Twenty Minutes That Shook the Crypto World
Twenty minutes. Enough time to make a cup of tea, answer a few emails or watch the beginning of a television programme. On 29 October 2026, attackers used roughly that amount of time to move most of an estimated $6.3 billion in cryptocurrency from wallets controlled by Binance, one of the world's largest digital-asset exchanges.
The figure is extraordinary. It is more than four times the value stolen in the $1.5 billion Bybit attack in February 2025, itself a landmark event in cryptocurrency crime. But there is something more troubling than the scale of the Binance theft.
According to the exchange's initial investigation, the attack may have involved a compromised laptop belonging to a DevOps engineer. Binance later acknowledged additional points of compromise. It also stated that investigators had found no evidence of the wallet private keys themselves being leaked. That raises a remarkable question. If the attackers did not simply steal the private keys, how did they obtain the authority to move billions of dollars?
The answer lies in a distinction that cryptocurrency owners often overlook. A blockchain can operate securely while the institution using it suffers a catastrophic security failure. And when that institution is responsible for billions in digital assets, the consequences can be enormous.
What Happened on 29 October?
The first suspicious transfers began at approximately 20:05 UTC. Blockchain investigators identified movements from Binance-controlled wallets on the XRP Ledger, followed by activity involving Ethereum, Bitcoin, Solana, Tron and other networks. The transfers continued across several blockchain systems, with most of the value moving during an exceptionally concentrated period. Further suspicious activity followed later in the evening.
TRM Labs, a blockchain intelligence company, calculated that approximately $6.36 billion was transferred to attacker-controlled addresses. Elliptic, another specialist firm, estimated the stolen amount at approximately $6.43 billion. Binance put the initial loss at around $6.3 billion. The differences are modest relative to the scale of the incident and reflect separate analytical methods, asset valuations and transaction coverage.
The more striking detail is that the theft affected numerous cryptocurrencies and blockchain networks. These networks use different transaction formats and signing procedures. Successfully moving assets from multiple exchange-controlled wallets therefore raises the possibility of a compromise affecting the infrastructure responsible for authorising transactions.
Binance's initial statement suggested that a compromised DevOps engineer's laptop had enabled access to a software service container, from which unauthorised withdrawals were submitted. A service container is a software environment that runs a particular application or operational process. Large exchanges rely on many connected services to process requests, manage wallet balances, validate permissions and send transactions to blockchains. A security failure in one of those systems can become extremely serious if it allows an attacker to reach more sensitive infrastructure.
But the precise sequence remains unresolved. Binance subsequently reported discovering additional points of compromise and promised a detailed technical post-mortem after verification. That means the laptop explanation is a preliminary finding, not a completed reconstruction.
The essential question is how the attackers obtained the ability to cause apparently authorised transactions across multiple systems. That question takes us to the difference between breaking a blockchain and compromising the people or software authorised to use it.
A Secure Blockchain Is Not the Same as a Secure Exchange
Imagine a bank with an exceptionally well-protected vault. The vault cannot easily be forced open. Its accounting records are accurate, and every movement of money is documented. Now imagine a criminal obtains control over a system authorised to instruct the vault to release its contents. The vault may function exactly as designed. It receives an instruction that appears valid.
Something similar can happen with cryptocurrency. Blockchains such as Bitcoin and Ethereum use cryptographic rules to establish whether transactions satisfy their technical requirements. They do not independently determine whether the person behind a transaction has honest intentions. If the necessary authorisations are present, a network may process a transaction even when the instruction originates from a criminal.
An exchange, meanwhile, has its own operational systems: employees, servers, wallet-management software, transaction-signing services and administrative permissions. Those systems can be attacked without defeating the underlying blockchain's cryptography.
This matters because many cryptocurrency users associate blockchain security with the safety of their exchange accounts. The two are connected, but they are not interchangeable.
In the Binance case, independent investigators identified transaction patterns suggesting that the attackers had gained access to, or influence over, the exchange's signing and authorisation infrastructure. Precisely how that happened has not yet been publicly established.
The incident does not demonstrate that Bitcoin's cryptographic protections were broken or that Ethereum's consensus mechanism was defeated. It demonstrates the danger when powerful operational permissions may be obtained or misused by an unauthorised party.
One of the clearest illustrations came from Ethereum.
EIP-7702: How a Legitimate Feature Became Part of the Attack
A particularly unusual element of the incident involved EIP-7702, a feature introduced through Ethereum's Pectra upgrade in May 2025. The name is technical. The basic idea is not.
EIP-7702 allows an ordinary Ethereum account to authorise the use of smart-contract code to govern certain aspects of its behaviour. Put simply, an account can delegate operations to programmable software. This feature is intended to improve the flexibility of Ethereum accounts. But any mechanism for delegating authority creates serious consequences if the wrong party obtains the necessary authorisation.
According to TRM Labs, the attackers submitted 50 pre-signed authorisations associated with a Binance hot wallet. These covered a sequence of transaction counts, increasing the likelihood that one would match the wallet's state when the malicious transaction was submitted.
Once an authorisation succeeded, the account was delegated to attacker-controlled smart-contract code. That enabled subsequent transfers from the affected wallet. The delegation also remained active after the initial transaction, allowing further movements of assets that arrived later.
This does not establish a flaw in Ethereum's consensus rules or a general failure of EIP-7702. The relevant permissions were apparently used for a malicious purpose. The central unanswered question is how the attackers obtained those signed authorisations.
There is also a broader complication. On other blockchains, investigators observed ordinary signed transfers rather than the Ethereum-specific delegation mechanism. That suggests the investigation must consider a wider compromise of Binance's transaction-authorisation environment rather than attributing the entire incident to one Ethereum feature.
The lesson is important for exchanges and ordinary cryptocurrency owners alike. A transaction can be technically valid and still be criminal. The question is who had the authority to approve it — and how that authority was protected.
Where Did the Stolen Billions Go?
The conventional image of a bank robbery involves criminals escaping with physical money. A cryptocurrency theft creates a different challenge. The stolen assets can move rapidly, but their movements across public blockchains may remain visible.
Investigators can follow transactions, examine addresses and identify links to exchanges, trading services and earlier suspicious activity. What they cannot necessarily do is reverse the transactions. Nor does identifying a blockchain address automatically reveal the person controlling it.
Within hours of the Binance attack, blockchain intelligence firms and industry participants began tracing and restricting stolen assets. By 30 October, Binance reported that approximately $3 billion had been frozen on-chain. Elliptic independently verified around $2.84 billion in frozen assets at the time of its analysis.
Why were some assets easier to freeze than others? The answer lies in the differences between cryptocurrencies.
Certain centrally issued stablecoins have administrative mechanisms that allow their issuers to freeze identified tokens under particular circumstances. Stablecoins such as USDT and USDC are designed to maintain a value linked to a conventional currency, usually the US dollar. Their issuers may be able to prevent particular tokens from moving once an address associated with criminal activity has been identified.
Bitcoin does not have an equivalent central issuer able to freeze arbitrary balances. Native ether likewise cannot simply be frozen by instructing a stablecoin issuer to block it. For a criminal, therefore, the type of asset held can matter almost as much as its value.
Elliptic reported that some stolen stablecoins were converted into ether and other assets beyond issuer-level freezing mechanisms. Investigators also identified substantial movements of bitcoin. Those conversions can involve trading costs, market impact and additional traces for investigators to follow.
But one distinction must remain absolutely clear.
Frozen cryptocurrency is not necessarily recovered cryptocurrency.
If tokens are frozen at an address, the criminal may be unable to move them. That does not automatically restore them to Binance. Recovery may require cooperation between issuers, exchanges, law-enforcement authorities and other parties. It may also require legal processes.
And there is another distinction that matters even more when considering Binance's promise to customers. Replacing lost assets is not the same as recovering the original stolen assets.
Who Was Behind the Attack?
Independent investigators have identified evidence suggesting the involvement of a North Korean-linked hacking group. TRM Labs attributed the attack with high confidence to TraderTraitor, a group it associates with North Korea. Elliptic also reported evidence consistent with North Korean-linked activity, including connections between some funds and addresses associated with earlier suspected operations.
These findings are significant. North Korean-linked hackers have previously been implicated in major cryptocurrency thefts, including the February 2025 attack on Bybit.
But attribution is not a simple matter of discovering the criminal's identity attached to a transaction. Specialists examine operational patterns, transaction histories, technical evidence and connections to known infrastructure. Such evidence can support a strong assessment without identifying every individual involved or establishing their responsibility through a judicial process.
The Binance investigation remains open. Accordingly, TraderTraitor should be described as the group identified by blockchain intelligence analysts, not as the subject of an already concluded legal finding in this case.
For most customers, however, the immediate concern is simpler. If the exchange has lost billions, who will cover the financial damage?
Binance Says Customers Will Not Pay. What Does That Mean?
Binance has pledged to absorb the financial impact of the stolen assets rather than pass the direct loss on to its users. In its 30 October statement, the company said it had set aside more than $6.34 billion in company funds and had already covered approximately 80% of the affected amount.
On 31 October, Binance announced that the figure had increased to 90%. It said ten major affected assets, including BTC, ETH, USDT, BNB, SOL, USDC and XRP, were fully backed on its reported basis. The remaining assets were less liquid and could take longer to acquire.
Binance identified several sources of funding for the replenishment, including its corporate treasury, partial use of the Secure Asset Fund for Users (SAFU) and a portion of its Futures insurance fund.
These are company-reported measures, not proof that investigators have recovered the stolen assets.
Imagine a shop loses £10,000 in a robbery. The owner might recover the stolen cash. Alternatively, the business might replace the money from its own savings or an insurance payment. Either way, the shop's accounts may be restored. But in the second case, the original stolen money remains missing.
That is the essential distinction in the Binance story. When the company says 90% of the affected assets have been replenished, it is reporting that replacement backing has been arranged for that proportion of the loss. It is not reporting that 90% of the stolen cryptocurrency has been returned by the attackers.
This distinction matters because replacing assets can preserve customer balances while leaving the exchange exposed to a substantial financial cost. It also reveals another complication: acquiring replacement cryptocurrencies is not always straightforward.
The Hidden Cost of Replacing Less-Liquid Tokens
Buying a large amount of bitcoin or a major stablecoin may be comparatively straightforward in a liquid market. Buying an equally valuable quantity of a thinly traded token can be much harder.
Some digital assets have relatively little trading activity. If a buyer attempts to purchase a substantial amount quickly, there may not be enough sellers offering tokens at the current market price. The buyer may have to accept progressively higher prices. Economists call this *market impact*.
Binance has said that it is using both open-market and over-the-counter transactions to replace the affected assets. Over-the-counter, or OTC, transactions allow parties to arrange trades directly rather than placing every order into a public exchange order book. This can help manage the execution of large purchases.
It does not eliminate the underlying challenge of finding sufficient supply at an acceptable price. If an asset is scarce, replenishing large quantities may become expensive. Binance acknowledged that the remaining 10% of affected assets on 31 October consisted of less-liquid tokens that could take longer to source.
Could the purchases themselves affect market prices? In principle, yes. A large buyer can influence prices in a thin market. But determining whether Binance's purchases actually produced a material price movement in a particular token would require detailed trading evidence.
We should not mistake a plausible economic mechanism for a documented market event. The wider lesson is nevertheless valuable. A cryptocurrency's quoted price does not necessarily tell you how much it would cost to buy or sell an enormous quantity.
Liquidity matters. And when billions of dollars are involved, it matters enormously.
Is Your Cryptocurrency Actually Safe?
The Binance incident has revived a question that every digital-asset owner should be able to answer. Who controls the keys required to move your cryptocurrency?
Broadly, investors face two main custody arrangements.
With a centralised exchange, the platform manages the custody infrastructure. Customers see balances and use an account to request transactions. This arrangement is convenient. But it creates reliance on the exchange's security, financial condition and ability to process withdrawals.
With self-custody, the individual controls the private keys or recovery credentials necessary to access the assets. That reduces certain institutional dependencies. It also transfers substantial responsibility to the owner.
An exchange may be hacked, encounter financial difficulties or suspend withdrawals. A self-custody user may disclose a recovery phrase, sign a malicious transaction or lose access through an irreversible mistake. Neither approach is risk-free.
The important thing is to understand which risks apply to the arrangement you use.
What about hardware wallets?
For long-term holders, a reputable hardware wallet may provide protection against certain types of malware and private-key compromise. Such devices are designed to keep sensitive signing credentials isolated from an everyday computer or phone.
But a hardware wallet is not a guarantee of safety. If the recovery phrase is disclosed, the assets can be compromised. If the owner authorises a malicious transaction, the device may sign an instruction that enables a loss. If both the device and the only usable recovery information are lost, access to the funds may become impossible.
A hardware wallet reduces particular security risks. It does not replace informed judgement.
Ten Practical Ways to Protect Your Crypto
No individual measure can eliminate every risk, but the following precautions can reduce exposure to common forms of theft and fraud.
1. Understand who holds your keys
Determine whether your cryptocurrency is held by a custodian or in a wallet you control. Understand how access, withdrawals and recovery work before transferring substantial assets.
2. Secure your accounts
Use a unique password for every exchange and a reputable password manager where appropriate. Enable passkeys or an authenticator app when supported. Protect the email account associated with your exchange account just as carefully.
3. Never disclose your recovery phrase
Do not enter a recovery phrase into a website reached through an unsolicited message, share it with customer support or store it casually in screenshots. Anyone who obtains the phrase may be able to reconstruct access to your wallet.
4. Consider suitable offline key storage
For funds held over longer periods, consider whether a hardware wallet is appropriate for your experience and needs. Purchase through a trustworthy source and follow the manufacturer's official instructions. Make sure your recovery procedure works before transferring large sums.
5. Verify addresses and networks
Before sending cryptocurrency, check the recipient's address, network and asset. An unfamiliar destination may justify a small test transaction first, although a successful test does not establish that the recipient is trustworthy.
6. Ignore emergency transfer demands
Criminals may impersonate exchange employees after a major security incident. Do not transfer assets to a supposed safety wallet or reveal credentials to claim compensation. Access services through independently verified official channels.
7. Review devices and permissions
Check authorised account devices, login history, withdrawal settings and active API keys. For self-custody wallets, review connected applications and token-spending approvals. Remove permissions that are unnecessary or suspicious.
8. Keep software updated
Install security updates for your operating system, browser and wallet applications. Avoid suspicious downloads, pirated software and unknown browser extensions. A compromised device can undermine otherwise sound security practices.
9. Avoid excessive custody concentration
Keeping every asset on one platform creates dependence on that provider. Different custody arrangements may reduce some risks, but they also introduce complexity and possible mistakes. Choose arrangements you can competently manage.
10. Prepare before an incident occurs
Know how to contact your provider and preserve records of relevant transactions. If you suspect unauthorised access, protect your remaining accounts and report the incident promptly. Avoid supposed recovery experts who demand advance payments or guarantee that they can reverse blockchain transactions.
A second scam often follows the first.
What Binance Customers Should Do Now
For customers affected by uncertainty surrounding the incident, the first priority is reliable information. As of 31 October, Binance said it had replenished 90% of the affected assets and remained on track to resume withdrawal services on Sunday, 1 November, subject to final security checks. That was the company's stated timetable, not confirmation that withdrawals had already resumed.
Users should consult official Binance announcements for the current service status. They should review login activity, authorised devices, authentication methods, email security and any active API keys. Suspicious activity should be reported through official support channels.
Customers should also remain alert to fake compensation schemes. A legitimate response to a security incident does not require the disclosure of private keys or recovery phrases to an unknown person.
Those considering self-custody should avoid rushed transfers to unfamiliar wallets. A transfer made under pressure can create new risks, particularly when the user has not tested the receiving wallet or secured its recovery information.
Binance also announced a new Proof of Reserves snapshot taken at 00:00 UTC on 31 October. The exchange said the complete zero-knowledge proof would take approximately 40 to 50 hours to generate, with availability estimated for 3 November. Until that process is complete, a published snapshot should not be confused with completed cryptographic verification.
And even when the proof becomes available, it will not constitute a comprehensive independent audit of every operational, cybersecurity or financial risk. Proof of Reserves is useful within its defined scope. It is not a universal safety guarantee.
British Investors: Do Not Assume Your Crypto Is Protected
For readers in the United Kingdom, another misunderstanding deserves particular attention. Many people are familiar with the Financial Services Compensation Scheme, which can protect eligible customers of certain regulated financial firms under specified circumstances. They may assume that cryptocurrency holdings receive similar protection.
Generally, they do not.
The Financial Conduct Authority warns that direct investments in cryptoassets are high-risk and that consumers are unlikely to have access to the Financial Services Compensation Scheme or Financial Ombudsman Service for most crypto-related activities. The precise position depends on the firm, the service and the regulated activity involved.
The existence of an FCA registration or the use of familiar financial terminology does not automatically mean a cryptocurrency investment has the same protections as an eligible bank deposit.
Binance's promise to cover the losses arising from this particular incident is a corporate commitment. It is not a universal compensation guarantee for cryptocurrency investors.
Before placing substantial funds on any platform, investors should understand which legal entity provides the service, how their assets are held and which protections actually apply.
These questions may seem less exciting than the latest rise in Bitcoin's price. They become much more interesting when something goes wrong.
What the Binance Attack Means for the Industry
The immediate financial cost of the incident is extraordinary. But its consequences extend beyond the stolen assets.
Binance must investigate the compromise, strengthen affected systems, manage replenishment and restore normal operations. Customers and regulators will want to understand what failed and whether the same weaknesses could be exploited again.
The broader industry faces questions about online wallet exposure, transaction-signing safeguards, operational permissions and the speed at which unusual withdrawals are detected.
How much value should an exchange hold in internet-connected wallets? How should critical authorisations be separated between systems and personnel? What transaction limits and monitoring controls are appropriate for institutions holding billions of dollars? And how should exchanges demonstrate that security problems identified during a major incident have been properly addressed?
These are questions of governance as well as technology.
The cryptocurrency industry frequently promotes the removal of traditional financial intermediaries. Yet centralised exchanges are intermediaries themselves. Their users depend on institutional security, liquidity and operational reliability.
The Binance incident reveals how significant that dependence can become.
The Questions Binance Still Has to Answer
Several central questions remain unresolved.
How did the attackers gain access to the authority needed to produce valid transactions? What was the precise role of the compromised DevOps laptop? How did the compromise affect wallets across different blockchain networks? Why did operational safeguards fail to prevent transfers of such magnitude?
How much of the frozen cryptocurrency can ultimately be returned? Will investigators establish the identities of the perpetrators beyond the current intelligence-based assessments? And what independent evidence will demonstrate that the underlying security weaknesses have been corrected?
Binance has promised a fuller technical report. That document will be essential to assessing the final causes and consequences of the attack.
Until then, preliminary explanations should remain preliminary. There is no need to invent answers where the evidence has not yet produced them.
The Most Expensive Lesson in Crypto Security
Six point three billion dollars. The figure will remain associated with the Binance attack for years to come. But the most important lesson may be more fundamental than the amount stolen.
A secure blockchain does not automatically mean a secure exchange. A company's promise to reimburse users does not mean the original stolen funds have been recovered. And control over a personal wallet does not guarantee safety if the owner mishandles its recovery information or authorises a fraudulent transaction.
The right response is neither panic nor blind confidence. It is understanding.
Know who controls your assets. Know how transactions can be authorised. Know what protections apply. And know what you would do if one of the systems holding your money stopped working tomorrow.
The Binance investigation is far from complete. Its ultimate findings may change our understanding of precisely how the attackers succeeded.
But one lesson is already clear.
In cryptocurrency, security is not simply about protecting a digital wallet. It is about understanding who — or what — has the power to open it.