Kaand Report Case File #001. Last updated October 31, 2026. This story is moving fast, and we will update this post as facts change. This is news and education, not financial or legal advice.

At 1:35 am India time on October 30, money started leaving Binance. Within about 20 minutes, most of it was gone. When the last transfer landed nearly four hours later, the loss stood at about $6.3 billion, or roughly ₹60,000 crore. By value at the time, that makes it the largest crypto theft on record, about four times the size of the Bybit hack in 2025.

Then came the strange part. Binance says it has found no evidence that its wallet private keys leaked.

If you have spent any time around crypto, that sentence should bother you. Funds move when a valid signature authorises them, and signatures come from private keys. So either the keys did leak and nobody has proved it yet, or someone got valid signatures without ever touching a key.

We read everything we could find from the people closest to this: Binance's own updates, the analyses from TRM Labs, Chainalysis and Elliptic, the Ethereum proposal at the centre of the attack, and the US government's record on the group being named. Here is what holds up.

A note on our labels. Confirmed means the party concerned said it, or two independent sources agree. Alleged means an accusation or assessment nobody has proven. Unverified means one source, or something we cannot check yet.

The short version

• Confirmed: about $6.3 billion left Binance hot wallets across at least ten blockchains.
• Confirmed: around $3 billion has been frozen. Frozen does not mean recovered.
• Alleged: the attacker made Binance's own signing system approve the transfers.
• Alleged: North Korea did it. Tracing firms say so, but no government has.
• Unverified: that users will be made whole. Binance has promised it, but nobody outside can check it yet.
• Not published: a root cause. Binance has not given one.

It started 36 hours earlier

Everyone dates this hack to 1:35 am. The blockchain tells a longer story.

According to TRM Labs and Elliptic, on-chain preparation began at least 36 hours before. Three small withdrawals from Tornado Cash funded an operator wallet, which hid where the money came from. About four hours before Binance was hit, the attacker ran a full rehearsal on another wallet and routed the test money back to itself. Confirmed.

That 36 hours is only the part visible on a public ledger. Nobody has said how long the attacker was inside Binance's systems. In the Bybit case, attackers spent more than two weeks inside a vendor's cloud account before they struck.

Was it really one laptop?

Binance's first update said early findings suggest a compromised DevOps engineer's laptop may be involved, and that it gave access to a service container which submitted the withdrawals. Notice the hedging. Unverified.

The internet ran with it anyway: one laptop, one engineer, billions gone. Binance has since pushed back. Co-CEO Richard Teng said this was more than one engineer's permissions and more than a single action, and that no individual is being held responsible. Binance also says it has found additional points of breach. It has not said what they are. Confirmed.

One piece of context is worth knowing. Back in 2022, the FBI, CISA and the US Treasury warned that North Korean hackers target DevOps and IT staff with fake recruitment offers. Nothing shows that is what happened here. But it is not a new playbook.

The machine, not the key

Here is the detail that makes this case so unusual. The affected wallets used different chains, different key types and different signing schemes, yet they all produced valid signatures for one attacker within about half an hour. A single stolen key does not easily explain that.

TRM Labs' assessment is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing. Elliptic and the security firm Blockaid read it the same way. Alleged.

Think of a bank's cheque-signing machine. The signature never leaks. Someone simply gets their own cheques in front of the machine.

It is a neat theory, and it is still a theory. Binance has not published a root cause, and not everyone agrees. Mark Karpeles, the former head of Mt. Gox, told Reuters he thinks the attacker likely found the key, although part of his reasoning conflicts with what TRM Labs and Elliptic saw on-chain. So treat "no key leaked" as Binance's finding so far, not as an established fact.

Fifty tickets for one moving number

The cleverest part happened on Ethereum, using a feature called EIP-7702. It lets a wallet sign an authorisation that points the account at a smart contract. After that, the account runs that contract's code.

There is a catch. The authorisation only works if it matches the wallet's current transaction counter, and a busy exchange wallet's counter never stops moving. Think of the token display at a bank.

So, according to TRM Labs and Elliptic, the attacker brought 50 signed authorisations covering 50 consecutive numbers. Under the rules, a wrong one is simply skipped. One matched. About three and a half minutes later, a single transaction moved 167,464 ETH and about 1.6 billion USDT, worth $2.53 billion on Elliptic's count. Confirmed. Binance itself has said this delegation did not go through its normal approval controls.

The delegation also does not expire by itself. The proposal's first draft was temporary, and persistent delegation was added on purpose. So when new money reached that wallet, it was swept again, and again. The proposal warns about exactly this kind of change, noting that once delegated, "any call to the account may also cause the balance to decrease".

To be clear, Ethereum was not hacked, and neither was EIP-7702. The rule worked as written. Blockaid's chief executive says the funds could have been stolen without it, and that it simply offered a way to do so in one sweep.

Did the pause stop it?

Binance said outflows stopped when it paused withdrawals. The pause was in place by 22:33 UTC at the latest. TRM Labs, however, logs sweeps at 22:39 and 23:56 UTC, which is 5:26 am in India. Confirmed for the sweeps.

Our reading, not a finding: the pause stopped Binance's withdrawal service, but a delegated wallet no longer needed that service. Binance has not addressed this, and we would like to hear its explanation.

A race against the freeze

Stablecoins such as USDT and USDC have companies behind them that can freeze funds. Bitcoin and Ether do not. That turned the next few minutes into a race.

Tether made its first freeze 37 minutes after the main sweep, and Circle followed three minutes later. The attacker was selling as fast as it could. Chainalysis says one trade turned $325 million of stablecoins into about $285 million of ETH, giving up about $40 million in a single move to stay ahead. Confirmed. Elliptic puts the loss across all such swaps at 12% to 26% below market. Unverified, Elliptic only.

The race mostly went against the attacker. Around $3 billion is frozen, which Elliptic's count puts at about 44% of the loss. In the Bybit hack, only about 3% was frozen in the early days. The difference comes down to what was stolen: Binance lost billions in freezable stablecoins, while Bybit's loot was mostly ether.

Two warnings, though. Frozen is not recovered, and Binance has not said how much has actually come back. And billions remain in assets no issuer can freeze. The bitcoin and XRP had not reached any service when Elliptic last checked.

Was it North Korea?

Nearly every headline says yes. The evidence deserves a closer look.

TRM Labs and Chainalysis attribute the hack to TraderTraitor, a North Korean hacking cluster that the US government has named publicly. TRM Labs cites off-chain intelligence that is not public, so nobody outside can check it. The strongest public evidence is that stolen Binance funds were mixed in several wallets with funds from last month's Bitget theft. Alleged.

Elliptic also calls North Korea the likely culprit, but it gives reasons for caution. The overlap with Bitget is small, laundering networks can serve more than one client, and this attacker was unusually slow to convert stablecoins for a group known for speed. There is another weak link: no government has attributed the Bitget theft either. So one firm-attributed theft is being linked to another.

As of October 30, no government has named anyone. The FBI says only that it is aware of the incident. That silence proves little this early, because the FBI took five days to name North Korea over Bybit. But for now, this is an allegation, and we will call it one.

The attacks are moving away from the key

This part is our own analysis, so read it that way.

Look at the big thefts in order. At Ronin in 2022, attackers took validator keys. At WazirX in 2024 and Bybit in 2025, the keys stayed safe, and humans were shown a screen that did not match what they were signing. At Bitget last month, the approval process was fed spoofed data. At Binance, allegedly, the signing system itself did the work.

Each step moves further from the key. The industry spent years protecting the secret. The attackers seem to have moved on to whatever uses the secret.

If you have money on Binance

Binance says it will absorb the loss, and that it has set aside more than $6.34 billion, not counting frozen funds. That is a strong statement, and also still a promise. Binance has not shared the wallet addresses, and the security firm CertiK said it needed more information to verify the figure. Unverified.

For scale, the bitcoin stolen came to 18,270 BTC. Binance's SAFU emergency fund held about 15,000 BTC as of February. And the latest audit on its Proof of Reserves page is still dated October 1, before the hack.

The real test comes next. Binance is targeting a phased restart of withdrawals around November 1, with reserves results by November 2. Users cannot truly test the promise until they can withdraw.

If you are in India, keep this in mind. Crypto here has no statutory deposit insurance, and lawyers told Moneycontrol the pledge is an assurance, not a guaranteed legal right. Binance's FIU-IND registration is an anti-money-laundering duty, and we do not read it as a safety guarantee. We found no statement yet from FIU-IND, RBI, SEBI or CERT-In on this incident.

Here is what we would do:

• Save your statements, transaction history and support messages.
• Check balances only through the official app or a site you already trust.
• Treat every "refund" or "recovery" message as a scam, and never share a password, code or recovery phrase.
• If you see unauthorised activity on your account, report it at cybercrime.gov.in or call 1930.

If you build systems

• Treat developer laptops as a route into production. Even if the laptop turns out to be a small part of this, it is a common way in.
• Treat access to a signing system like access to the key. If a system can sign in your name, it is your key in every way that matters.
• Keep the blast radius small. TRM Labs advises separating signing infrastructure by chain and wallet tier, so one breach cannot reach everything.
• Watch delegations as well as transactions. Any wallet that can be delegated needs a plan for spotting and revoking it fast.

What we still do not know

• What the additional points of breach are
• How the laptop was compromised, or whether it was the real entry point
• How the attacker reached the signing system, or whether that theory is right
• How long the attacker was inside
• How much has been recovered, not just frozen
• Whether any government will attribute the attack

Case status: open

Binance has promised further technical findings by about November 2, and a full post-mortem with no date yet. When they land, we will reopen this case and update this post. If the facts prove us wrong, we will say so here.

Follow Kaand Report at @kaandreport on Instagram and YouTube for real hacks, properly explained.

Sources

From Binance

• Security incident, first update
• Update #2
• Proof of Reserves

Investigations

• TRM Labs analysis
• Elliptic analysis
• Chainalysis analysis
• TRM Labs on the Bitget theft
• Sygnia on the Bybit hack

Official records

• EIP-7702
• CISA advisory on TraderTraitor
• FBI on Bybit
• FBI on Ronin
• US, Japan and South Korea statement, including WazirX
• FIU-IND order on Binance

Reporting and company statements

• Reuters: analysts react
• Cointelegraph: as it happened
• Cointelegraph: how it unfolded
• Cybersecurity Dive
• CoinDesk on SAFU
• Moneycontrol: what Indian users can do
• Bybit's incident timeline
• WazirX's preliminary report