At 5:05 a.m. Korea Standard Time (KST) on October 30, 2026, coins began leaving Binance's wallets. Over 3 hours 51 minutes, about $6.34 billion worth went out, according to Binance's report. Analytics firms put the total as high as $6.43 billion. That is more than four times the Bybit theft of February 2025 (about $1.5 billion) and the largest theft of crypto assets on record.
The cause was not that blockchain is unusually vulnerable. For more than four months the attackers went after employees who could handle the keys that move coins, known as private keys. They then used the company's signing system to create withdrawals that carried genuine signatures. Banks have also had incidents that targeted people with authority and internal procedures.
The attackers went after employees first
In June, an engineer on the wallet operations team, Engineer A, searched for an AI coding tool and downloaded an installer that had been tampered with. The security team replaced the computer. By then the attackers already knew what A's job was and who A's colleagues on the wallet team were.
In September, Engineer B received a fake interview offer on a job site. The interviewer won B's trust, going as far as showing personal photos, and near the end had B download an "assignment" file onto a company computer. The malware was new, and the company's security software did not detect it.
On October 20, the attackers used B's computer and an internal AI tool to compromise A and Engineer C as well. They had not found a flaw in blockchain code. They had taken over employee computers and account permissions, step by step.
This account comes from Binance's initial report, and outside review is still to come. The US Federal Bureau of Investigation (FBI) named the North Korean group TraderTraitor. North Korea denied involvement. No court has ruled on the matter.
When the attackers got into the signing system, withdrawals went out with genuine signatures
Moving coins on a blockchain requires a signature. A signature is a digital seal showing that the wallet's owner approved the transfer. At a centralized exchange such as Binance, the company keeps both the customers' coins and this seal.
With the stolen permissions, the attackers entered the wallet signing system and attached genuine signatures to transactions that had not gone through withdrawal review. A blockchain checks only whether the signature is valid. It is similar to a registry office accepting a document stamped with a stolen corporate seal, the registered stamp that companies in South Korea use in place of a signature. Among the sources found through November 5, none said that transaction records had been forged.
Analytics firm TRM Labs also rated a takeover of the signing system as the most likely explanation, citing the fact that Binance wallets on 10 blockchains all produced valid signatures within about 30 minutes.
The money was also frozen by companies
Binance put the amount frozen or blocked at $2.85 billion, about 45% of the loss. Most of it was coins frozen by the companies that issue them, such as Tether and Circle. On Arbitrum, a blockchain network, a security council with emergency powers forcibly moved the coins in the attacker's wallet. What stopped the money was also decisions by companies and a council, not code.
Banks have had incidents of the same kind
In 2016, attackers hit Bangladesh's central bank. Through a terminal connected to SWIFT, the international payment network, they sent fake transfer orders that passed authentication and took $81 million, according to US Department of Justice charges. Most of the remaining transfer orders were blocked. In 2023, an inspection by Korea's Financial Supervisory Service, the financial regulator, confirmed that an employee of Kyongnam Bank had embezzled KRW 298.8 billion. That figure adds up every amount taken, including money used to cover earlier embezzlement. The net loss was KRW 59.5 billion. In both cases the problem lay with people who held authority and with internal procedures more than with code.
Where incidents happen depends on who holds the keys
At an exchange the company holds the keys, so incidents happen on the company's side. At Bybit, the computer of a developer at an outside wallet provider was breached, and the transaction the signers approved was swapped for another. At Upbit, a Korean exchange, about KRW 44.5 billion worth of coins left an internet-connected company wallet, known as a hot wallet, in November 2025. Korean law requires exchanges to keep at least 80% of users' coins in wallets separated from the internet, known as cold wallets. Bybit, however, was hit while moving coins out of a cold wallet. Someone has to sign for coins to be taken out.
Incidents also happen when coins are not left with a company. Cetus, a decentralized exchange where users trade from their own wallets, lost about $223 million in May 2025 because of a flaw in its program code. From personal wallets, where owners keep their own keys, $713 million was stolen between January and early December 2025.
On the blockchain side, what made the damage worse was one Ethereum feature
The attackers abused EIP-7702, an Ethereum feature that lets a wallet hand its permissions to a program. The feature was added to Ethereum in May 2025. Reports described this as abuse of a normal feature, not a flaw. But the delegation is recorded on the blockchain, so it stayed valid after Binance halted withdrawals. Canceling it required a separate procedure, and in the meantime money arriving in the wallets was taken six more times.
Cases in which the blockchain record itself was changed have come from chains where few computers take part in verification. In July and August 2020, attackers on Ethereum Classic gained a majority of the computing power that verifies transactions, reversed the record, and spent about $5.6 million worth of coins twice, by Bitquery's estimate. No successful attack of this kind has been reported on Bitcoin, according to the Bitcoin Wiki. The Binance incident is of a different kind. The attackers did not alter the record. They stole the authority to sign.
The difference from banks is what happens after an incident
In Korea, bank deposits are protected up to KRW 100 million per person at each financial institution. Victims of voice phishing (phone scams) can ask for a payment freeze, and people who send money to the wrong account can apply to the Korea Deposit Insurance Corporation for help recovering it. Coins held at exchanges are covered by cold-wallet and insurance rules, but the Financial Services Commission, Korea's financial policy authority, has said the relevant law does not guarantee that coins are safe. Blockchain transactions are hard to reverse after they become final, and the freezes described above were possible only where there was an issuing company or a body with emergency powers. On the other side, bank customers have to trust the banks and the authorities, and outsiders cannot follow transactions minute by minute as the timeline in this article does.
Whether coins are safe depends on where they are kept
Binance customers had to wait for the company's response until withdrawals reopened, starting with bitcoin on November 1. The company said it would absorb the loss and that, as of its November 3 report, it had replenished 98% of the affected coins. That is the company's own statement that it covered the shortfall with company money. It does not mean the coins were recovered. No independent verification was found.
So asking only whether blockchain is safe does not show whether a person's coins are safe. For coins left at an exchange, what matters is that company's security and its ability to compensate customers after an incident. For coins moved to a personal wallet, the owner is responsible for managing the keys.