On Thursday afternoon, October 29, at about 1:05 p.m. Pacific time, money started leaving Binance. Within roughly twenty minutes, wallets belonging to the world’s largest cryptocurrency exchange had sent their balances to addresses controlled by one attacker, across ten different blockchains. Blockchain analysts at TRM Labs put the total at about $6.36 billion. Binance’s own estimate is $6.3 billion.
That makes it the largest crypto theft on record, about four times the $1.5 billion stolen from the exchange Bybit in February 2025, which until today held the title. Binance suspended deposits and withdrawals and has pledged to cover all customer losses.
The number is staggering. But the detail that caught my eye is much smaller: according to Binance’s early investigation, it may have started with one laptop.
How one machine opened the vault
As CNBC reports, Binance says the incident may involve a DevOps engineer’s compromised laptop. From there, the attacker reached a service container inside Binance’s systems and was able to submit withdrawal transactions that looked authorized.
TRM’s analysis of the blockchain fits that picture. Wallets on very different networks, using different key types and signing methods, all produced valid signatures for the attacker within about half an hour. TRM’s conclusion is that the attacker gained the ability to make Binance’s own “hot wallet” signing system sign whatever it wanted. (A hot wallet is the internet-connected wallet an exchange uses to pay out customer withdrawals.) In plain terms, the thieves did not crack a vault door. They got a trusted insider’s machine to tell the vault to open.
This was not a smash-and-grab, either. TRM found the attacker’s wallet was funded through the mixing service Tornado Cash starting the morning of October 28, and the attack code was tested on other wallets, then rehearsed, before it was used on Binance. On Ethereum, the attacker had prepared 50 signed authorizations in advance so that at least one would still be valid at the moment it fired. That is patience and planning, not luck.
Who is behind it
TRM attributes the attack, with high confidence, to TraderTraitor, a North Korean state-sponsored hacking unit. The FBI named the same group as responsible for the Bybit theft last year. TRM points to familiar fingerprints: small Tornado Cash withdrawals to fund the operation, staging that began well ahead of time, and signatures gathered in advance and used in one burst.
North Korea’s hackers have a long record of going after the people who hold the keys rather than the systems themselves, often through fake job offers and “technical tests” sent to engineers. Nobody has said yet how this particular laptop was compromised, so I will not guess. But it is worth knowing that the target in these attacks is usually a person.
The race to freeze the money
The good news is that a large part of the haul is stuck. Stablecoin issuers Tether, Circle, Ripple and World Liberty Financial froze stolen tokens within minutes to hours, and Arbitrum’s Security Council forced funds out of the attacker’s wallet on its network. TRM counts about $2.7 billion frozen so far.
The bad news is that the attacker saw the freezes coming and raced them, selling stablecoins at a steep discount for Ethereum and borrowing against them on a lending platform. TRM says the attacker still controls more than 420,000 ETH and 18,270 bitcoin, about $2.4 billion that no company can freeze. The bitcoin is already being split into smaller and smaller pieces to make it harder to follow, and past cases suggest bridges, swap services and over-the-counter brokers come next.
Markets felt it right away. FXStreet reports that bitcoin fell below $80,000 and more than $1 billion in leveraged crypto positions were liquidated within 24 hours.
What we do not know
Binance has not published a root cause yet and says a full technical report will follow its investigation. We do not know how the engineer’s laptop was compromised, how long the attacker had access, or why that access could reach so many wallets on so many chains at once. The totals are also still moving: early reports said $2.7 billion, and different firms now put the figure anywhere from $5.9 billion to $6.36 billion depending on how they count and when they priced the coins.
Binance says customer funds are safe and that it will cover the losses. That promise matters, and so far it is only a promise. I would watch for the technical report and for when withdrawals fully resume.
The lesson for the rest of us
When I wrote McAfee’s original Virus Informer newsletter, the threats spread on floppy disks and the advice was simple: be careful what you put in your computer. The tools have changed beyond recognition. The lesson has not. A company with billions of dollars and some of the best security people in the world can still be undone by one trusted device that let the wrong person in.
Your laptop is not guarding $6 billion. But it probably holds your email, your bank login and your password manager, and to a criminal, that makes it the key to everything else.
What you can do
- Expect the scam that follows. After every big breach, fake “Binance support” calls, texts and emails appear, offering refunds, compensation or help “securing” your account. Binance will not ask for your password, your two-factor codes or your recovery phrase. Go to the app or website yourself instead of clicking a link.
- Do not keep more on an exchange than you need. An exchange is a convenient place to trade, not the safest place to store savings. Larger, long-term holdings belong in a wallet you control, with the recovery phrase written on paper and kept somewhere safe.
- Treat unexpected “job tests” and files with suspicion. If a recruiter you have never met sends you code to run, an app to install or a document to open, stop and check who they really are first. This is one of the favorite tricks of the very group blamed for this heist.
- Keep your work and personal machines separate. The laptop you use for your job, your business or your money should not also be the one used for random downloads and games.
- Turn on app-based or hardware-key two-factor login. Use it everywhere it is offered, especially for email and anything financial. Text-message codes are better than nothing, but an authenticator app or a security key is better still.
- Brush up on the basics. Updates, strong passwords, spotting phishing and backing up your files are the everyday defenses; ransomwear.org collects plain-English guides on each.
Billions of dollars moved in twenty minutes because one machine was trusted more than it should have been. Take a minute tonight to think about which of your devices you trust that much, and whether it has earned it.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
