Robotic hand picking up coins beside a stack, illustrating an automated withdrawal process.

Facts current as of 11 a.m. ET, Oct. 30, 2026.

The short version: On Oct. 29, 2026, attackers took an estimated $6.3 billion from Binance, the largest crypto theft on record. Binance says it may have started with one engineer's infected laptop, which let the attacker reach an automated system that apparently handled withdrawals. It has seen no sign its wallet keys leaked, and it says it will cover customers' losses.

On Oct. 29, 2026, attackers took an estimated $6.3 billion from Binance, the world's largest cryptocurrency exchange. It's the largest crypto theft on record. Binance says about $3 billion has been frozen and that it will cover customers' losses. Bitcoin, which was already sliding that week, dipped to roughly $76,400 overnight.

Binance hasn't published a full explanation yet, and it has since said the attack was more complex than a single step. So what follows is our educated guess, based on its early statements. It isn't confirmed.

What probably happened

Picture Binance as a bank with an automated back office.

One laptop got infected. Binance says the attack may have started with the laptop of an engineer who keeps its systems running. The usual ways in are a convincing fake email, a fake job offer that comes with a "coding test" (a trick security researchers tie to North Korean hackers), or a booby-trapped download.

The attacker looked like an employee. That laptop was already signed in to work systems, so whoever controlled it could pass as trusted staff.

They found the right clerk. Binance says the attacker reached what's called a service container. Think of it as one automated back-office worker with a single job. This one apparently handled withdrawals, so it was already allowed to send money out.

They never needed the vault keys. Binance says it has seen no sign that the master codes to its crypto wallets leaked. That fits our guess: the attacker handed the clerk fake withdrawal orders, and the clerk did what it was built to do.

It was planned. Most of the money left in about 20 minutes. In all, it moved across 10 different crypto networks, including a smaller second wave about three hours later. That kind of speed points to a script written in advance, after the attackers had quietly studied the systems.

In short, they didn't break into the vault. They tricked the clerk who's allowed to open it. One laptop could reach too much, and the withdrawal system seems to have trusted requests from inside without a second check, like a person signing off or a cap on unusually large transfers.

Binance hack FAQ

What happened in the Binance hack? On Oct. 29, 2026, attackers took an estimated $6.3 billion from Binance, the world's largest cryptocurrency exchange. It's the largest crypto theft on record. Most of the money left in about 20 minutes. In all, it moved across 10 different crypto networks, including a smaller second wave about three hours later.

How did the attackers get in? Binance says the attack may have started with the laptop of an engineer who keeps its systems running, and that the attacker reached a service container, an automated back-office worker that apparently handled withdrawals. Binance has since said the attack was more complex than a single step and hasn't published a full explanation. Beyond that, it's our educated guess: the infected laptop let the attacker pass as trusted staff.

Were Binance's wallet keys stolen? Binance says it has seen no sign that the master codes to its crypto wallets leaked. Our educated guess is that the attacker never needed them. The attacker handed the automated withdrawal system fake orders, and it did what it was built to do.

Will Binance customers lose money? Binance says about $3 billion has been frozen and that it will cover customers' losses.

What should a small business take from it? One laptop could reach too much, and the withdrawal system seems to have trusted requests from inside without a second check.

Concerned about cybersecurity? Get a cybersecurity assessment from MQUAL

MQUAL has worked with businesses across the U.S. since 2006 and is based in Clearwater, Florida. We can look at who in your company can reach what, and where a second check would help. If you're adding AI tools, our AI security assessment can also make sure they aren't opening new doors.

Schedule a 15-minute discovery call or call 844-724-8251.

This article is for general information only and is not financial or investment advice.

More in Cybersecurity