Update to our 29 October report. In an update on 30 October 2026, Binance said its initial investigation suggests the theft may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorised withdrawal transactions. Binance says it has found no evidence that wallet private keys leaked. It has not explained how the laptop was compromised.
The laptop is not the whole story. In a later statement Binance said it had found additional breach points, which it has not described. Co-CEO Richard Teng said the attack involved a complex process. Malwarebytes' Pieter Arntz cautioned that a compromised laptop may show where the attack began but does not by itself explain how billions left the exchange.
Size and timeline: Binance now estimates the impact at about $6.3 billion; earlier outside estimates were up to $5.8 billion. TRM Labs calculates about $6.36 billion left Binance wallets across ten networks, most of it in roughly 20 minutes from about 20:05 GMT on 29 October. TRM says preparation began at least 36 hours earlier, including funding through Tornado Cash and tests of attack code, and that on Ethereum the attacker used EIP-7702 authorisations to make a Binance wallet run attacker-controlled code.
Who did it: TRM Labs attributes the theft with high confidence to TraderTraitor, a North Korean group associated with Lazarus, and Chainalysis CEO Jonathan Levin called it likely TraderTraitor. Binance has not named the attackers, and there is no official government attribution in the sources.
Status: Binance says about $3 billion has been frozen on-chain with partners (frozen is not the same as returned). It says customers will not bear losses, which will be covered from its SAFU fund and company funds. Deposits are working again; withdrawals remained paused, with Binance saying they were expected to resume within 45 hours of a later update. A technical post-mortem and an updated Proof of Reserves are promised.
