Binance Reportedly Loses an Estimated $6.3 Billion in Hot Wallet Theft, With a Developer's Laptop Named as the Entry Point

Binance has confirmed that an attacker drained an estimated $6.3 billion from its hot wallets across roughly 10 blockchains on the evening of 29 October 2026. Most of the funds moved within about 20 minutes. The attacker did not simply steal keys. Instead, they made Binance's own withdrawal systems sign and send funds to addresses they controlled. The operation appears to have been staged in advance and run across multiple chains at once.

Binance's initial investigation suggests a compromised DevOps engineer's laptop gave the attacker access to a service container that submitted the unauthorised withdrawals. The company says it found no evidence that a wallet private key leaked. About $3 billion has been blocked through on-chain freezes, and Binance says it will cover all losses from its SAFU fund and company funds. Withdrawals remain paused while controls are improved, and should begin resuming within 48 hours. Deposits are operating normally.

Blockchain analysts attribute the theft with high confidence to North Korea's TraderTraitor group, but neither Binance nor government agencies have confirmed this. As of 00:30 UTC on 30 October, about $2.4 billion was still under attacker control. Binance has warned users not to trust unofficial links or messages about the incident.