Signing system · hot wallets"]
    C --> D["Signed withdrawals on ten chains"]
    D --> E["Attacker wallets"]

A carefully prepared operation

TRM’s reconstruction shows an attack that was anything but improvised:

Most of it left in about twenty minutes. By chain, the breakdown looks like this:

The Ethereum trick: 50 authorisations signed in advance

The most technically striking part is on Ethereum. The attacker used EIP-7702, the proposal that arrived with the Pectra upgrade in 2025 and lets a regular account delegate its behaviour to a smart contract through a signed authorisation.

Each authorisation is tied to the account’s nonce, the counter that prevents transactions from being replayed. Since the attacker didn’t know exactly which nonce the wallet would have at the time of the attack, they prepared 50 authorisations for consecutive nonces, so that one would match. They sent them all in a single transaction, and Binance’s hot wallet ended up delegated to a “sweeper” contract that only accepted orders from the attacker. About three and a half minutes later, the wallet was emptied.

On the other nine chains nothing so elaborate was needed: ordinary signed transfers were enough. That’s why TRM rules out simple phishing, which would explain Ethereum but not the rest.

The race to freeze

This is the most curious contrast in the case. Bitcoin or ETH can’t be frozen, but stablecoins can, because they’re issued by a company that can block addresses. And they did it fast:

In total, Binance speaks of about $3 billion frozen. The attacker knew this, which is why they rushed to convert stablecoins into ETH: they sold about 325 million USDT through UniswapX paying more than 10% above the market price, and deposited another 60 million as collateral on Aave to borrow about 19,760 ETH. Aave later froze those markets.

According to TRM, the attacker still holds over 420,000 ETH and the 18,270 BTC, about $2.4 billion, and the bitcoin is already moving in small hops between addresses to make tracing harder.

Who’s behind it

TRM attributes it “with high confidence” to TraderTraitor, a North Korean group linked to Lazarus, which the FBI already blamed for the Bybit theft. Chainalysis also points to North Korea. The signs match earlier attacks: funding the operator wallet through Tornado Cash, preparing everything well in advance and executing previously obtained signatures in a single burst. The difference from Bybit is in the laundering, which this time relies on swaps and lending rather than cross-chain bridges.

What about users

Binance has suspended deposits and withdrawals, says “user funds are safe” and that it will cover all losses from its SAFU emergency fund and its own funds. Co-founder Yi He expects withdrawals to resume on Sunday. The market noticed: bitcoin fell about 5%, below $77,000.

My takeaway

This case seems to me a very clear lesson for anyone working on infrastructure, whether or not they deal with crypto. No key had to be stolen: it was enough to reach, from one person’s laptop, a system that was allowed to request signatures. It’s the same pattern that repeats in many incidents: the most protected part of a system is only as secure as whatever is allowed to talk to it.

That’s why the measures that really matter aren’t in the HSM but around it: team laptops shouldn’t have a direct path to critical services, a signing system shouldn’t sign anything it receives without amount limits or additional approvals, and moving billions in twenty minutes should trigger alarms that stop something. We don’t know yet which of those barriers was missing or failed. The technical post-mortem Binance has promised should clear that up.

Source: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, TRM Labs. More context from CoinDesk, NBC News and Al Jazeera.