Binance’s $6.3B “Laptop Bug” Becomes Crypto’s Biggest Heist—And a $3B Freeze

Binance said an investigation into the October 29, 2026 security incident that drained an estimated $6.3 billion from exchange-linked wallets was “complex,” uncovering “additional points of breach” beyond an initially suspected compromised DevOps engineer’s laptop. Co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action,” while Binance maintained: “We have found no evidence of any wallet private key leak.”

The exchange initially estimated total impact at around $6.3 billion and said about $3 billion in affected assets had been frozen onchain with assistance from blockchain partners. Binance set aside more than $6.34 billion in company funds to cover losses, including $5 billion already held in the same tokens affected by the incident. The company said it would cover all losses through its SAFU emergency reserve and company funds and publish an updated Proof of Reserves after remediation is complete.

On-chain estimates of the initial outflows ranged from $5.57 billion to $5.643 billion, with Arkham later recording $6.01 billion taken from Binance hot wallets on nine blockchains between 4:10 p.m. and 7:05 p.m. ET on October 29. Earlier chain-level tallies included $3.528 billion from Ethereum, $1.449 billion from Bitcoin and $628 million from Tron, while the wider attack reportedly spanned 10 blockchains. At 20:24 UTC, Binance 14 sent 167,464 ETH and 63 tokens, including 1.615 billion USDT, to a newly created address; Binance 16 transferred another 28,005 ETH to the same address 24 seconds later. The receiving address forwarded 195,460 ETH, worth roughly $450 million, to another fresh address within 15 minutes.

Tether and Circle froze large portions of the transferred stablecoins during the early response, with Tether and Circle amounts initially put at approximately $971 million and $823 million, respectively. Binance later listed frozen assets including Tether USDt (USDT), USDC (USDC), Ripple USD (RLUSD), World Liberty Financial USD (USD1), StraitsX USD (XUSD), USDT0 (USDT0), Wrapped Beacon ETH (WBETH), Tether Gold (XAUT), Pax Gold (PAXG), Pax Dollar (USDP) and Arbitrum (ARB). The available totals for frozen assets varied by assessment, including approximately $1.8 billion, $2.39 billion, $2.80 billion and a verified total of $3 billion.

Blockchain security firm Blockaid said the operation appeared to involve key misuse and manipulation of signing infrastructure rather than a private-key leak. Its analysis found that the attacker bundled 50 EIP-7702 authorizations into one transaction targeting Binance 14 and delegated the account to an unverified sweeper contract. Blockaid co-founder and CEO Ido Ben-Natan said the feature was “a way to do this in one sweep and maybe a way to bypass some sort of checks they may have,” while Ivo Georgiev, co-founder and CEO of Ambire, said the attackers could already authorize the transactions and warned that malicious EIP-7702 delegations were “very very poorly understood.”

TRM Labs attributed the attack to North Korea’s TraderTraitor with “high confidence,” while Chainalysis co-founder and CEO Jonathan Levin assessed that the DPRK group was responsible. On-chain investigator ZachXBT said funds from the Binance incident and the earlier Bitget exploit were commingled at the same address after passing through THORChain. The Binance incident would dwarf the $387 million Bitget hack and the $1.5 billion Bybit hack from February 2025.

Binance paused withdrawals, revoked the affected address authorization and worked with law enforcement and blockchain intelligence firms to trace and recover funds. Deposits were later described as operating normally, while withdrawals remained suspended during a security revamp of the withdrawal service and its related addresses. Co-CEO Yi He expected withdrawals to reopen within 48 hours, and Binance said outflows stopped after the exchange paused them. Binance founder Changpeng Zhao also weighed in: “It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).”