Binance's $6.3bn theft may have begun on one laptop, and did not stop there

At 20:05 UTC on 29 October, five Binance wallets on the XRP Ledger sent 233 million XRP to a single address, according to a reconstruction by TRM Labs, the blockchain intelligence firm. Over the next 20 minutes the exchange’s hot wallets on Bitcoin, Tron, Solana and Ethereum followed. By the time withdrawals were paused, Binance had lost about $6.3bn (£4.7bn) by its own estimate, in what TRM calls the largest crypto hack on record and more than four times the $1.46bn (£1.1bn) taken from Bybit in February 2025, by Elliptic’s count.

Binance’s first detailed statement, posted at 02:25 UTC on 30 October, gave a root cause that any board would recognize: “Binance’s initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” It said it had found no evidence of a wallet private key leak, had frozen about $3bn (£2.3bn) with blockchain partners and would cover all losses from its Secure Asset Fund for Users (SAFU) and company funds.

Richard Teng, Binance’s co-chief executive, posted his own account five hours later. “To be clear: the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process,” he wrote. “Our investigation has not attributed responsibility to any individual.” An hour after that, the company said its “subsequent investigation has uncovered additional points of breach”.

The laptop is the detail that will travel, because every company has laptops. The record Binance, Elliptic and TRM Labs put together in the first 12 hours says something narrower: the attacker never needed Binance’s keys. They needed Binance’s own systems to sign, and for about three hours those systems did.

What a service container could reach

Elliptic, the blockchain analytics firm, counts $6.43bn (£4.8bn) leaving Binance hot wallets across 11 blockchains in a few hours, a higher figure than Binance’s estimate; Elliptic values each transfer at the time of theft. On Ethereum, where TRM counts about $3.79bn of the total, the attacker used EIP-7702, a feature the network added in May 2025, to delegate a Binance hot wallet to a ‘sweeper’ contract. They submitted 50 pre-signed authorizations, each for a consecutive nonce, so one would be valid whenever the wallet’s transaction count reached it. The delegation stayed in place, and TRM lists six further sweeps of the wallet between 20:41 and 23:56 UTC.

On Bitcoin, Tron, Solana and the other chains no delegation was used. The funds left in ordinary signed transactions: 18,270 BTC, about $1.47bn, from the Bitcoin hot wallet at 20:20 UTC, then 612.7 million USDT and 46.4 million TRX from Tron within two minutes. Elliptic reads this as the attacker being able to instruct Binance’s signing infrastructure directly. TRM says the most likely explanation is a compromise of the hot wallet signing infrastructure itself. Binance has said only that the laptop gave access to a service container that could submit withdrawals, and that there were other points of breach it has not yet described.

Thirty-six hours of preparation

TRM’s timeline shows the preparation. On the morning of 28 October an operator wallet took three small withdrawals from Tornado Cash, the mixing service. Early on 29 October the attack code was deployed and tested on two wallets, then rehearsed in its final form on a third. About four hours later it was installed on a Binance hot wallet. The first transfer out came at 20:05 UTC. Binance says the outflows ceased when it paused withdrawals; TRM’s data show a second wave from the Avalanche and Polygon wallets at 23:05 UTC, three hours after the first.

The freezes followed within hours. Tether froze about 1.77 billion USDT and Circle about 825 million USDC, by TRM’s count, and Elliptic’s verified total of $2.84bn frozen, 44% of the theft, is almost all USDT and USDC. The attacker still held more than 420,000 ETH and 18,270 BTC at 00:30 UTC on 30 October, worth about $2.4bn (£1.8bn), by TRM’s count.

Who did it, and who says so

TRM Labs attributes the theft to TraderTraitor, the North Korean unit the FBI named for the Bybit hack, and says: “We make this judgment with high confidence.” Elliptic also attributes it to North Korea (DPRK) on the evidence so far, citing funds from this theft and an earlier Bitget exploit reaching the same Ethereum address, among other signs. It then lists the reasons for caution in its own assessment: the overlap with the Bitget funds is small, the stablecoins were not swapped quickly as they usually are in DPRK laundering, the laundering methods differ from the Bybit case and the root cause has not been published. “No government or law enforcement agency has confirmed attribution, and Binance has not commented on who was responsible,” Elliptic writes. Binance says it is working with law enforcement “to confirm the identity of these criminals and bring them to justice”.

The postmortem Binance has promised

Binance had deposits running normally by the morning of 30 October and said withdrawals were on track to resume in 45 hours, after what Teng called “a security revamp of the withdrawal service and its related addresses”. It has promised a detailed technical postmortem and an updated proof of reserves once remediation is complete. That document will have to explain three things the statements so far have not: how a DevOps engineer’s laptop was compromised, what the service container was permitted to do, and how 50 authorizations for an Ethereum hot wallet came to be signed. Until the postmortem arrives, the only root cause on the record is a laptop, and Binance has already said that is not the whole story.