$6.3 billion through one laptop: lessons from the biggest hack in crypto history
On 29 October 2026 about $6.3 billion was stolen from Binance in 20 minutes — four times the previous record. The best-protected infrastructure in the crypto industry was breached not through the blockchain or the exchange engine, but through one DevOps engineer's work laptop.
---
## 20 minutes and $6.3 billion
On 29 October 2026 attackers drained about **$6.36 billion** (TRM Labs' estimate) from the wallets of Binance, the world's largest crypto exchange. The funds moved across 10 blockchains, most of them within roughly **20 minutes**. A single transaction exceeded $2.5 billion.
It is an all-time record. The previous one — the $1.5 billion Bybit hack in 2025 — is four times smaller. Across the whole of 2025, according to TRM Labs, $2.87 billion was stolen from crypto companies in nearly 150 incidents.
But the most important part of this story isn't the amount — it's how the exchange was breached.
## The entry point: a DevOps engineer's laptop
Binance has everything that is usually considered world-class protection: cold wallets, multi-level transaction signing, its own security team, a user protection fund. And yet, according to the initial investigation findings the exchange published on 30 October, the incident may involve **a compromised DevOps engineer's laptop**. Through it, the attacker gained access to a service container and was able to submit unauthorised withdrawal transactions. Binance says it has found no evidence of any wallet private key leak.
This is the key detail. A DevOps engineer runs the infrastructure: servers, containers, deployment processes. Their job gives them access to systems an ordinary employee never sees. The attackers didn't even need the wallet keys: it was enough to get onto the computer of a person with access to the infrastructure that transactions pass through. There was no need to break the protected system head-on.
The attack was no improvisation. According to TRM Labs, it was prepared at least 36 hours in advance: the wallets were funded beforehand through the Tornado Cash mixer, and transaction signatures were obtained ahead of time. Once everything was ready, the money was moved out in minutes — faster than any team could react manually.
## We've seen this before
Analysts at TRM Labs ("high confidence") and Chainalysis ("likely") link the attack to the North Korean group **TraderTraitor**, considered part of the Lazarus Group. The FBI named the same group as responsible for the Bybit hack in 2025.
The scenario there was similar: the path to Bybit's money also ran through a developer's computer — only a third-party one, at Safe{Wallet}, the service the exchange used to sign transactions.
The group has long specialised in people rather than servers. Back in 2022 the US cybersecurity agency CISA warned that TraderTraitor sends targeted phishing emails to crypto company employees and gets them to download infected applications — for example, disguised as trading tools or as a test assignment during a "job application".
## What Binance did
- temporarily suspended withdrawals while security checks are completed;
- revoked the affected address authorisation;
- promised to cover all losses from the SAFU fund and the company's own funds, and said user funds are safe;
- together with partners, froze about **$3 billion** — mostly stablecoins blocked by their issuers, Tether and Circle;
- engaged law enforcement and blockchain intelligence firms to trace and recover the funds;
- promised to publish a detailed technical post-mortem and an updated Proof of Reserves.
The rest will be harder to get back: bitcoin and ether cannot be frozen, and according to Chainalysis experts, recovering funds can take months or years. After the news, bitcoin fell by about 5%.
## Why this isn't only about crypto exchanges
Every company has its own "engineer's laptop" — the workstation of a person through whom critical operations pass. In an IT company, it's the DevOps engineer with access to servers and deployment processes. In a bank, the computer of the employee who approves payments. In manufacturing, an engineer with remote access to industrial control systems. In any company, the system administrator and the accountant with access to online banking.
An attacker doesn't need to break your best-protected system. They need to get onto the computer of the person who manages it.
What follows from this:
1. **Workstations of privileged staff are a separate risk zone.** They are protected more strictly than the rest, not "like everyone else's".
2. **Critical operations must not depend on one device and one person.** Large payments and changes should be approved by at least two people from different devices.
3. **Antivirus is not enough.** A targeted attack is often visible not by a virus but by behaviour: an unusual login, a new process, access to systems this employee doesn't normally touch. This kind of behaviour is caught by EDR systems and SOC analysts.
4. **Response speed is everything.** Binance lost billions in 20 minutes. Monitoring that looks at events once a day is useless here — it has to be around the clock.
5. **Employees are the first line of defence.** Especially those with the most access: they are the ones most often chosen as targets.
## The bottom line
The best-protected infrastructure in the crypto industry was breached not through the blockchain or the exchange engine, but through one work laptop of one employee. If it worked against Binance, it will work against any company that protects its servers but forgets about the computers of the people who manage them.
[Antivirus with EDR](/pricing) helps protect workstations, and [24/7 SOC monitoring](/services/soc) helps spot an attack in time. If you want to find out where your company's own "engineer's laptop" is, [get in touch](/contact).
---
*Based on Binance's official statement (30.10.2026) and reporting by CNBC, Al Jazeera, The Washington Post, Bloomberg and Axios (29–30.10.2026). The investigation is ongoing; figures and details may change.*