Twenty Minutes, Ten Blockchains, $6.3 Billion: Anatomy of the Binance Hack

At 20:05 UTC on Thursday, 29 October 2026, the largest theft in the short history of crypto began. Most of it was over in about twenty minutes. Binance says roughly $6.3 billion left its wallets, and the blockchain analysts at TRM Labs, whose tally runs slightly higher, count the outflow across ten separate networks. Under the floor, the pipes had already begun to make their sound.

The First Twenty Minutes

The clock below comes from TRM Labs' reconstruction, and this article follows it. Five Binance wallets on the XRP Ledger sent 233.46 million XRP between 20:05 and 20:09 UTC. Shortly after 20:10, Solana and Optimism were drained. At 20:20 a Bitcoin hot wallet sent out 18,270 BTC. Within two minutes, a Tron hot wallet sent 612.7 million USDT and 46.4 million TRX. A second wave, around 23:05 UTC, reached wallets on Avalanche and Polygon. The TRM Labs account of the theft puts most of the value out within about 20 minutes of the first transfer.

Twenty minutes is a strange unit for an institution that guards other people's money. Stranger still is the speed. In that short span, most of the value left across ten networks.

Imagine a compliance analyst on the night shift, watching a screen that has been quiet all evening. At 21:00 UTC the screen still shows a normal day, and the analyst is reading history without knowing it. The scene is invented to make the timing felt. It records no one's actual evening. What is reported is simpler and worse: most of the value, by TRM's account, left the Binance wallets within about twenty minutes of 20:05 UTC, and the first issuer freeze came at 21:01 UTC (TRM).

The Ledger of Twenty Minutes

Numbers are the characters of this story, and they change as you hold them up to the light. Binance's headline figure is about $6.3 billion, according to Al Jazeera's account of Binance's statement, which also reports that Binance warned the figure could rise. TRM puts it at about $6.36 billion at the prices of the moment of transfer, and about $6.23 billion at later prices. All of these figures are provisional, and they are still moving.

The ten chains are the Ethereum, Bitcoin, XRP Ledger, Tron, Solana, Optimism, Arbitrum, Base, Avalanche and Polygon networks. Per TRM's tally as of 00:30 UTC on 30 October, Ethereum accounted for about $3.79 billion. Bitcoin held 18,270 BTC, worth about $1.47 billion. Tron about $628 million, the XRP Ledger about $296 million, Solana about $96 million, and the three layer-two networks Arbitrum, Optimism and Base together about $39 million. Avalanche held about $28 million and Polygon about $10 million.

Ethereum alone held more than the other nine networks put together, which together come to roughly $2.57 billion. The house was not one large room with many small ones. It was one great room, and everything else was a corridor.

The second surprise is the comparison. Al Jazeera reports that the theft "dwarfs the previous record of $1.5bn, which was stolen from the exchange Bybit in February 2025." Set against that figure, the $6.3 billion headline is roughly four times larger. That multiple is my own arithmetic (about 4.2 on TRM's $6.36 billion), not a figure stated by either outlet. It is the sentence every reader will repeat, and the arithmetic holds. The comparison alone, though, says little about how either theft began, and the rest of this story turns on that question.

Why a Laptop Beats Cryptography

Binance's own account of the cause is the most important paragraph in the case, and it is also the least finished. According to BleepingComputer's report of the company's statement, access began with the compromised laptop of a DevOps engineer. From there the attacker reached a service container and used it to submit unauthorised withdrawal transactions.

At the level the public record supports, the logic is simple. A crypto exchange is not a vault with one door. It is a set of systems that hold keys, and other systems that are allowed to ask those keys to approve things. A digital signature is strong, but its strength is a strength about secrets: nobody forges one without the key. The attacker's question is different. It is not "can I break the mathematics?" It is "which machine is allowed to ask for the signature, and can I become that machine?" In my judgment, a laptop belonging to a person who maintains the infrastructure is, almost by design, a machine that is allowed to ask.

That is why I call this the human-laptop problem, and why it is older than blockchains. A bank's vault is only as strong as the procedures that open it, and the procedures are carried out by people with screens. Cryptography does not care who is holding the keyboard. The system does.

Binance has said more since the first statement. Its co-CEO, Richard Teng, was quoted by BleepingComputer saying that the company had "uncovered additional points of breach," and that the attacker did not simply use the permissions of one engineer. Binance also says it has found no evidence of a leaked wallet private key. Those two statements pull in different directions, and both may be true.

Teng also said, as quoted by Yahoo Finance, citing Bloomberg reporting, "This was a complex attack," and that "the attacker also used a self-destruct mechanism that destroyed tooling and tracers." That is Binance's description, not an independent finding. Judgment, not fact: the more an attacker can erase, the more the public must rely on analysts and on the company's word.

Al Jazeera also reports that Mark Karpeles, the former head of Mt. Gox, told Reuters that attackers had probably accessed keys for at least two wallets. That is Karpeles's claim, not Binance's, and it has not been verified.

Who Did It, and How Sure Anyone Is

Attribution is the part of the story most likely to be repeated as fact, and it is the part that least deserves to be. What the record supports is narrower. TRM Labs attributes the theft to a group it calls TraderTraitor, which it describes as North Korea's hacking unit, and it says it reached that conclusion "with high confidence," based on "robust on and off-chain intelligence." Chainalysis reached the same conclusion, reported by BleepingComputer as "with a high degree of confidence." Elliptic has also linked the theft to North Korean hackers, according to Yahoo Finance. The same group is tracked under other names, including the Lazarus Group and APT38.

These are private analysts' assessments. They are not court findings. Binance has not attributed the attack, and Teng said the company's investigation "has not attributed responsibility to any individual," according to Al Jazeera. No government has been reported as attributing this theft in the sources cited here. North Korea routinely denies involvement in hacking.

What the on-chain record does show is preparation. TRM says the preparation was visible on-chain at least 36 hours before the theft. Beyond that, the mechanism stays out of print. The point is that the staging was visible in public before the money moved.

"When North Korea steals at this scale, the money funds weapons proliferation and other destabilising activity." This is Ari Redbord, TRM Labs' global head of policy, quoted by Al Jazeera. It is a claim about where the money might go, made by a company that sells tracing services, and it should be read in that light.

The Freeze, and the Money Beyond Reach

The surprise of the night was not the theft. It was the freeze. Issuers of stablecoins, the dollar-pegged tokens that move so easily between wallets, hold a power that a thief does not always expect: they can freeze tokens they issued. TRM's timeline shows Tether freezing 971.1 million USDT at 21:01 UTC, about an hour after the first transfers. Circle froze 823 million USDC at 21:04 UTC. Ripple froze 40.5 million RLUSD at 22:01 UTC. World Liberty Financial froze 27.8 million USD1 at 22:10 UTC. At 00:08 UTC the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB, about $30 million. TRM is the source for every one of those timestamps.

According to TRM, Binance said at 23:35 UTC that verified frozen funds had reached $2.54 billion, and TRM itself counted about $2.7 billion at 00:30 UTC. Later, Binance said about $3 billion had been frozen on-chain so far, with help from Tether and Circle. Those figures moved upward through the day, and they should be read as a snapshot, not a settled total.

Tether's chief executive, Paolo Ardoino, said the company had frozen more than $1.567 billion of USDT tied to the hack. Circle's chief executive, Jeremy Allaire, said Circle had frozen another $800 million in coordination with law enforcement. Those numbers, as reported by Yahoo Finance, do not obviously reconcile with TRM's figure of about $1.77 billion in total Tether freezes. A plausible reading, which neither source confirms, is that several freezes at different times make up the total. The difference is flagged here, not resolved.

Yahoo Finance also reports that Elliptic estimated about 44 percent of the stolen assets had been frozen, nearly all of them stablecoins, and that the attackers still controlled more than $3 billion that the issuers could not freeze directly. TRM's own tally is that the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond the reach of any issuer.

So who really holds the money? Not the exchange alone, and not the thief alone. The exchange holds the customer ledger and promises to make it whole. The issuers hold a freeze switch over some tokens. The attacker holds the unfrozen remainder, including Bitcoin, which no stablecoin issuer can freeze. The house has more than one set of keys, and the freeze is a power others hold.

Binance has said it will cover the losses. Teng told the press, as quoted by Yahoo Finance, "We are committed to covering all hacked losses through our company funds. Your assets are safe." Binance has also said it will publish an updated proof of reserves after remediation, as BleepingComputer reports. These are promises, not audits, and they are worth reading as the company's stated plan, not as a verified fact about the balance sheet.

Kenya's Wallet, and the House With One Plumbing

For a Kenyan user, the hack's first meaning is simple and uncomfortable. The exchange is a trusted room. You do not see its pipes. You see a balance, and you believe the balance is yours because the room says so. The whole model of trusting an exchange rests on the sentence "your assets are safe," and this week that sentence was tested by a stranger in the walls.

Withdrawals were suspended, and three different timetables have been reported. A service update from Yi He, Binance's co-CEO, posted at 04:17 UTC on 30 October, said withdrawals should resume within 48 hours, as Business Upturn reported. Yahoo Finance reports Yi He saying withdrawals should resume by Sunday, 1 November. Al Jazeera reports Binance expecting to resume withdrawals within 45 hours. These windows conflict, and resumption had not been confirmed when this was written.

In my judgment, no legitimate recovery process asks a user to send a fee to a stranger, and anyone offering to "unlock" frozen funds is selling the same thing as every other scam.

The trust-the-exchange model has a plain weakness. Users trust the room because it is large and famous, and because its pipes are hidden. Judgment, not fact: a large brand's balance sheet and a small team's laptop are part of the same house, and the house is only as secure as its least examined door. The better question is not whether crypto works. It is who may ask the machine to sign.

For banks, the lesson is less exotic than the headlines. My view: the strongest controls in the world can be bypassed through a service account, a developer's machine or a stored batch of permissions. Segregation of duties and monitoring of approvals are not new, nor is the assumption that any single endpoint will eventually be compromised. What is new is the speed. Most of the outflow happened in about twenty minutes. The first issuer freeze came about an hour after the first transfers (TRM). Binance's laptop account appeared in print on 30 October, when BleepingComputer reported it.

For agents, the lesson is sharper, and it is my view as well. An autonomous system that can sign payments is a service container with a signing key and a voice. Every such agent will need the same questions answered before it touches money: who can instruct it, what it may approve in a single action, and how a human can stop it when the instruction looks wrong. The Binance case is a reminder that the most valuable thing in a payment system is not the key. It is the permission to ask for the key.

Finally, the figures are still moving, and any writer who promises a final total is selling something. Binance's own explanation has changed in its details. Analysts disagree on the frozen share and on the exact size of the unreachable remainder. The honest form of this story is therefore a set of dated claims, each with its source and its confidence attached.

Imagine a trader in Nairobi, a composite invented for this scene and not a real person, opening the app on a Friday morning. The balance is still there. The withdrawal button is grey. The ledger keeps counting, as ledgers do, while the company checks its pipes and promises to reopen the valve on a timetable its executives have described in conflicting terms. The trader waits. So does the house, like every house with one plumbing, listening for water in the walls.

Editorial note: This essay expresses the founder’s ideas, developed with AI-assisted research and writing (parallel Claude Haiku 5.5 agents) and checked against the linked sources on 30 October 2026. Convictions, proposals and forecasts are identified in the text; scenes framed as imagined are illustrative. This is a developing story: figures were still changing at the time of writing, and attribution to North Korea is an assessment by blockchain-analytics firms, not a legal finding.

Cover photograph / illustration: Satheesh Sankaran (via Flickr, Wikimedia Commons). CC BY 2.0. Original source. Illustrative image: a physical bitcoin coin on a laptop keyboard. Photograph: Satheesh Sankaran. CC BY 2.0. This image does not document the events described.