At 3:24 am on October 30 Vietnam time, money began flowing out of a wallet of Binance, the world's largest cryptocurrency exchange by trading volume. Just a few minutes later, more than 60 types of digital currency in the wallet were at a strange address, when most of the country's cryptocurrency players were still sleeping.

By morning, Binance estimated the amount taken was about 6.3 billion USD. If this number stands, this is the largest cryptocurrency theft ever recorded by the end of October 2026. The previous record belonged to Bybit, which lost about 1.5 billion USD in February 2025.

Picture Binance as a bank

To understand this case, just imagine Binance as a bank with many safes. Money deposited by customers on the floor is in wallets, and each wallet can be opened with a separate key, which industry insiders call a private key.

Most of the money is kept in safes deep in the basement, rarely opened. A smaller portion is kept available at the counter for customers to withdraw at any time, and people call that place the hot wallet. This case targets such a hot wallet.

To take money out of a wallet, the transaction must have a signature from that wallet's key. In a large exchange, the key is not in anyone's pocket but is stored in an automatic signature system, like a cashier who only stamps checks sent from the correct department.

The thief doesn't take the key, he just borrows the hand of the person who has the power

Binance said there is no sign that the wallet key was leaked. According to the floor's initial assessment, everything could start from the laptop of a system operating engineer.

From that laptop, the attacker accessed an internal server with the right to send withdrawal orders. If this scenario is correct, the treasurer received payment vouchers that looked exactly like real ones, sent from the same familiar department, so he still stamped them as always.

In the final step, security company Blockaid believes that the attacker took advantage of a new feature of Ethereum called EIP-7702. This feature allows the wallet owner to hand over control of the wallet to another program, like signing an authorization to let someone else go to the counter to withdraw money on their behalf.

With just one valid signature on that authorization form, the crook's program wiped out the wallet in about 3 minutes. Blockaid also noted that the attacker tested this method on test wallets several hours ago. No one has been able to explain the money taken on the Bitcoin and Tron networks using this mechanism.

Six hours a night

Binance stopped all deposits and withdrawals at 5:15 a.m., nearly 2 hours after the money started flowing out. At 9:25 a.m., the exchange announced the figure of 6.3 billion USD and the question about the laptop.

Why was half of the money blocked?

Among the money taken, there were two completely different types of management.

The first type is USDT and USDC, digital currencies pegged to the US dollar. Each coin has a company behind its issuance, Tether and Circle, so that company has the right to lock the money at any address, like a bank blocking an account.

Tether has locked more than 1.57 billion USDT, while Circle has locked more than 800 million USDC. In addition to other parties, Binance said about $3 billion was frozen.

The second type is bitcoin and Ether, two coins that do not have any company behind them, so there is no one holding the key. Most of the money that is still out of reach lies in these two coins, and the crooks also know that, so they quickly mortgaged USDT to borrow Ether before being blocked.

Who pays the rest?

Binance is committed to compensating all damages. According to that commitment, people with money on the floor will not have to bear any loss.

Compensation money comes from the SAFU fund, a reserve fund established in 2018 for situations like this, plus the company's own money. The SAFU fund currently holds about 1 billion USD, so most of the shortfall will be paid by the company itself.

According to DefiLlama, assets on Binance before the attack were about 144 billion USD, so the loss was about 4%. The market still panicked before the commitments could reach everyone's ears, and according to CoinDesk, bitcoin sometimes fell below 77,000 USD.

Binance still owes users a full technical explanation and a specific date to reopen withdrawals. The culprit is currently only suspected, although investigators ZachXBT and Blockaid both lean towards North Korean hacker groups. The Bybit case last year and the Binance case this time show the same rule: the thicker the safe, the more thieves will find the computer of the person who has the right to press the button. The wallet key may still be in the same place, only the laptop that has the right to give orders has obeyed someone else.

• Data updated until the morning of October 30, 2026 and may change when Binance releases technical analysis. Time stamp converted to Vietnam time (UTC+7) from Bitcoin.com News and FinanceFeeds timeline. The 04:04 mark is an estimate, based on receiving address information that collected about 3.52 billion USD within 40 minutes of the first transfer.

• Estimated damage, frozen amount and suspected laptop according to Binance's announcement on X. Frozen USDT and USDC numbers according to statements by Paolo Ardoino and Jeremy Allaire, Ripple numbers according to Yi He. The "Other parties" box is the difference between the approximately 3 billion USD announced by Binance and the total named amounts.

• "Internal server" in the article is a shortened name for the service container that Binance mentioned in the announcement. EIP-7702 mechanism according to Blockaid analysis. Total assets on the exchange according to DefiLlama, SAFU fund size and price fluctuations according to CoinDesk. Illustrations are graphic.