How much was stolen in the Binance hack?

Binance said a security incident on 29 October 2026 affected about $6.3 billion in client assets, with around $3 billion frozen on-chain. CNBC called it the largest crypto theft on record. Earlier tracker estimates ranged from about $2.8 billion on Ethereum alone to $5.8 billion, depending on how many chains they counted.

How did the Binance hackers get in?

Binance’s first statement named a compromised laptop belonging to a DevOps engineer as the likely entry point, with the attacker reaching a service container and submitting unauthorised withdrawals. Binance said it found no evidence of a wallet private key leak. Co-CEO Richard Teng later said the attack was more complex than the misuse of one engineer’s permissions. The full post-mortem had not been published as of 31 October 2026.

Did freezing USDT and USDC stop the Binance hackers?

In part. Tether froze more than $1.5 billion in USDT and Circle more than $800 million in USDC within hours. Ether cannot be frozen by an issuer, and by 31 October Elliptic counted $6.43 billion taken and $2.85 billion verified as frozen, with most of the rest held as ether. Before the freeze, the attacker also deposited about $60 million of USDT on Aave and borrowed about 19,800 ETH against it.

Field Notes / Breach

One engineer’s laptop, $6.3 billion gone: what the Binance theft says about the access your own admins carry.

Q: Who was behind the Binance hack?

TRM Labs and Chainalysis attributed it to TraderTraitor, a North Korean hacking unit the FBI also blamed for the roughly $1.5 billion Bybit theft in 2025. Binance had not named a perpetrator as of 31 October 2026. The FBI said it was coordinating with public and private partners.

On 29 October 2026 attackers emptied Binance hot wallets in the largest crypto theft on record. Binance points at a compromised DevOps laptop, and it says no private key leaked. Tether and Circle froze about $2.3 billion within hours. The ether could not be frozen. Here is the sequence, what the freezes did and did not save, and the five questions to ask about the laptops that can reach your production systems.

Author: Red Team Partners
Read: 6 MIN READ
Filed: 31 Oct 2026

01 What happened

he attacker prepared a day early. On 28 October an address received 0.1 ETH from Tornado Cash. On the afternoon of the 29th the same address deployed its own contract Cryptoticker, Etherscan times .

At 20:20:59 UTC, a Binance Ethereum hot wallet signed a delegation to that contract. Ethereum has allowed this since May 2025 (EIP-7702): a wallet hands its moves to a contract, and exchanges use it to batch transfers. Analysts counted 50 delegations in one transaction, which makes a fast revoke harder. At 20:24:23 one transaction swept 167,464 ETH and 1.615 billion USDT. USDC followed at 20:41. A public analyst flagged the theft at 20:32, eleven minutes after the delegation.

A delegation only works when the wallet’s own signing system approves it. Binance says the key did not leak. So the attacker got the signing system to approve something it should never have approved. Binance’s account of how: a DevOps laptop, then a service container, then unauthorised withdrawal requests CNBC . Co-CEO Richard Teng has since said the chain was more complex than one engineer’s permissions. The post-mortem is still to come.

TRM Labs and Chainalysis attribute the attack to TraderTraitor, the North Korean unit the FBI blamed for the roughly $1.5 billion Bybit theft in 2025. Binance has named no one.

02 What the freeze saved

$2.3bn

Stablecoins frozen within hours: more than $1.5 billion in USDT by Tether and more than $800 million in USDC by Circle.

Tether and Circle CEOs, via CNBC, 29 Oct 2026

Tether and Circle can freeze their own tokens at any address, and they did it fast. Ether and Bitcoin have no issuer to call. By 31 October Elliptic counted $6.43 billion taken across 11 chains and $2.85 billion verified as frozen. The rest, most of it ether, stayed with the attacker. Update, 2 November: we weigh the claims that Binance staged the theft in a follow-up note.

A post doing the rounds on social media says the attacker beat the freeze by parking stolen USDT on Aave and borrowing ETH. That happened, at a smaller scale than the post implies: about $60 million of USDT in, about 19,800 ETH (around $44 million) out, before Aave froze the markets Trending Topics . The large escape was the ether taken straight from the wallet.

03 The question for your team

You probably do not hold billions in a hot wallet. You do have engineers whose laptops reach production, a CI pipeline that deploys without a second person, and service accounts that can move data or money. Attackers who cannot break the vault go after the person who holds a key to the building. The Bybit theft in 2025 began the same way, on a compromised developer machine at its wallet provider.

Ask this week

Which engineer and admin laptops can reach production, and could you list them today?
Can one person’s session push a change to the systems that move money or customer data, with no second approval?
Do the service containers that request payments, withdrawals or exports accept requests from anywhere inside the network?
Would anyone notice an unusual high-value action within minutes, at 20:30 on a weekday evening?
If you had to cut every engineer’s access in the next hour, does a written procedure exist, and has anyone run it?

A test answers those five questions faster than a meeting does. We take one compromised engineer’s machine as the starting point and show you how far it gets before anything stops it. Enterprise-grade. Not enterprise-priced.

References

Sources

CNBC. “$6.3 billion Binance hack is largest crypto theft on record.” 29–30 October 2026. cnbc.com
Cryptoticker. “Binance Hack: $2.8B Drained From Hot Wallet via EIP-7702.” October 2026. cryptoticker.io
The Block. “Binance investigating hack as suspicious outflows reach up to $5.8 billion.” 29 October 2026. theblock.co
Trending Topics. “Binance Hackers Flee Into DeFi as Tether and Circle Freeze Billions.” October 2026. trendingtopics.eu