The $6.36 Billion Binance Hack Wasn't a Code Bug. Most of Crypto's Biggest Losses Aren't.
The largest crypto theft on record took about 20 minutes and needed no flaw in any smart contract. The data shows why: code bugs cause half of crypto hacks but only 15% of the money lost. The big losses come from keys, servers and people.
All hackers since 2022, except the last row. Source: TRM Labs, 30 October 2026.
On the evening of 29 October 2026, about $6.36 billion in cryptocurrency left wallets belonging to Binance, the world’s largest crypto exchange. Most of it moved in about 20 minutes, across ten blockchains. It is the largest crypto theft on record, about four times the $1.5 billion taken from Bybit in February 2025.
Two days later, the FBI confirmed that North Korea was responsible (FBI, 31 October 2026).
When crypto is stolen, the usual assumption is a bug in the code. This theft needed no bug at all. And the data shows that is the normal pattern for the largest losses: the biggest crypto thefts come from attacks on keys, servers and people, not from flawed code.
What happened on 29 October
Blockchain analysis firm TRM Labs traced every transfer from Binance wallets to the attacker. Preparation began at least 36 hours earlier, and the theft itself started at 20:05 UTC on the XRP Ledger. Within about half an hour, Binance wallets on Bitcoin, Ethereum, Tron, Solana and other networks had sent funds to the attacker. A second wave reached Avalanche and Polygon around 23:05 UTC (TRM Labs, 29 October 2026).
Source: TRM Labs, 29 October 2026.
The amounts add up to about $6.36 billion. Valued at prices a day later, the same assets were worth about $6.23 billion.
Binance confirmed the breach and suspended deposits and withdrawals while it carried out security checks. It said it would “cover all losses from the SAFU fund and the company’s funds” (BleepingComputer, 30 October 2026). By 1 November, Binance said it had covered about 95% of the affected amount and was preparing to resume withdrawals (BleepingComputer, 1 November 2026).
How it got in: a laptop, not a code flaw
Binance linked the theft to a DevOps engineer’s compromised laptop. According to the company, that access let the attackers reach a service container and submit unauthorized withdrawal transactions. Binance said it had not found evidence of a leaked wallet private key.
Binance was also clear that this was not one person’s mistake. Co-CEO Richard Teng said the attack “involved a more complex attack process” and that “our investigation has not attributed responsibility to any individual.”
TRM’s analysis of the transactions points in the same direction. Wallets on different blockchains, using different key types and signing methods, all produced valid signatures for the attacker within about half an hour. In TRM’s assessment, the most likely explanation is that the attacker gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing. Binance has not yet published a full root cause.
A hot wallet is a wallet connected to the internet that an exchange uses to process customer withdrawals quickly. It needs a signing system that can approve transactions automatically, which is exactly what makes it a high-value target.
The data: code bugs are common, but not where the money goes
This is where the Binance case fits a much larger pattern. TRM Labs classifies crypto hacks by how they happened, and the split by number of hacks looks very different from the split by money lost (TRM Labs, 30 October 2026):
- Smart contract code exploits are the most common type of attack: 49% of classified incidents since 2022. But they account for only 15% of the value stolen.
- Infrastructure attacks, which target the keys, servers and signing systems behind the money, are less frequent but far larger.
The gap is widest for North Korea, the single largest source of stolen crypto:
Source: TRM Labs, 30 October 2026.
Only 13 of North Korea’s 100 attributed incidents were code exploits, and together they add up to about 1% of what it has stolen. The rest came from reaching the systems that hold or sign for the money.
That is why the numbers are so concentrated. North Korea-linked hackers have stolen about $12.8 billion in crypto since 2017, and just five incidents (Binance, Bybit, Ronin, Bitget and DMM Bitcoin) account for $9.1 billion of it.
How the attackers reach the keys: people first
If the target is a signing system rather than code, the way in is usually through the people who can reach it. TRM calls the sequence “Code to Custody”: a fake recruiter or investor approaches a developer, a “coding test” delivers malware, and the malware yields the keys, session cookies or cloud tokens that lead to the systems that sign transactions.
The same group’s earlier thefts follow this pattern closely:
| Date | Target | Amount stolen | How access was gained (as reported) |
|---|---|---|---|
| May 2024 | DMM Bitcoin | $308 million | An employee at a wallet software company was tricked by a fake recruiter on LinkedIn into running malicious code disguised as a pre-employment test |
| Feb 2025 | Bybit | $1.5 billion | A compromised computer belonging to a developer at a wallet platform (Safe{Wallet}) |
| Apr 2026 | Drift | $280 million | A months-long social engineering operation, including in-person meetings at industry conferences |
| Sep 2026 | Bitget | $387.5 million | Reported as a zero-day flaw in third-party security products (early reports gave $351.6 million) |
| Oct 2026 | Binance | $6.36 billion | A compromised DevOps engineer’s laptop that gave access to a service container |
Sources: BleepingComputer, 1 November 2026 (DMM, Bybit, Drift, Bitget amounts); BleepingComputer, 30 October 2026 (Binance); TRM Labs. Descriptions are as reported; several investigations are ongoing.
Four of the five began with a person or a person’s computer, not with the blockchain or a smart contract.
How much of the $6.36 billion can be recovered?
Once crypto is stolen, the race is between freezing it and converting it. Stablecoins such as USDT and USDC are issued by companies that can freeze tokens in specific wallets. Native assets such as Bitcoin and Ether have no issuer, so once the attacker holds them, nobody can freeze them.
The frozen and held amounts do not add up to the total, because the attacker sold and converted some funds before the freezes. Source: TRM Labs, 30 October and 3 November 2026.
Stablecoin issuers moved within hours. Tether froze its first 971 million USDT 37 minutes after the main transfer:
Source: TRM Labs, 30 October 2026.
The attacker, in turn, raced the freezes by selling USDT to market makers and borrowing Ether against it. As of 3 November, TRM reported that the main Ethereum and Bitcoin holdings had not moved, while smaller amounts were being laundered through new routes on Tron and Solana (TRM Labs, 3 November 2026). The FBI has published 628 addresses linked to the theft and asked exchanges and other services to block transactions from them.
The bigger picture: one country, most of the losses
Crypto hacking losses reached $8.7 billion in 2026 by October, the highest on record, and the Binance theft accounts for most of the increase. North Korea’s share of the money stolen has grown sharply:
2026 is year to date as of October. Source: TRM Labs, 30 October 2026.
Of the $8.7 billion lost to crypto hacks so far in 2026, TRM attributes about $7.4 billion to North Korea.
What this means for security teams
The data points to a few lessons that security teams across the industry draw from incidents like these. None of them is specific to Binance, and Binance has not yet published its full root cause:
- Treat developer and operations devices as part of the vault. In four of the five thefts above, the first step was a person’s computer. Devices that can reach production or signing systems need the same protection as the systems themselves.
- Treat hiring and investment approaches as a possible attack. The FBI and TRM both describe fake recruiters and “coding tests” as a long-running North Korean tactic, including the campaign known as Operation DreamJob.
- Limit what a single signing system can do. The Binance theft moved most of its value in about 20 minutes. Limits on how much can leave a hot wallet, how fast, and with how many approvals all shrink what an attacker can take before anyone notices.
- Speed matters after a theft, too. Fast action by stablecoin issuers froze about 42% of the Binance proceeds within hours. Assets that had already been converted into Bitcoin and Ether could not be frozen.
Security spending often focuses on auditing code, and code audits do prevent many smaller hacks. But by value, the largest losses come from somewhere else.
Key terms
- Hot wallet: a crypto wallet connected to the internet, used by exchanges to process withdrawals quickly.
- Signing system: the software and hardware that approves (signs) transactions from a wallet.
- Smart contract exploit: an attack that uses a flaw in a blockchain program’s code to drain funds directly.
- Infrastructure attack: an attack on the keys, servers or signing systems behind a wallet, rather than on the code of a protocol.
- Stablecoin: a crypto token designed to hold a steady value, such as USDT or USDC. Its issuer can freeze tokens in specific wallets.
- TraderTraitor: the FBI’s name for the North Korean hacking activity behind the Binance and Bybit thefts. It is also tracked as Lazarus Group, Jade Sleet and APT38.
Notes on the data
- Figures on the Binance theft come from TRM Labs’ on-chain tracing as of 30 October and 3 November 2026, and from statements by Binance reported by BleepingComputer. The investigation is ongoing and figures may change.
- Binance has not yet published a full root cause. The description of how the attackers got in is Binance’s own, as reported; TRM’s view of the signing system is its assessment.
- Attribution to North Korea comes from the FBI’s official alert, and from TRM Labs and Chainalysis.
- TRM’s breakdown by attack type covers incidents in its data that have a classified attack type, since 2022.
- Amounts for earlier thefts are as reported at the time; the Bitget amount differs between reports ($387.5 million and $351.6 million).
Sources
Official: FBI – North Korea responsible for $6 billion+ Binance attack (31 Oct 2026)
Blockchain analysis: TRM Labs – North Korea steals USD 6.36 billion from Binance (29 Oct 2026) · TRM Labs – North Korea has stolen USD 12.8 billion in crypto (30 Oct 2026) · TRM Labs – Binance hack update (3 Nov 2026)
Reporting: BleepingComputer – Binance probes potential $5.8 billion hack (29 Oct 2026) · BleepingComputer – Binance links theft to compromised DevOps laptop (30 Oct 2026) · BleepingComputer – FBI links Binance heist to North Korean hackers (1 Nov 2026)
Every figure in this article links to its source and was checked against that source before publishing. How we check figures