Binance hack: the largest robbery in financial history

What it is

A 21shares analysis, written 30 October 2026, of the 29 October theft of about $6.3 billion from Binance. It adds the freeze breakdown, the loss-coverage arithmetic and the sanctions angle that the catalog summary leaves out. Figures are on-chain estimates (Arkham, LlamaRisk and others), not confirmed by Binance.

How it works

Binance's initial finding points to a compromised DevOps engineer's laptop, with no sign that any wallet private key leaked. The page says Binance has not disclosed its fund-approval process. It also says no evidence shows one person could approve these transfers, and nothing indicates an insider job.

Freezing works only for tokens whose issuer or governing body can block addresses. Reported freezes:

• Tether: more than 1.6 billion USDT.
• Circle: more than 800 million USDC.
• Arbitrum Security Council: 75 million ARB and 8,425 ETH moved to a frozen wallet.

The issuer amounts are "more than" floors and may overlap Binance's own figure of about $3 billion frozen. That leaves about $3.3 billion unfrozen and at risk.

The Aave spillover: the attacker supplied 60 million stolen USDT and borrowed 19,762 WETH (about $44.6 million) within about three minutes. Aave froze its markets as a precaution. Per LlamaRisk and the Aave governance forum, it reported no bad debt because the position remains over-collateralized.

Preconditions / Affected

• Anyone handling the stolen funds may face compliance questions. If the North Korea attribution holds, OFAC sanctions Lazarus Group and related groups.
• Binance has paused withdrawals and expects to resume within 48 hours. Deposits have resumed.
• Bitcoin itself was not compromised. It fell just over 2% in the 24 hours after the hack.

Caveats

• Chainalysis states high confidence in North Korean attribution. Neither Binance nor any government has confirmed it.
• If the attribution holds, the page says recovery of unfrozen funds is unlikely. Such groups typically launder through swaps, bridges and mixers, and funds not frozen early are rarely recovered.
• Binance says SAFU and company funds will cover all losses. SAFU holds 15,000 BTC (about $1.18 billion at $78,509 per bitcoin), or about 36% of the unfrozen $3.3 billion. The remaining roughly $2.1 billion would come from company funds.
• Binance's proof of reserves on 1 October 2026 showed $134 billion in net user balances against about $136 billion on-chain, a surplus near $2 billion (ChainCatcher). Binance covered a 7,000 BTC loss (about $40 million) from SAFU in May 2019.
• The page is from an ETP issuer and includes a section on its own products. It says 21shares' physically-backed products have no exchange exposure and are trading normally. It gives no technical detail on the laptop compromise.