The Binance Hack Explained: How $6.3B Was Stolen

On October 29, 2026, attackers moved about $6.3 billion out of Binance in what blockchain analysts call the largest crypto theft on record. Most of it left in roughly 20 minutes. Binance says it found no evidence its private keys leaked, and despite the headlines, there's no evidence AI ran the attack.

MSP Pentesting is channel-only, so we spend our time testing the kinds of environments MSPs manage, not crypto exchanges. But the way this attack worked is the way most serious intrusions work, at any size. Here's what happened, step by step, and the one question it should make every MSP ask about its clients. The short video version is right here.

What happened

At about 20:05 UTC on Thursday, October 29, Binance wallets started sending funds to addresses the exchange didn't control. Blockchain intelligence firm TRM Labs counted about $6.36 billion leaving across ten blockchains, most of it within about 20 minutes. Binance's own estimate is $6.3 billion. For scale, that's roughly four times the $1.5 billion taken from Bybit in February 2025, the previous record.

Binance paused withdrawals, said it would cover all losses from its SAFU fund and company funds, and set aside more than $6.34 billion to do it. On October 31, the FBI attributed the theft to TraderTraitor, a North Korean state hacking unit it had already blamed for the Bybit theft.

How the attack worked, step by step

1. It started with a laptop

Binance's early findings point to a compromised laptop belonging to a DevOps engineer. The company has since said it found additional points of breach, and co-CEO Richard Teng said the attacker didn't simply use one engineer's permissions and that this wasn't a one-click action.

Binance hasn't said how the laptop was infected. But the FBI and CISA have described TraderTraitor's usual way in since 2022: spearphishing aimed at system administrators and DevOps staff, dressed up as recruiting for a high-paying job, that ends with the target installing a malware-laced app.

2. They took over the signer, not the vault

From that laptop, the attackers reached an internal service that submits withdrawals. According to TRM Labs, they compromised the system that signs transactions for Binance's hot wallets, the internet-connected wallets an exchange uses for day-to-day withdrawals.

That's the part worth sitting with. The keys didn't need to leak. Once you control the software that tells the keys what to sign, a perfectly protected key signs whatever you hand it.

3. The sweep

On Ethereum, Teng said the attacker used an EIP-7702 delegation to take control of a hot wallet without passing Binance's normal approval checks. EIP-7702 is a 2025 Ethereum upgrade that lets a regular wallet run smart-contract code, and here it turned a hot wallet into a sweeper pointed at the attacker. Researchers disagree on how much that feature changed the outcome, but they agree on the root cause: a compromised signing system. On the other chains, Binance's own withdrawal system signed the transfers out.

4. The race against the freezes

Then came a race. Tether, Circle and other issuers froze about $2.7 billion in stablecoins, according to TRM. But no issuer can freeze ether or bitcoin, and the attacker raced the freezes by selling stablecoins and borrowing ether against them on Aave. As of November 2, Elliptic estimated about 44% of the stolen funds had been frozen or seized, with roughly $3.28 billion still under the attackers' control across more than 950 wallets.

Was it an AI hack?

A lot of coverage framed this as the moment AI-powered hacking arrived. The evidence doesn't support that yet. Reuters reported no evidence that AI was used in the attack, and after tracing the laundering, Elliptic co-founder Tom Robinson said, "The pattern fits scripts written and supervised by people."

That doesn't make AI irrelevant. The FBI and security researchers believe North Korean groups use AI for reconnaissance and to write more convincing phishing, and Immunefi's Goncalo Magalhaes told Reuters that AI has made finding weaknesses cheap while fixing them still happens at human speed. That gap is the real AI story for defenders.

What MSPs should take from it

Strip out the crypto and this is a familiar incident. A privileged person's machine gets compromised, usually through social engineering. That machine can reach systems that move money or run production. Nobody had mapped how far that path went until an attacker walked it.

A few things worth checking at every client you manage:

Treat admin and developer laptops as high-value targets. Check Point's Hendrik de Bruin made that point after the attack, along with setting hard limits on how much can move without extra approval.
Keep the machines people use for email and browsing away from the ones that can touch production, payments or backups.
Make sure no single account, service or device can approve a high-value action on its own.
Train for the fake-recruiter playbook. It's how this group has gone after engineers for years.
Find out what one compromised workstation can actually reach, before someone else does.

That last one is what an internal penetration test answers. The tester starts inside the network, the same place this attacker started, and shows how far a foothold spreads: lateral movement, privilege escalation, Active Directory and credential weaknesses, and the paths to the systems that matter. A social engineering test covers the other half, whether staff will open the attachment, take the call or install the app in the first place.

Questions MSPs are asking

Did Binance customers lose money?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company funds. It paused withdrawals during the response and said it would reopen them in stages.

Who was behind it?

The FBI attributed the theft to TraderTraitor, a North Korean state-sponsored unit, on October 31. TRM Labs and Chainalysis reached the same conclusion from on-chain evidence. Binance itself has not named an attacker.

Could the same pattern hit an SMB client?

Yes, at a smaller scale. In most SMBs the money sits behind an accounting login, a payroll portal or a wire approval, and the path to it usually starts with one person's laptop. The steps are the same: get a foothold, find what that machine can reach, then take over something that's trusted to act.

Is an external pentest enough to catch this?

Not for this risk. An external test looks at what's exposed to the internet. This attack started inside, on a trusted device. Testing that takes an internal engagement, and for most clients it's worth running both.

If you want that answer for a client before an attacker finds it, get a pentest quote. We test under your brand, and we never sell to your client.

External Network Pentesting

Internal Pentesting

Web Application Pentesting

Social Engineering

Cloud Pentesting

WiFi Pentesting

ISO 27001 Penetration Testing

CIS Critical Security Controls

NIST 800-171 / CMMC 2.0

HIPAA Penetration Testing

PCI DSS Penetration Testing

SOC 2 Type I & II Readiness