--- title: Binance’s $6.3bn heist: how one laptop opened the door... description: Attackers stole an estimated $6.3 billion from Binance on 29 October, the largest crypto theft on record, about four times the $1.5 billion Bybit hack in... canonical: https://daily.dev/posts/binance-s-6-3bn-heist-how-one-laptop-opened-the-door-to-the-biggest-crypto-theft-in-history-nldowtao0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Binance’s $6.3bn heist: how one laptop opened the door to the biggest crypto theft in history | daily.dev og:description: Attackers stole an estimated $6.3 billion from Binance on 29 October, the largest crypto theft on record, about four times the $1.5 billion Bybit hack in... og:url: https://daily.dev/posts/binance-s-6-3bn-heist-how-one-laptop-opened-the-door-to-the-biggest-crypto-theft-in-history-nldowtao0 og:image: https://api.daily.dev/og/posts/NlDOWTAO0.png og:image:alt: Binance’s $6.3bn heist: how one laptop opened the door to the biggest crypto theft in history og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Binance’s $6.3bn heist: how one laptop opened the door to the biggest crypto theft in history **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 15 min read · 0 upvotes · 0 comments ## Summary Attackers stole an estimated $6.3 billion from Binance on 29 October, the largest crypto theft on record, about four times the $1.5 billion Bybit hack in February 2025. Funds left Binance wallets across ten blockchains starting around 20:05 UTC, with most of the money gone within 20 minutes. Binance says a compromised DevOps engineer's laptop gave an attacker access to a service container that could submit withdrawals, and found no evidence of a private key leak. On Ethereum, the attacker used EIP-7702 authorizations to redirect a hot wallet to a sweeper contract. About $3 billion was frozen within hours, including over $2.5 billion by Tether and Circle, while TRM Labs attributes the attack with high confidence to the North Korean group TraderTraitor. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers steal $6.3 billion from Binance in October 2026? Binance's preliminary findings point to a compromised DevOps engineer's laptop that gave an attacker access to a service container capable of submitting withdrawals. No wallet private keys were reportedly leaked. On Ethereum, the attacker used EIP-7702 authorizations to make a Binance hot wallet execute a sweeper contract, while other chains saw ordinary signed transfers, moving most funds within about 20 minutes. _Teams building transaction authorization systems can track incidents like this one on daily.dev to harden their own controls._ ### How much of the stolen Binance crypto funds have been recovered or frozen? Around $3 billion was frozen within hours with help from stablecoin issuers, partners, and law enforcement, with Tether and Circle alone freezing more than $2.5 billion in USDT and USDC. TRM Labs estimates the attacker still controls over $2.4 billion in ether and bitcoin, which has started moving through decentralized exchanges and lending protocols including Uniswap, Aave, and JustLend. _Anyone tracking crypto security incidents and fund recovery can follow developments like this on daily.dev._ ### Who is believed to be responsible for the Binance hack and the Bybit hack? TRM Labs attributed the Binance theft with high confidence to TraderTraitor, a North Korean state-backed hacking unit linked to the Lazarus Group, the same group blamed for the $1.5 billion Bybit theft in February 2025. Independent investigator ZachXBT also named Lazarus as the likely attacker, and Bitget's September loss of about $388 million was blamed on North Korea as well. _Security teams evaluating nation-state threats to crypto infrastructure can follow this reporting on daily.dev._ --- Tags: [#cyber](https://daily.dev/tags/cyber), [#crypto](https://daily.dev/tags/crypto) [View this post on daily.dev](https://daily.dev/posts/binance-s-6-3bn-heist-how-one-laptop-opened-the-door-to-the-biggest-crypto-theft-in-history-nldowtao0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Binance’s $6.3bn heist: how one laptop opened the door to the biggest crypto theft in history","url":"https://daily.dev/posts/binance-s-6-3bn-heist-how-one-laptop-opened-the-door-to-the-biggest-crypto-theft-in-history-nldowtao0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/binance-s-6-3bn-heist-how-one-laptop-opened-the-door-to-the-biggest-crypto-theft-in-history-nldowtao0"},"datePublished":"2026-10-30T15:36:08.003Z","dateModified":"2026-10-30T16:33:24.788Z","description":"Attackers stole an estimated $6.3 billion from Binance on 29 October, the largest crypto theft on record, about four times the $1.5 billion Bybit hack in...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f9e392f13ec43521266d59e955568e82?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/f9e392f13ec43521266d59e955568e82?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/binance-s-6-3bn-heist-how-one-laptop-opened-the-door-to-the-biggest-crypto-theft-in-history-nldowtao0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,crypto","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"Binance’s $6.3bn heist: how one laptop opened the door to the biggest crypto theft in history"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/binance-s-6-3bn-heist-how-one-laptop-opened-the-door-to-the-biggest-crypto-theft-in-history-nldowtao0#faq","mainEntity":[{"@type":"Question","name":"How did attackers steal $6.3 billion from Binance in October 2026?","acceptedAnswer":{"@type":"Answer","text":"Binance's preliminary findings point to a compromised DevOps engineer's laptop that gave an attacker access to a service container capable of submitting withdrawals. No wallet private keys were reportedly leaked. On Ethereum, the attacker used EIP-7702 authorizations to make a Binance hot wallet execute a sweeper contract, while other chains saw ordinary signed transfers, moving most funds within about 20 minutes. Teams building transaction authorization systems can track incidents like this one on daily.dev to harden their own controls."}},{"@type":"Question","name":"How much of the stolen Binance crypto funds have been recovered or frozen?","acceptedAnswer":{"@type":"Answer","text":"Around $3 billion was frozen within hours with help from stablecoin issuers, partners, and law enforcement, with Tether and Circle alone freezing more than $2.5 billion in USDT and USDC. TRM Labs estimates the attacker still controls over $2.4 billion in ether and bitcoin, which has started moving through decentralized exchanges and lending protocols including Uniswap, Aave, and JustLend. Anyone tracking crypto security incidents and fund recovery can follow developments like this on daily.dev."}},{"@type":"Question","name":"Who is believed to be responsible for the Binance hack and the Bybit hack?","acceptedAnswer":{"@type":"Answer","text":"TRM Labs attributed the Binance theft with high confidence to TraderTraitor, a North Korean state-backed hacking unit linked to the Lazarus Group, the same group blamed for the $1.5 billion Bybit theft in February 2025. Independent investigator ZachXBT also named Lazarus as the likely attacker, and Bitget's September loss of about $388 million was blamed on North Korea as well. Security teams evaluating nation-state threats to crypto infrastructure can follow this reporting on daily.dev."}}]} ```