Lessons · Exchange infrastructure
Binance Hack: What Happened on October 29
On the evening of October 29, 2026, cryptoassets began leaving Binance wallets. The exchange subsequently estimated its losses at approximately $6.3 billion. Its hot wallets—the part of its infrastructure used to process withdrawals promptly—had been compromised. Binance suspended withdrawals and said it would bear the financial impact.
EDITORIAL OVERVIEW · Prepared by the project editors from the sources listed below.
An initial explanation, not a final account
The explanation, however, proved more complicated than the initial headlines suggested.
Binance initially said a compromised DevOps engineer’s laptop may have been the point of entry. The company later discovered additional points of breach. The story of one employee losing billions with a single click is therefore not an established account of the attack. In the same update, Binance said it had found no evidence of leaked private keys. That was an interim investigative finding, not a definitive exclusion of that possibility.
Valid signatures and the signing infrastructure
TRM Labs analysts highlighted another detail: wallets on different blockchains sent funds using valid signatures. In their assessment, this points to a compromise of the exchange’s own transaction-signing infrastructure. TRM counted 18,270 BTC among the stolen assets. That is a research estimate based on observed transfers and should be distinguished from Binance’s statement about its overall losses.
An important distinction lies here. A valid signature establishes authority to transfer funds from the network’s perspective, but does not prove that the transfer reflected the system owner’s intentions. The published research describes an attack on exchange infrastructure, not a demonstrated breach of Bitcoin’s cryptographic rules.
Questions for the technical report
In its latest verified update, Binance still promises a separate technical report once the investigation is complete. That report should help answer the remaining questions: how the attackers gained access to transaction signing, and why the protective controls did not stop the transfers.
Sources and verification
Information checked November 2, 2026. The investigation remains ongoing; company statements and research assessments are identified separately. A possible point of entry is not a final explanation of the attack.
Unless stated otherwise, the text, conclusions, structure and editorial arrangement were created by the project editors. Facts, quotations and source materials remain attributable to their authors and rights holders.
← Back to the rubric