# Binance's $6.3 billion security incident: what we know and what companies should learn > What we know about Binance's $6.3 billion security incident: a compromised DevOps laptop, signing infrastructure, frozen assets and lessons for every company. - URL: https://twinlikee.com/en/blog/binance-6-3-billion-security-incident/ - Published: 2026-10-30 - Category: Cybersecurity - Tags: Binance, incident response, endpoint security, DevOps security, supply chain - Publisher: Twinlike (https://twinlikee.com) On the evening of 29 October 2026, large amounts of crypto left wallets linked to Binance, the world's largest crypto exchange. Binance confirmed a security incident, paused deposits and withdrawals, and estimated the total impact at about **$6.3 billion**. If that figure holds, it will be the largest crypto theft on record. In this article we bring together what has been made public, separate what is confirmed from what is still unknown, and set out the lessons for companies outside crypto. > This article is based on information published as of 30 October 2026. Binance has not yet released its detailed technical report; figures and findings may change. ## What happened: a short timeline - **29 October, evening (UTC):** On-chain data showed unusual outflows from Binance-linked wallets. Binance founder Changpeng Zhao confirmed the attack. - **The same night:** Tether and Circle said they had frozen stablecoins linked to the attack. Binance temporarily suspended deposits and withdrawals on several networks. - **30 October:** Binance shared its first findings and said a detailed technical report would follow. ## What Binance has said According to Binance's first statement, the incident may have started with **a compromised DevOps engineer's laptop**. Through that laptop the attacker reached a **service container** in the internal infrastructure and submitted **unauthorized withdrawal transactions**. Other key points from the statement: - The exchange says it has found **no evidence of a wallet private key leak**. - The affected address authorization has been revoked. - The estimated total impact is about $6.3 billion. Around **$3 billion** of it has been frozen on-chain with the help of partners across the ecosystem. - User losses will be covered by Binance's **SAFU** emergency fund and company funds. Binance says user funds are safe. According to press reports, Tether froze about $1.57 billion and Circle more than $800 million. Other organizations, including Ripple and World Liberty, said they had frozen smaller amounts. ## How the attack may have worked Blockchain security firm **Blockaid** published an analysis based on on-chain data. Binance has not confirmed all of it, but the picture is this: - At around 20:20 UTC on 29 October, the attacker sent **50 separate authorizations** in a single transaction. All of them targeted a Binance hot wallet that was processing withdrawals. - Because the wallet was constantly sending transactions, its next transaction number could not be predicted. So the attacker tried 50 consecutive numbers at once, and one of them matched. - The matching authorization handed control of the wallet to a contract the attacker had prepared in advance. Within minutes, ETH and stablecoins were drained through that contract. Blockaid's assessment points the same way as Binance's statement: **misuse of the signing infrastructure** rather than a stolen key. In other words, instead of extracting the key, the attacker may have used the system that signs transactions to approve their own. The pattern resembles the roughly $1.5 billion **Bybit** attack of February 2025. There too, attackers compromised a developer's system and got signers to approve a transaction that looked legitimate. The FBI attributed the Bybit attack to North Korea-linked groups. ## What is still unknown - **The final loss:** $6.3 billion is Binance's estimate. Some sources put the amount that left the wallets between $5.5 and $5.9 billion. The exact figure may take a few days to settle. - **How the laptop was compromised:** Malware, phishing or a stolen session? This has not been disclosed. - **Who the attackers are:** TRM and other firms point to North Korea-linked groups. This has not been officially confirmed. - **How much can be recovered:** The fate of the funds that were not frozen is unclear. In the markets, Bitcoin and Ethereum fell by about 3%, with Bitcoin dropping to around $76,000. But the wider markets were also selling off at the time, so it is unclear how much of the fall was caused by this incident. ## Five lessons for companies The most important part of this incident is that the attack did not start by breaking a crypto wallet; it started with **a privileged employee's laptop**. That makes it relevant to every organization, crypto or not. ### 1. Privileged staff devices are the most valuable target Laptops with access to servers, cloud accounts and production are, to an attacker, the keys to the vault. On these devices: - Run endpoint detection and response (EDR) software. - Protect sign-ins with phishing-resistant **hardware keys** (FIDO2). - Keep production access off the machine used for everyday work; where possible, use devices dedicated to that job. ### 2. "No key was leaked" does not mean you are safe In both the Binance and Bybit cases the key appears not to have been stolen, yet the signing system approved the attacker's transaction. Every action that moves money, data or permissions needs **a control layer independent of the signing or approval step**: amount limits, allow-listed destinations and a second approval through a different channel for large transactions. ### 3. One laptop should not reach everything That a laptop could reach a container able to submit withdrawals shows why network segmentation and least privilege matter. Replace long-lived access keys with **short-lived, task-specific permissions**, and open access to critical systems only when needed, with a record of who did what. ### 4. See and stop unusual activity within minutes One reason Binance could limit its losses was that it could halt transactions quickly and freeze assets with its partners. Every company needs **alerts and an emergency stop** for unusual data exports, mass deletions or unexpected payments, and should rehearse in advance who pulls the switch and how. ### 5. Forgotten secrets speed up the attacker Once a laptop is compromised, the attacker first uses whatever passwords, access keys and configuration files they find there. Secrets forgotten on file shares and team laptops make every step after the first one easier. With [Twinlike Digger](https://twinlikee.com/en/digger/) you can find passwords, keys and personal data on your file shares before attackers do. ## A short warning for users Major security incidents are often followed by fake "compensation", "account verification" and "refund" messages. If you have a Binance account, trust only announcements from official channels. Do not sign in through links in e-mails or messages, and never share verification codes with anyone. ## Conclusion The Binance incident shows again that the largest losses do not always begin with sophisticated cryptography being broken; they can begin with **a single privileged laptop**. The detailed technical report will make the picture clearer. What companies can do today is already clear: protect privileged users' devices, stop internal systems from trusting each other blindly, and be able to spot and stop unusual activity within minutes. If you would like to review your own infrastructure with this in mind, see our [cybersecurity](https://twinlikee.com/en/services/cybersecurity/) and [secure software & DevSecOps](https://twinlikee.com/en/services/secure-software-devsecops/) services, or check your website with our [free security scan](https://twinlikee.com/en/free-security-scan/). For any questions, [get in touch](https://twinlikee.com/en/contact/). **Sources:** [Fortune](https://fortune.com/2026/10/30/what-we-know-about-binance-hack-biggest-crypto-heist/), [Cointelegraph](https://cointelegraph.com/news/binance-hack-may-involve-private-key-misuse-not-theft-blockaid-ceo), [crypto.news (Blockaid analysis)](https://crypto.news/binance-hack-eip-7702-wallet-attack/), [CoinDesk](https://www.coindesk.com/business/2026/10/29/potential-multi-billion-binance-hack-hitting-crypto-markets), [IBTimes UK](https://www.ibtimes.co.uk/binance-suspends-withdrawals-after-security-incident-1828947), [Bitcoin Magazine](https://bitcoinmagazine.com/news/bitcoin-price-slides-near-76000-binance) ## FAQ ### Were customers' private keys stolen at Binance? According to Binance's first statement, no. The exchange says it has found no evidence of a wallet private key leak. Early findings point to a compromised DevOps engineer's laptop being used to reach internal systems and submit unauthorized withdrawals. The detailed technical report has not been published yet. ### Who is behind the attack? Nothing has been officially confirmed. Security firms such as TRM point to North Korea-linked groups, but Binance has not named the attackers and says it is working with law enforcement. ### We are not a crypto company. Why does this matter to us? The attack did not start by breaking a wallet; it started with a privileged employee's laptop. Every company has people with access to servers, cloud accounts or payment systems. How those devices are protected, how much internal systems trust each other and how quickly unusual activity is spotted are the same questions in any industry.