Guide · Developer security · as of 30 October 2026
On the night of 29 October 2026, about $6.3 billion left Binance’s hot wallets in what analysts are calling the largest crypto theft on record. Binance’s first finding is not a stolen key. It is a compromised engineer’s laptop. Here is what Binance and the on-chain investigators have said so far, why the Bybit theft of February 2025 followed the same path, and the changes any team that holds valuable credentials on developer machines should make this week.
What Binance has said
In a statement posted early on 30 October, Binance wrote that its “initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.” It added: “We have found no evidence of any wallet private key leak.” Binance put the affected assets at about $6.3 billion and said roughly $3 billion had been frozen on-chain with the help of stablecoin issuers. It will cover user losses from its Secure Asset Fund for Users, set up in 2018, and from company funds. Withdrawals were suspended while the withdrawal service is rebuilt; deposits kept running, and Binance said it expected withdrawals back within about 48 hours. A full technical post-mortem and an updated proof of reserves are promised once the facts are verified. Everything above is Binance’s preliminary account, in its own hedged words. Treat it as the best current reading, not the final one.
The timeline so far
times in UTC (Dubai is four hours ahead)
How a laptop reaches a hot wallet
An exchange hot wallet does not hand its private key to engineers. It sits behind a withdrawal service: code that is allowed to ask the wallet to sign. Binance’s statement says the attacker got into a container running that kind of service, through the engineer’s laptop, and used it to submit withdrawals. That is why no key had to leak. Blockaid’s trace adds the on-chain half. EIP-7702 lets an ordinary Ethereum account delegate its execution to a contract, but each authorisation must match the account’s current nonce, a counter that moves with every transaction. Binance 14 was busy processing withdrawals, so the attacker could not know its nonce. They sent 50 authorisations covering 50 consecutive nonces in one transaction. One matched. That one pointed the wallet at an unverified contract with a sweep function, which moved out the ETH and the tokens and left 1 ETH behind for fees. The contract had been deployed hours earlier, funded through Tornado Cash. What Binance has not yet explained is how the attacker obtained the signed authorisations in the first place. That is the question the post-mortem must answer, and until it does, the service-container account remains a hypothesis Binance itself calls preliminary.
Bybit
February 2025 · the same shape
The largest theft before this one started the same way. On 4 February 2025 a developer at Safe{Wallet}, the multi-signature wallet Bybit used for its cold storage, ran a malicious Python project with Docker logic on a macOS workstation; the file talked to a domain the attacker had registered two days earlier. From 5 February the attacker reused that developer’s live AWS session tokens, tried and failed to register their own MFA device, and spent two weeks mapping the environment. On 19 February malicious JavaScript appeared in the Safe{Wallet} front end served from AWS. On 21 February Bybit’s signers approved what looked like a routine transfer; the altered page had swapped the destination. About 400,000 ETH, worth roughly $1.5 billion, left in one transaction, and the script was scrubbed minutes later. Safe’s review found no vulnerability in its contracts or its front-end code: the attack was “achieved through a compromised Safe{Wallet} developer machine.” The FBI attributed it to North Korea’s TraderTraitor. No key leaked then either. The machine that was trusted to serve the signing page, and the machine that signed, were enough.
What froze, and what cannot
Who it points to
TRM Labs attributed the theft to TraderTraitor, the North Korean unit behind Bybit, with “high confidence”. The investigator ZachXBT named Lazarus Group as the likely attacker, and Blockaid’s Ido Ben-Natan said the tactics are consistent with North Korean operations. Binance has not named anyone; it says it is working with law enforcement to identify the attackers. For scale: TRM Labs counted $2.9 billion stolen across nearly 150 crypto attacks in all of 2025. If Binance’s figure holds, this one incident is more than double that year.
The pattern
Read the two incidents together and the lesson is uncomfortable for every engineering team, not just exchanges. In both cases the cryptographic core did what it was designed to do. The weak point was the ordinary machine that is allowed to talk to it: a laptop with live cloud sessions, access to internal containers, and a person who sometimes runs code they did not write. That same laptop is where the year’s other big campaigns went hunting. The npm worms and the GhostAction attacks of 2025 and 2026 were built to steal exactly these things: cloud credentials, session tokens, SSH keys, package-publishing tokens and the sign-in files of AI coding tools. A developer workstation now holds more reach than most production servers did ten years ago, and it is patched, monitored and segmented far less.
What to do this week
Why this matters to us
We are an AI lab in Dubai, and the AI agents we build run on exactly the kind of machine this guide is about, with cloud sessions, package managers and API keys within reach. So the controls above are not advice from the sidelines; they are the ones we hold our own agents to, including scoped credentials, a cooldown on every dependency and a human in front of anything that spends or ships.
Sources
read 30 October 2026
A question?
Tell us how your team’s machines reach your cloud, your pipeline and your money, and we will tell you honestly where one laptop could become the vault.