Binance puts its hack at $6.3 billion, blames an engineer's laptop
Victoria Shinder2 min readThe largest theft in crypto's history happened on Thursday evening, and by Friday morning Binance had confirmed it in its own words. In a "Security Incident Update" published at 02:23 UTC on 30 October, the exchange estimated total losses at about $6.3 billion and said roughly $3 billion had been frozen with the help of blockchain partners.
According to Binance, its initial investigation points to a compromised laptop belonging to a DevOps engineer. That gave the attacker access to a service container, from which unauthorised withdrawal transactions were submitted. The exchange says it has found no evidence that wallet private keys leaked. As immediate measures it temporarily suspended deposits and withdrawals, revoked the authorisation of the affected address, and brought in law enforcement and blockchain analytics firms. Binance says it will cover all losses from its Secure Asset Fund for Users and company funds, that user funds are safe, and that it will publish an updated proof of reserves and a technical post-mortem once the investigation is complete.
The outflows began around 20:20 UTC on 29 October, when, according to on-chain tracking cited by CoinDesk and Decrypt, Binance hot wallets sent large amounts of ether, stablecoins and about 18,270 bitcoin to new addresses. Tether chief executive Paolo Ardoino said his company had frozen more than $1.57 billion in USDT and Circle's Jeremy Allaire said more than $800 million in USDC was frozen. Blockchain analytics firms including TRM Labs and Blockaid said the operation looked like the work of North Korean hackers; Binance has not attributed it. The previous record was the roughly $1.5 billion taken from Bybit in February 2025.
What it means
Binance's account answers the first question, how the attacker got in, without the detail that matters for every other exchange: what the service container was allowed to sign, and why its withdrawals were not stopped by limits or review. As of Friday morning the exchange had not announced when withdrawals would resume. The promise to cover losses depends on Binance's own balance sheet, which it says is sufficient; the updated reserves report will be the first independent test.