On October 29, 2026, Binance, the global financial ecosystem's largest cryptocurrency exchange, experienced a massive breach, losing approximately $6.3 billion across 10 different blockchains. The attackers gained access through a single compromised laptop belonging to a DevOps engineer. They used this access to pretend to be a legitimate internal service authorized to send out automated withdrawals. The breach occurred over a 20-minute window at 20:05 pm.
The hackers utilized smart contract automation on Ethereum, employing pre-prepared instructions (EIP-7702) to instantly convert Binance hot wallets into automated "sweeper" contracts. This allowed them to auto-redirect incoming and existing funds out in seconds. Blockchain intelligence firms, including TRM Labs and ZachXBT, attribute the attack to TraderTraitor, a state-sponsored North Korean group, also known as Lazarus Group.
The attackers cleverly deposited stolen USDT into the decentralized lending platform Aave as collateral and borrowed liquid Ethereum (ETH) against it. Although Tether froze $1.57 billion and Circle froze over $800 million, Tether cannot freeze native Ethereum. As a result, the hacker walked away with liquid, unfreezable ETH, leaving Aave holding millions in frozen USDT collateral.
Hendrik de Bruin, head of security consulting for Africa at Check Point Software Technologies, noted that the Binance attack stands out not for the amount stolen but for how it was done. The attackers didn't break the encryption or steal the private keys; they took over the system that tells the keys what to sign. De Bruin emphasized that a strong vault doesn't matter if someone controls the process that opens it.
The incident highlights a repeatable pattern, as cryptocurrency exchange Bitget suffered a $388 million breach just five weeks prior, executed through identical methodology. This incident and the concurrent PHP2Shell global patching crisis demonstrate that modern cyber risk is defined by speed, automation, and workflow subversion. The threat is coming from inside the organization, accelerated by AI.
Allan Juma, lead cybersecurity engineer at ESET, drew parallels between high-profile platform exploits and underlying web application vulnerabilities such as PHP2Shell. He warned that the two flaws (CVE-2026-109618 and CVE-2026-109619) can allow attackers to execute code without logging in, putting all PHP installations serving web requests at risk.
The Binance breach and other recent hacks have significant implications for the cryptocurrency industry. Bernardo Brites, CEO of Trace Finance, observed that AI-driven vulnerability exploitation is making it hard to counter hacks. He predicted that users will move away from smaller and medium-sized exchanges, which are becoming too risky to park money that couldn't cover a hack of meaningful size.
Key points
- The Binance hack was executed through a single compromised laptop, highlighting the vulnerability of internal systems.
- The attackers used smart contract automation to rapidly redirect funds.
- The breach has significant implications for the cryptocurrency industry, with users potentially moving away from smaller exchanges.
