The Binance hack occurred in late October 2026 and resulted in the theft of approximately $6.3 billion, making it the largest financial cyberattack in history.
How it originated
Point of entry: The initial investigation indicated that the attack began with the compromise of a laptop belonging to a DevOps engineer at the platform, a device with elevated access privileges to internal systems.
Lateral movement: Using these credentials, the attackers (linked by cybersecurity firms to the North Korean state-sponsored group TraderTraitor) managed to access a service container and bypass authorization controls.
Mass execution: This allowed them to manipulate the hot wallet signing system to extract and process massive unauthorized withdrawals across multiple blockchains within 20 minutes.
How it was resolved and mitigated
On-chain fund freeze: Binance immediately collaborated with crypto industry partners, validators, and stablecoin issuers (such as Tether and Circle). As a result, nearly $3 billion in assets were frozen on the blockchain to prevent the attackers from moving or liquidating them.
Full coverage of losses: Binance executives announced that the platform would cover 100% of the losses using its emergency user fund (SAFU) and corporate reserves, ensuring users' funds remained secure.
Restoration and security: The company temporarily suspended the affected withdrawals and deposits to patch the breach vectors, isolate the compromised containers, and strengthen access protocols at the infrastructure and development levels.
$usdt $bnb $xrp
How it originated
Point of entry: The initial investigation indicated that the attack began with the compromise of a laptop belonging to a DevOps engineer at the platform, a device with elevated access privileges to internal systems.
Lateral movement: Using these credentials, the attackers (linked by cybersecurity firms to the North Korean state-sponsored group TraderTraitor) managed to access a service container and bypass authorization controls.
Mass execution: This allowed them to manipulate the hot wallet signing system to extract and process massive unauthorized withdrawals across multiple blockchains within 20 minutes.
How it was resolved and mitigated
On-chain fund freeze: Binance immediately collaborated with crypto industry partners, validators, and stablecoin issuers (such as Tether and Circle). As a result, nearly $3 billion in assets were frozen on the blockchain to prevent the attackers from moving or liquidating them.
Full coverage of losses: Binance executives announced that the platform would cover 100% of the losses using its emergency user fund (SAFU) and corporate reserves, ensuring users' funds remained secure.
Restoration and security: The company temporarily suspended the affected withdrawals and deposits to patch the breach vectors, isolate the compromised containers, and strengthen access protocols at the infrastructure and development levels.
$usdt $bnb $xrp