They didn't crack the vault, they cracked a laptop

What happened

Say “bank robbery” and you probably picture a film scene: drills, a vault door, sweaty foreheads, a guard in the corner. Forget all that. In the biggest crypto heist so far, nobody touched the vault. The attackers got behind the teller’s window through one employee’s laptop, and from there the till paid them out by itself.

On Thursday, 29 October 2026, assets started pouring out of the wallets of Binance, the world’s largest crypto exchange. Users and blockchain watchers noticed first; then founder Changpeng Zhao wrote on X that the exchange had probably been hacked. Shortly after, Binance confirmed it was handling a security incident.

The numbers are dizzying, and they don’t quite match. Binance puts the estimated total impact at about $6.3 billion; blockchain analytics firm Chainalysis puts the value at the moment of theft at about $5.9 billion. They measure different things, but either way it’s the largest crypto theft ever, roughly four times the Bybit case of February 2025 (about $1.5 billion). The attackers took bitcoin, ether and two big stablecoins (crypto tokens pegged to the dollar), USDT and USDC.

What struck me most was the method. According to Binance’s preliminary investigation, the starting point was most likely the compromised laptop of a DevOps engineer (someone who both builds and runs systems). From that machine, the attacker reached an internal service container, one of the exchange’s running software components, and submitted unauthorised withdrawals from there. The company says there is no sign that the wallets’ private keys leaked. So the keys stayed put; someone else simply told them what to sign. Binance hasn’t yet disclosed how the laptop was compromised or which controls failed to stop the outflow, and has promised a detailed post-mortem.

Damage control kicked in fast. According to Binance, about $3 billion of the affected assets were frozen together with partners: Tether froze more than 1.57 billion USDT, Circle more than 800 million USDC. That’s money stopped, not money recovered. Bitcoin and ether, however, can’t be frozen centrally, and the attacker quickly swapped part of the haul. Binance has pledged to cover the losses from its user protection reserve (SAFU) and its own funds. Deposits resumed on 30 October 2026; withdrawals, by the company’s estimate, within 48 hours.

Who’s behind it? Binance hasn’t named anyone. Blockchain analytics firm TRM Labs attributes it “with high confidence” to TraderTraitor, a North Korean state-backed group. The FBI previously named the same group behind the DMM Bitcoin (2024) and Bybit (2025) heists, and in both cases a developer’s machine was the way in. There’s no official confirmation for this case yet.

Why it matters to you

If you hold crypto, on Binance or anywhere else, your money is probably not at risk from this heist itself. Binance has pledged to absorb the loss. The threat to you is the second wave. After big heists, scammers ride the news: “Binance support” calls, a text says “your account was hacked”, someone offers “compensation registration” or “fund recovery”, for a fee, of course. In February 2025, days after the Bybit heist, exactly this happened to Binance customers.

If you run a company, the lesson isn’t about crypto. One employee’s machine was enough to reach the payouts, because too much trust sat behind it. Ask yourself: whose laptop is worth that much at your place?

No impact in Hungary is known, and as of 30 October 2026 we found no warning from Hungarian authorities. Across Europe, the second wave can arrive in any local language.

Red // attacker's view

Cracking a vault is expensive, slow and loud. Why bother? Right next to it sits someone who’s allowed to open it.

Here’s how I think. The human in the chain: a DevOps engineer has access to production systems because of the job. That person’s machine is worth more to me than any customer account. Groups like TraderTraitor spend months preparing to approach one key person: a fake job offer, a “recruitment coding test”, a message from a “partner”. How it started at Binance isn’t known yet; this is the group’s known playbook.

From the machine to the engine room: from the compromised laptop I reach an internal component that is allowed to start withdrawals. Using the system’s own hands: in the system’s eyes, my requests are official. I don’t need to steal the key; the key politely signs whatever I tell it to. That’s why “no private keys leaked” is both good news and a warning: protecting the key is worthless if the process using the key can be hijacked. Speed: I scatter and swap the money immediately, before the freezable stablecoins can catch me.

And once the news goes round the world, my colleagues arrive: the second wave. They don’t even need a laptop, just your fear and a phone.

Blue // what to do now

Individuals (if you hold crypto anywhere)

Don’t move anything to a “safe wallet”, no matter who asks. A real exchange never asks you to move your money to a wallet it provides.
Don’t call back numbers from texts or emails, and don’t click the link in the message. Check notifications in the exchange’s app or on the official address typed by hand; a fake text can even show up in the same thread as the real ones.
You don’t have to do anything to be compensated. Anyone asking for money or data for “compensation registration”, an “unlock fee” or “verification” is a scammer. Don’t pay “fund recovery” firms either: authorities don’t charge for investigations.
Never give anyone remote access to your computer, and never share your recovery phrase (seed phrase), password or two-factor code.
Don’t keep on an exchange what you’re not using for trading.

Organisations and small businesses

Treat the machines of people with production access as a separate category: no personal browsing, no unknown “test tasks” or downloaded code repositories, endpoint protection and regular review.
Make your team aware of the fake job offer trick: anyone asking you to run code as a “recruitment test” is suspicious.
Two keys for moving money: no large payout should start on the decision of a single person or a single machine. Set amount and velocity limits, an independent second approver on a separate channel, and an automatic stop on unusual patterns.
No direct path from developer laptops to production: a separate, isolated admin workstation and short-lived, task-bound privileges.
Prepare for the second wave: have a customer message ready on how you contact customers, and how you never do.

For professionals: technical details

CVE: none; Binance hasn’t named a vulnerability. Based on current knowledge: endpoint compromise and abuse of internal access.
Disclosed chain (preliminary): DevOps engineer’s laptop → internal service container → unauthorised withdrawal transactions. Binance says no private key leaked and several factors contributed; it is rebuilding the withdrawal service and related addresses.
Attribution: TRM Labs: TraderTraitor (Jade Sleet, UNC4899, Slow Pisces), “high confidence”; Blockaid and ZachXBT: North Korea. No public evidence and no official confirmation as of 30 October 2026.
Precedents: DMM Bitcoin (2024, $308 million): fake recruiter, coding test, stolen session cookies, manipulated transaction request (FBI). Bybit (February 2025, about $1.5 billion): code planted in the web interface via a Safe{Wallet} developer’s machine.
MITRE ATT&CK (editorial mapping, assumption): T1566 / T1204 (the group’s known lure, not confirmed here), T1539 and T1550 (confirmed in the DMM case), T1078, T1021 / T1610-type movement towards the container environment, T1657.
Detection ideas: withdrawal requests from an unusual internal source or schedule; amount and count anomalies in a short window; new, unknown code repositories or unusual browser extensions on admin endpoints; the same session from an unusual place or device; container access from a developer machine outside working hours or without a change ticket.
Indicators: no official consolidated IOC list; attacker addresses are tracked by blockchain analytics firms (Arkham, Chainalysis, TRM Labs). Background: SEAL’s February 2025 DPRK advisory, the FBI IC3 warning on fund recovery scams.

Péter // the chief's note

Today you shouldn’t look for the treasury in bank branches or safes anymore. For me that’s the most important lesson of the Binance case, and it’s not only about crypto.

Classic cash storage now holds only a tiny amount of value compared to what sits in digital wallets or is recorded electronically in other ways. The numbers show it well. About $6 billion disappeared from Binance in a single day, and even that is only around 4 percent of the exchange’s total assets of roughly $144 billion. Value on that scale isn’t guarded by a vault anymore, but by keys, software, and the handful of people whose machines can reach them.

An armed security guard won’t help here when things go wrong. The attackers didn’t come through the front door, and they didn’t steal the key either: according to Binance, the private keys stayed where they were. Through an engineer’s laptop they reached an internal service that, in the system’s eyes, legitimately started the withdrawals. The guard wouldn’t have seen any of it, because there was nothing for him to see.

That’s why I think we have to redefine what guarding the treasury means. The new “vault door” is our key people’s machines and the process that uses the key. If there’s too much trust there, the thickness of the vault doesn’t matter.

So here’s the question I’d close with: do you know where your treasury is today, and who really guards it?

Background report for professionals

The full research in one PDF

Timeline, actors, how the attack works, actions for each audience, technical details and source assessment. All in one place, printable and easy to pass on.

PDF · 8 pages · 210 KB · research revision v1

Open the PDF (English) Magyar eredeti (PDF)

What happened

Why it matters to you

The full research in one PDF

Sources