The $6 billion-plus hack that was partly thwarted

On 29 October 2026, large sums leave wallets attributed to Binance. TRM places the first movements at around 20:05 UTC and estimates that much of the transfer activity took place over about twenty minutes. Several networks are affected. The following day, Binance announces an estimated impact of $6.3 billion. This provisional figure does not necessarily represent a final, wholly irrecoverable loss.

How could unauthorized withdrawals be triggered? Binance first advances the track of the compromised computer of a DevOps engineer, in charge of computer systems. This access would have made it possible to reach an internal service container, an environment where software runs, and then submit withdrawals. The company then reports other points of intrusion. The initial infection and the complete sequence are not published. So you can’t invent a trapped email, a fake job interview or the fault of a specific person.

On Ethereum, TRM describes a delegation allowing a wallet to execute authorized code, diverted to move its assets. On other networks, the company observes ordinary signed transfers. It sees this as an indication of compromise of the signature infrastructure. This is his analysis, separate from Binance’s still provisional balance sheet. Binance says it has not found evidence of private key leaks; this does not demonstrate that its authorization mechanisms have not been abused.

Public transfers leave traces. Analysts follow the addresses and warn the actors able to intervene. This external monitoring is documented, but the exact trigger of the internal alert at Binance remains unknown in the sources consulted. No employee name or precise detection system can be given as the first to have discovered the intrusion.

Binance announces a temporary suspension of deposits and withdrawals during initial verifications, as well as the revocation of an authorization related to an affected address. Subsequent information viewed indicates suspended withdrawals; this timeline does not constitute a real-time service status. The platform cooperates with authorities and blockchain specialists. Issuers, including Tether and Circle, immobilize tokens associated with the theft. Binance announces about $3 billion frozen with its partners.

Freezing does not mean refunding. Assets can be locked up at an address without being returned to their owners. Not all can be blocked in the same way. Analyst estimates vary by time, networks covered and prices used: they do not add up. The race consists in particular in intervening before the conversion or the dispersion of the funds.

Who is behind the attack? TRM attributes it with high confidence to TraderTraitor, a North Korean group; Elliptic also considers North Korean involvement likely. These are duties of investigators, not the judicial identification of an individual. Binance says it is working with authorities to confirm the identity of those responsible.

Binance promises to cover losses with its resources and SAFU, its emergency fund for users. This is a commitment, not proof of refunds already made. A detailed technical report is announced after the investigation. As of 30 October 2026, the full mechanism, the amount definitively recovered and the responsibilities remain to be established.