Binance Confirms $6.3 Billion Hack via Compromised Laptop: Largest Crypto Heist in History

By TaazaPulse News Desk · Published: 30 October 2026 · TaazaPulse News Desk

What was a suspected hack with no confirmed loss figure on Thursday night is now, in Binance's own words, a confirmed security breach worth about $6.3 billion — the largest crypto theft in history. In a late-Thursday statement, the world's largest cryptocurrency exchange said its initial investigation points to a compromised laptop belonging to a DevOps engineer, which let an attacker reach a service container and submit unauthorised withdrawal transactions. About $3 billion of the stolen assets have been frozen on-chain, Binance said, and the exchange pledges to cover all losses from its Secure Asset Fund for Users (SAFU) and company funds. Withdrawals and deposits remain suspended, with no resumption time announced — and that, for users in Pakistan and everywhere else, is the part of the story that has not changed at all.

This follow-up replaces the uncertainty that dominated TaazaPulse's first report on Thursday night. Then, Binance would say only that it was investigating a "potential security issue", its founder Changpeng Zhao would say only that it "does look like a hack", and every loss figure in circulation was an outside estimate, ranging from $2 billion to $5.8 billion. Now three things are confirmed by Binance itself: the scale (around $6.3 billion), a suspected entry point (the engineer's laptop), and the amount frozen so far (about $3 billion, up from the $2.54 billion reported on Thursday evening). What is still not confirmed is just as important: Binance has not named the attacker, has not published a full technical post-mortem, and has not said when users will be able to withdraw again. The North Korea attribution circulating in headlines comes from blockchain analysts, not from Binance or from any government — and this article keeps that distinction visible throughout.

The breach itself unfolded with extraordinary speed on Thursday evening, 29 October 2026. On-chain trackers first spotted abnormal outflows from wallets labelled as belonging to Binance at 20:24 UTC — 01:24 PKT on Friday morning in Pakistan. A wallet labelled "Binance 14" on the Etherscan explorer sent out about 167,464 ether, worth roughly $388 million, plus about 1.615 billion USDT and more than 60 other tokens in a single transaction. Within minutes, further Binance wallets moved in the same direction, including roughly 28,006 ether and about $823 million in USDC. The wallets that received the funds went on to hold, at one point, more than $5.7 billion in various cryptocurrencies, according to blockchain analytics firm Arkham — including nearly $1.5 billion in bitcoin, about $900 million in ether, roughly $1.5 billion in USDT and more than $800 million in USDC. Blockchain analytics firm Chainalysis, which tracks stolen funds for exchanges and law enforcement, later updated its own estimate of the amount stolen to roughly $5.9 billion at the time of the theft, and said that as of 8:30 p.m. Eastern Time on Thursday it had confirmed at least $5.912 billion stolen across bitcoin, Ethereum, Tron, Ripple and several layer-2 networks.

Binance's explanation of how that happened is, by its own framing, preliminary. "Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," the exchange said in its statement. "We have found no evidence of any wallet private key leak." A DevOps engineer is the kind of staff member who maintains the systems that move code and services into production; a service container is a packaged unit of software running inside the exchange's infrastructure. If the account is right, the attacker did not need to break Binance's vaults or steal its master keys — compromised access to one engineer's machine was enough to reach a service that could order withdrawals. Binance promises a detailed technical post-mortem once the investigation is complete and the facts are fully verified, and until that document appears, the laptop account should be treated as the exchange's leading hypothesis, not as a proven reconstruction. Independent researchers had earlier proposed a different layer of the mechanism: that the attack used Ethereum's EIP-7702 feature, introduced with the Pectra upgrade in May 2025, which lets an ordinary wallet temporarily hand control to smart-contract code. Binance's statement does not confirm or deny that element, and the two accounts are not mutually exclusive — a compromised laptop could be how an attacker gained the access, and a delegated wallet could be how the funds were swept out. What matters for users is the part Binance did state plainly: it found no evidence that wallet private keys leaked, which, if it holds, means the breach was about abused access rather than exposed keys.

The race to freeze the money is where the numbers have moved most since Thursday night. Binance says about $3 billion has now been frozen on-chain with the help of blockchain partners — up from $2.54 billion on Thursday evening. CoinDesk's summary of the statement puts about $2.3 billion of that frozen total in USDT and USDC stablecoins. The stablecoin issuers themselves announced their shares: Tether's chief executive Paolo Ardoino said his firm froze more than $1.57 billion in USDT linked to the incident, and Circle's co-founder Jeremy Allaire said more than $800 million in USDC was frozen in coordination with law enforcement. Binance co-CEO Yi He added that Ripple helped halt $200 million, and that World Liberty Financial, a crypto company linked to US President Donald Trump's family, worked with custodian BitGo to freeze $27 million in stablecoins and about $2 million worth of its own tokens. Stablecoins can be frozen because they are issued by central companies that can blacklist an address; ether and bitcoin have no such off switch. That is why the frozen $3 billion, welcome as it is, still leaves roughly $3.3 billion unaccounted for — the gap between Binance's $6.3 billion impact figure and what has been located so far — and why the unfrozen portion, mostly ether and bitcoin, will be far harder to recover. Attackers in past thefts have typically tried to swap freezable stablecoins for cryptocurrencies that no issuer can block, using decentralised exchanges and lending platforms that need no central permission; Arkham's data shows the wallets linked to this exploit moving assets through the decentralised exchange Uniswap and borrowing against stolen USDT on the lending platform Aave. Movement alone does not prove the funds are beyond recovery, but every hour they spend moving through such platforms makes tracing and freezing harder.

Then there is the question everyone is asking: who did it? The careful answer is that several respected blockchain-intelligence firms have pointed in the same direction, while no official body has confirmed it. TRM Labs, a blockchain intelligence company, said it had traced the attack to TraderTraitor, an elite North Korean hacking group, citing blockchain transactions and other intelligence sources, and said it had "high confidence" in that assessment. Blockaid's co-founder and chief executive Ido Ben-Natan told CoinDesk that "the tactics and level of sophistication we've seen so far are consistent with the kinds of operations we've seen from DPRK", referring to the Democratic People's Republic of Korea, and called the theft "the biggest crypto hack in history". Prominent independent investigator ZachXBT pointed to the Lazarus Group, the state-linked hacking unit blamed for many large crypto thefts, as the "likely attacker". The Wall Street Journal reported that TRM Labs and Pangolin Intelligence both assessed North Korea's TraderTraitor group as behind the heist. That convergence is significant — these firms rarely agree so quickly — but it is not the same as a finding by Binance, by the United States government, or by any court, and readers should not treat it as one. If the attribution firms are right, the theft would fit a well-documented pattern: North Korean-linked hackers stole $1.5 billion from the Bybit exchange in February 2025, the previous record for a crypto theft, and have been blamed for a long series of exchange and bridge hacks used, according to US and UN assessments, to fund the regime's weapons programmes. At $6.3 billion, the Binance theft would be more than four times the Bybit record — and the Wall Street Journal quoted TRM Labs' global head of policy calling it "the largest bank heist in human history", a phrase that deliberately reaches beyond crypto to all bank robberies on record.

The market reaction was immediate and brutal, and it is the part of the story most visible to ordinary holders who never used Binance at all. Bitcoin fell 4.8 percent to below $77,000 on Thursday evening, according to CoinDesk, after earlier slipping 3.2 percent below $79,000 in Associated Press reporting; ether fell 5.7 percent, Binance's own BNB token fell 8 percent, and the lending token AAVE fell 11 percent as the exploit wallets moved funds through decentralised platforms. Derivatives traders were caught on the wrong side in large numbers: data from Coinglass cited by CryptoPotato put total liquidations during the sell-off at around $1.5 billion, up from the $627.7 million liquidated in a single hour reported on Thursday night. The scale of the theft relative to Binance itself puts the market shock in context. Binance held roughly $144 billion in assets on its platform before the hack, according to DefiLlama data cited by CoinDesk, so about $6.3 billion represents roughly 4 percent of the platform's holdings — a severe blow, but not an existential one for an exchange of Binance's size, which is precisely why its promise to cover all losses is credible in a way a smaller exchange's promise would not be. Binance's SAFU fund, established in 2018 to protect users during security breaches, holds roughly $1 billion in bitcoin, according to CoinDesk — enough to cover part of the loss, but not $6.3 billion on its own. The rest, Binance says, will come from company funds, and the exchange has also promised an updated Proof of Reserves once remediation is complete, so that users can check its holdings for themselves rather than taking its word for it.

For users, the practical position this Friday morning is unchanged from Thursday night in one respect and improved in another. Unchanged: deposits and withdrawals on Binance.com are suspended, Binance Alpha trading is suspended, and no resumption time has been given — the exchange says services will resume after the security issue is resolved, which is a condition, not a date. Improved: the exchange has now put a number on the damage, named a suspected cause, raised the frozen total to about $3 billion, and committed in writing to covering all losses from SAFU and company funds, with co-CEO Yi He repeating on X that the platform would cover "all hacking losses" and founder Changpeng Zhao adding that, as a shareholder, he expects all user funds to be fully covered. Binance.US, the separately operated American platform, says it is not affected and its services are operating normally — a distinction that matters because confused users have in past incidents flooded the wrong platform's support channels. Pakistani users face the same suspension as everyone else on Binance.com, and the same advice applies with extra force here: the trend that brought this story to the top of Pakistan's searches also brings scammers. Binance itself warns users to rely only on its official channels and to ignore unofficial links, messages and requests for account information. Nobody legitimate — not Binance support, not a "recovery agent", not a Telegram group promising to unlock frozen funds — will ask for a password, a seed phrase, or a payment to release money. Anyone who does is running the second scam built on top of the first theft.

Three things will decide how this story ends, and all three are still open. First, Binance's post-mortem: the confirmed loss figure, the full attack path, and whether the laptop account survives scrutiny or is revised — the exchange's own statement uses the word "may", and honest reporting should keep that qualifier attached until the detailed report lands. Second, the frozen-money race: whether the $3 billion frozen grows, whether the roughly $3.3 billion still moving can be traced before it passes through mixers and decentralised platforms that obscure its trail, and whether law enforcement and the stablecoin issuers can convert freezes into actual recovery for users. Third, the resumption of withdrawals — full, phased, or network by network — which is the moment users will be able to test for themselves whether "user funds are safe" was a promise kept or a slogan. Until then, the verified summary is this: Binance has confirmed a roughly $6.3 billion breach, the largest crypto theft on record, apparently entered through a compromised engineer's laptop, with about $3 billion frozen and all losses promised covered — while withdrawals stay suspended, the attacker remains officially unnamed, and the detailed account is still to come. TaazaPulse will update this story as soon as Binance publishes its post-mortem or announces a resumption time.