Binance blamed one laptop. The evidence points at the system that signs its transactions.
- Why Binance's laptop story changed three times in 12 hours.
- How one transaction with 50 signed permission slips handed a $2.5 billion wallet to the attacker.
- What the viral Codex screenshot really shows.
What happened in the Binance hack
On October 29, 2026, attackers moved about $6.3 billion out of Binance's hot wallets, the online wallets an exchange uses to pay out withdrawals. It is the biggest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.
Most of it left in about 20 minutes, across ten blockchains. About $3 billion was frozen, most of it by stablecoin issuers. Binance says customer funds sit mostly in cold storage, only its own hot wallets were hit, and it will cover the loss with $6.34 billion of company money. On October 31 it said 90% of the stolen assets were already replaced, and withdrawals began reopening in phases on November 1.
On October 31, the FBI said North Korea was responsible and named TraderTraitor, the state hacking group that blockchain analysts at TRM Labs and Chainalysis had already blamed. Binance's technical post-mortem is still to come. This post sticks to what is confirmed as of November 1.
Was it really one laptop?
Nobody has published how the laptop was compromised. Not Binance, and not any of the firms tracking the stolen funds. Binance's own account changed during the day (all times UTC, October 30):
- 02:25. The incident “may involve a compromised DevOps engineer's laptop,” which gave the attacker a service container that submitted withdrawals.
- 07:37. Co-CEO Richard Teng: the attacker did not simply use one engineer's permissions, and it was not a “one-click” action.
- 08:47. The investigation “uncovered additional points of breach.”
- 14:32. Teng on video: “This was not carried out by one person.” The attacker's tools self-destructed and wiped traces as they went.
Teng also said the hot wallet takeover “did not pass through our normal approval controls.” He called EIP-7702, the feature used for it, a multi-signature protocol. It is not: it is an Ethereum feature, live since May 2025, that lets an ordinary wallet run smart-contract code.
Timeline of the Binance hack
Preparation took about 36 hours. The theft took about 20 minutes. All times UTC. Click a bar to jump to a stage.
- Stage 1 · StagingOct 28 – Oct 29, 20:05
The attacker gets inside, funds a wallet and rehearses.
A way in that nobody has explained
Binance's first finding: a DevOps engineer's laptop was compromised, and from it the attacker reached a service container that could submit withdrawals.
How the laptop was hit, Binance has not said. It later found more points of breach, and said the attacker's tools destroyed themselves and their traces as they went.
Gas money from a mixer
A fresh wallet, the attacker's control desk, received three small withdrawals from Tornado Cash, a mixer that hides where money comes from. On-chain, it looked like nothing.
A $6 rehearsal
The attacker tested its code on two of its own wallets, then rehearsed the final version on a third. Each test moved $2 to $6, and the test money went back to the control wallet.
The sweeper goes live
A small contract, the sweeper, was published on Ethereum. Only the attacker's wallet could use it, and it could empty any account that handed it control. Four hours later, it was used.
- Stage 2 · DrainOct 29, 20:05 – 20:45
Binance's own systems sign the attacker's transactions on ten blockchains.
Hot wallets start to empty
Five Binance wallets on the XRP Ledger sent 233 million XRP to one address. Solana and Optimism followed. At 20:20 a Bitcoin hot wallet sent 18,270 BTC, and a Tron wallet sent 612.7 million USDT.
These were ordinary transfers, signed with valid Binance signatures.
50 signed slips for one lock
Binance 14, one of Binance's largest Ethereum hot wallets, numbers its transactions in strict order. The attacker sent one transaction holding 50 authorizations, one for each of the next 50 numbers, so one would match wherever the busy wallet's count stood.
One matched. From that moment Binance 14 ran the sweeper's code. Each authorization carried Binance 14's own signature, and the delegation never went through Binance's normal approval controls.
$2.5 billion in one sweep
3.5 minutes later the sweeper emptied Binance 14: 167,464 ETH, 1.6 billion USDT and about 60 other tokens, around $2.5 billion, to an address with no history. It left 1 ETH, so the wallet kept working.
24 seconds later Binance 16 sent 28,005 ETH with ordinary signatures. At 20:41 the attacker used Binance 14's new powers to pull 823 million USDC from another Binance account that Binance 14 controlled.
- Stage 3 · RaceOct 29, 21:00 – Oct 30
Issuers freeze what they can. The attacker swaps into what they cannot.
Stablecoins frozen within the hour
Tether froze 971 million USDT at 21:01. Circle froze 823 million USDC three minutes later. Ripple and World Liberty Financial followed. By 23:35 Binance counted $2.54 billion frozen.
Bitcoin and ether have no issuer that can freeze them. So the attacker swapped into them.
The door stays open for hours
At 21:44 the attacker swept Binance 14 again: 200 million USDT that had arrived after the first sweep. At 22:00 the delegation was still in place.
Binance paused withdrawals that evening and cleared the delegation at 00:10 on October 30, almost four hours after the takeover.
Sell at a loss, borrow, go in circles
About 325 million USDT was sold for ETH at more than 10% below market. 60 million USDT went into the lending app Aave as collateral to borrow ETH. Chainalysis watched thousands of transactions loop funds back to earlier addresses, a pattern it called never seen before.
About $2.4 billion in ETH and BTC is now out of reach.
How attackers usually get into a developer's laptop
Binance has not said how its engineer's laptop was hit. North Korean groups have used the same few tricks for years, and the chain is always similar: a person, then their laptop, then live sessions and cloud access, then the system that moves money.
- 2024DMM Bitcoin, $308M
A fake LinkedIn recruiter sent an engineer at wallet vendor Ginco a “pre-employment test.” The script opened the door. Stolen session cookies later let the attackers alter a transaction. (FBI)
- 2024Radiant Capital, $50M
A developer got a zipped “PDF” on Telegram from someone posing as a former contractor. It was a backdoor for macOS. (Mandiant)
- 2025Bybit, $1.5B
A developer at wallet provider Safe ran a malicious Docker project. The attackers hijacked their live AWS sessions, got past MFA and changed what Bybit's signers saw. (Safe, Mandiant)
- 2025CoinDCX, $44M
An engineer took an online side job and later did it on the work laptop. Malware came with it. (Bengaluru police)
The Codex screenshot and other rumors
Within hours, X filled with explanations. Here is what four of them actually show.
- The claim
A screenshot shows OpenAI's Codex with GPT-5.5 stealing $57.4 million.
What we foundIt is the abstract of CyberChainBench, a June 2026 research paper. AI agents attacked copies of 200 old DeFi hacks on test chains, and no real money moved. Binance was not hit through a smart-contract bug.
- The claim
A video shows the hacked Binance laptop: a multisig dropping from 3 of 5 signers to 1 of 5.
What we foundThe small print at the bottom reads “illustrative replay · not official exchange data.” None of its numbers appear in any report.
- The claim
An AI coding tool leaked Binance's keys.
What we foundNo evidence. Binance found no sign that any private key leaked, and outside analysts think the keys never left Binance's systems.
- The claim
One engineer did it.
What we foundBinance says the opposite: “not carried out by one person,” and it has not blamed any individual.
Was AI behind the Binance hack?
No source links AI to this attack. Three things do stand out. The speed: ten blockchains in about 20 minutes. The laundering: thousands of transactions sending funds in circles, which Chainalysis says suggests automation. And attack tools that destroyed themselves as they went.
That is heavy automation. Whether AI wrote any of it, nobody has said.
How to protect yourself
The theft took 20 minutes. The setup took at least 36 hours, and the decisive steps happened on machines a company owns and can watch: a laptop, a service container, a signing service.
Binance's approval rules checked withdrawals. The takeover came through a request they did not check. Rules cover the paths you already know. A baseline for each asset flags the new one: a signing service asked for signatures nobody scheduled, a container talking to the signer for the first time, a host deleting its own tools. Runtime monitoring sees that while the attacker is still setting up.
Start with five signals:
- Signing requests that do not match the service's normal volume, callers or timing.
- New processes and outbound connections in containers that can reach signers or keys.
- Sessions and tokens used from a new device or place.
- Mass file deletion or log wiping on any host.
- Permission and delegation changes on hot wallets, not just withdrawals.
Binance hack: FAQ
What happened in the Binance hack?
On October 29, 2026, attackers moved about $6.3 billion out of Binance's hot wallets across ten blockchains, most of it in about 20 minutes. It is the biggest crypto theft on record. About $3 billion was frozen. Binance says customer funds were not touched and it will cover the loss with company money.
How did the Binance hack happen?
Binance first said a DevOps engineer's laptop was compromised, giving the attacker a service container that submitted withdrawals. It later found more points of breach. Outside analysts say the attacker got Binance's own signing system to sign its transactions. On Ethereum, one transaction with 50 pre-signed authorizations handed a hot wallet to the attacker's contract. Binance's full post-mortem is still to come.
How was the Binance laptop compromised?
Nobody has said. Binance has not published it, and no firm tracking the funds has either. North Korean groups have broken into developer laptops before with fake job tests, fake side gigs, booby-trapped files and malicious code projects.
Who hacked Binance?
The FBI says North Korea. On October 31 it named TraderTraitor, the same state hacking group it blamed for the Bybit hack. TRM Labs and Chainalysis had reached the same view with high confidence, and Chainalysis saw Binance funds mix with funds from an earlier North Korean theft.
Were Binance users' funds affected?
Binance says no. Only its own hot wallets were hit, and most user assets sit in cold storage. It set aside $6.34 billion of company funds, and on October 31 said 90% of the stolen assets were already replaced, with its ten largest tokens fully backed. Withdrawals reopened in phases on November 1, starting with Bitcoin. A Proof of Reserves report is promised.
What is EIP-7702?
An Ethereum feature, live since May 2025, that lets an ordinary wallet hand control of its actions to smart-contract code. It needs the wallet's own signature. In the Binance hack, one signed authorization turned a hot wallet into the attacker's tool. Blockaid's CEO thinks it sped up the theft but did not cause it.
Was AI used in the Binance hack?
No source says so. The viral Codex screenshot comes from an unrelated research paper. What is confirmed is heavy automation: ten blockchains in about 20 minutes, thousands of laundering transactions, and attack tools that destroyed themselves.
Read next on the Cloudaware blog
- The Hugging Face incident: how OpenAI's security-testing agents broke in
- Is the internet over? PHP2Shell and the 10 worst vulnerabilities in internet history
- Cloud Security Monitoring: What It Is, How It Works, and What to Monitor
- What Is a Zero-Day Vulnerability? Multi-Cloud Mitigation and Response
Sources
- Binance – Initial findings: compromised DevOps engineer's laptop (X, October 30)
- Binance – Investigation update: additional points of breach (X, October 30)
- Richard Teng – Statement on the attack process (X, October 30)
- Richard Teng – Video update on the security incident, with transcript (X, October 30)
- FBI – North Korea responsible for $6 billion+ Binance attack (October 31)
- CNBC – Binance resumes withdrawals, says 90% of stolen assets are covered
- TRM Labs – North Korea steals USD 6.36 billion from Binance in the largest hack in history
- Chainalysis – Binance exploit: latest findings and response
- Blockaid – Binance hack: how the hot wallet was taken over
- Cointelegraph – Binance hack may involve key misuse, not theft: Blockaid
- The Hacker News – Binance suffers security breach affecting $6.3 billion in assets
- Protos – How the Binance hack happened on-chain on Ethereum
- BleepingComputer – Binance links $6.3 billion crypto theft to compromised DevOps laptop
- arXiv – CyberChainBench: Can AI agents secure smart contracts against real-world on-chain vulnerabilities?
- The Hacker News – North Korean hackers pull off $308M bitcoin heist from DMM Bitcoin
- Decrypt – What caused Bybit's $1.4 billion Ethereum hack
- The Record – Radiant Capital heist linked to North Korea
- The Block – Hackers used fake job offer to target CoinDCX employee
Facts as of November 1, 2026. Binance has not published its post-mortem, and this post will be updated when it does. Amounts differ by source: Binance about $6.3 billion, TRM $6.36 billion, Chainalysis about $6.4 billion, Elliptic $6.43 billion. Times are UTC. This post describes the attack at the level the companies and analysts published and does not reproduce attack methods.