Introduction
A single laptop may have cost the world’s biggest crypto exchange $6.3 billion. Attackers drained Binance wallets across 10 blockchains in about 20 minutes. Stablecoin issuers froze close to $3 billion before the hour was out.
What Happened?
The outflows started at 20:05 UTC on October 29. Five wallets pushed 233 million XRP into one address. Nine more chains followed within minutes. On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper contract, then emptied 167,464 ETH and 1.615 billion USDT in under four minutes. Binance says the trail starts at a compromised DevOps engineer’s laptop that reached an internal service container able to submit withdrawals. It reports no evidence of a private key leak, and has since said investigators found more breach points.
Roughly 43% was frozen. The rest kept moving.
Stablecoin issuers reacted inside 40 minutes, which is the only reason any of it stopped. Assets with no central freeze switch, mainly Bitcoin, Ether and native tokens, stayed in attacker control and started routing through lending pools and discounted swaps the same night.
Binance says it will cover every loss from its SAFU reserve and company funds. Deposits kept running throughout. Withdrawals were paused and expected back inside about 48 hours.
Who Did It?
Staging began about 36 hours early. A fresh operator wallet took small mixer withdrawals, and the code was first rehearsed on low-value wallets. Two blockchain analysis firms attribute the theft to a North Korean unit with high confidence. Binance has not confirmed that, and no government has either. Loss estimates range from $5.9 billion to $6.36 billion, depending on when each firm prices the tokens.
What’s the Impact?
Withdrawals stopped. Deposits kept running. Binance says it will cover every loss from its SAFU reserve and company funds, with withdrawals back inside roughly 48 hours. About 43% of the money sits frozen. The other $3.3 billion was already moving through lending pools and discounted swaps the same night, which is why the immediate steps after a breach matter more than the post-mortem.
Binance hack IOC reference
Published attacker addresses and transaction hashes from the October 29, 2026 incident, drawn from public blockchain investigation reporting. Addresses are labeled by observed on chain behavior, not by confirmed identity. Screen deposits and counterparty flows against this list.
Use with care. These indicators come from third party blockchain analysis published within 24 hours of the incident, and attribution is still unconfirmed by Binance or any government. Addresses may be reassigned or superseded as the investigation continues. Validate against your own threat intelligence feed before blocking or filing a report.
How to Avoid This
- Treat engineering endpoints as tier zero assets, with device posture checks and short-lived production credentials.
- Split signing paths by chain and wallet tier, so one foothold cannot reach everything.
- Configure signers to reject unexpected delegation authorizations, and alert on batched nonces.
- Put velocity limits and anomaly holds on withdrawals, measured across chains and not one at a time.
- Tighten modern access governance so a workstation cannot inherit a path into money movement.
Your Weakest Laptop Should Not Be Able to Move $6 Billion
Nothing between that engineer device and 10 blockchains ever stopped to ask a person for confirmation. Secure.com AI Teammates sit above the stack you already own and put that confirmation back into the path.
- The Red Teammate works inside an approved scope to simulate lateral movement from a developer endpoint to production signing, so you find the route before someone else sells it.
- The SOC Teammate triages the 3am outflow alert with full case context attached, instead of parking it in a queue until the morning shift.
- Consequential actions pause at human approval gates. Your team sets the rules. The teammates do the work.
- The Cloud Teammate watches identity and permission drift across accounts, which is where quiet footholds sit for weeks.
- Every recommendation, approval, and action is logged, so you can walk a board, an auditor, or a regulator through the night line by line.