In short: On the evening of 29 October 2026, crypto assets flowed out of wallets of the trading platform Binance without authorization. Binance puts the estimated total impact at around 6.3 billion US dollars. According to Binance's initial investigation, the attack began with the compromised laptop of a DevOps engineer. As of 30 October 2026: how the laptop was infected has not been published. For companies, the case shows that a single employee device can be enough.
What happened
Binance is one of the largest trading platforms for cryptocurrencies. From 20:05 UTC on 29 October 2026, which is 21:05 German time, there were unauthorized outflows from Binance wallets. A wallet is a digital account for crypto assets. According to the analytics firm TRM Labs, most of it moved within about 20 minutes across ten different blockchains, meaning ten separate networks on which crypto assets are recorded (The Next Web).
Binance puts the “total estimated impact” at around 6.3 billion US dollars. That is more than four times the theft at Bybit in February 2025, which amounted to 1.5 billion US dollars. Around 3 billion US dollars have been frozen on-chain, meaning blocked directly on the blockchain and unusable for the attackers for now. Deposits and withdrawals were suspended for a time. Binance says it will cover all customer losses (Euronews, 30 October 2026).
The headlines: Axios on 29 October 2026 “Binance halts trading after biggest-ever crypto hack”, CoinDesk on 29 October 2026 “Binance loses over $6 billion in the largest crypto hack to date” and Forbes on 30 October 2026 “Binance’s $6.3 Billion Hack Started With One Engineer’s Laptop”.
How the attackers got in
According to Binance's initial investigation, the starting point was “a compromised laptop belonging to a 'DevOps engineer'”, an employee who looks after servers and software operations. Through this laptop the attackers gained access to a service container. A container is a self-contained software package in which a single service runs on the server. From there they triggered unauthorized withdrawals. According to Binance, there is no indication that private wallet keys were leaked (Euronews).
Binance later reported having “uncovered additional points of breach” and said the incident “stems from multiple factors” (The Next Web). How the laptop was infected has not been published by Binance so far (as of 30 October 2026). Whether an email, an attachment, a website or something else was the way in remains open.
Who is said to be behind it
TRM Labs calls the case “the largest crypto theft on record”. TRM Labs attributes it “with high confidence” to the North Korean group TraderTraitor. The analytics firm Chainalysis agrees with this assessment. Binance and authorities have not confirmed the attribution so far (The Next Web, CNN, as of 30 October 2026).
What the Binance founder advises
As early as 28 October 2026, the founder of Binance warned on X, in essence: do not click links in emails and do not download attachments, not even from people you trust, because their computer can be infected without them noticing. In a reply he wrote, in essence, that the Binance hack was more complex, but that almost all hacks involve a compromised device somewhere.
What the case shows for companies
Most companies do not hold crypto assets. The pattern still applies to every company: a single employee device with far-reaching rights can be the way into core systems. At Binance it was access to servers and withdrawals. At a mid-sized company it can be access to accounting, online banking, the customer portal or the cloud. The more rights a device has, the greater the possible damage.
What companies can do
- Check links and attachments. Emails from known senders can also come from an infected computer. Open unexpected attachments and links only once it is clear they are genuine. Regular training and phishing simulations, meaning realistic practice emails, turn this into a habit.
- Call back via a second channel. Confirm requests for payments, credentials or software installations via a known phone number, not via the contact details in the message itself.
- Harden devices. Install updates promptly, encrypt disks, allow only approved software and use protection software that reports suspicious behaviour on the device (EDR, endpoint detection and response).
- Separate rights. Use admin access only on dedicated, specially protected devices, not on the laptop used for email and web. Critical steps such as large payments or changes to servers need a second approval and a login with a second factor.
- Monitor. Unusual logins, access at unusual times and large data outflows are only noticed if someone analyses the logs. At Binance most of it happened within about 20 minutes. Those who detect early can act early.
How GermanAI Defense helps
Our Cybersecurity Services address exactly these points: phishing simulation and awareness training for your employees, a review of devices and rights, and SOC monitoring around the clock, with service and response times as agreed in the contract. You receive a short overview of where a single device in your company has too much access today and what you can do about it.
→ More about our Cybersecurity Services: View Cybersecurity Services
Our short video on the case: Watch the reel on Instagram · More current cases: PHP2Shell and Node2Shell
Sources: The Next Web citing TRM Labs, 30 Oct 2026 · Euronews, 30 Oct 2026 · CNN, 30 Oct 2026 · Axios, 29 Oct 2026 · CoinDesk, 29 Oct 2026 · Forbes, 30 Oct 2026