Security
Binance: autopsy of a hack exceeding 5.5 billion euros
In twenty minutes on October 29, 2026, more than 5.6 billion euros (6.3 billion USD) were taken from Binance hot wallets across nearly a dozen blockchains. The attack, attributed by the FBI to a North Korean group, redefines the operational and geopolitical risks facing centralized platforms.
On October 29, 2026, around 5.58 billion € (6.3 billion USD) were siphoned from Binance hot wallets in about twenty minutes, according to the exchange’s official communications and initial on‑chain analyses published on October 30. Outgoing flows were detected on nine to ten blockchains, illustrating a coordinated and premeditated attack scenario. Authorities and several blockchain analytics firms are already calling the incident the largest hack in crypto history, surpassing the previous Bybit record estimated at 1.33 billion € (1.5 billion USD) in 2025.
On October 31, 2026, the FBI officially attributed the theft to TraderTraitor, a North Korean group previously linked to the Bybit hack in 2025. This attribution strengthens the geopolitical dimension of the case, placing the attack within a continuum of illicit financing operations attributed to Pyongyang. The repetition of large‑scale attacks ascribed to this group could prompt regulators to consider major crypto platforms as critical infrastructure, with consequent increased requirements for security and international cooperation.
Given the scale of the diversion, Binance reports that about 2.65 billion € (3 billion USD) were frozen on‑chain as of October 30, 2026, in partnership with several stablecoin issuers and blockchain actors. Tether reports having blocked over 1.33 billion € (1.5 billion USD) related to the incident alone. The ability to immobilize these funds so quickly highlights the central but also controversial role of freeze mechanisms in crisis management, with direct implications for the fungibility and perceived decentralization of stablecoins.
Initial technical analyses point to an entry point related to the compromise of a DevOps engineer’s laptop, combined with other intrusion vectors. This scenario brings internal practices for key management, access control, and development environments back into the spotlight. For the sector as a whole, the incident raises the question of scaling operational security measures: strict separation of environments, limitation of privileges, key rotation, and real‑time monitoring of movements on the hot wallets of large centralized platforms.
Beyond Binance, this massive hack is already feeding regulatory discussions about minimum security requirements for exchanges of global scope. In Europe, it could spur a reassessment of supervisory and operational resilience frameworks, building on MiCA and the DORA frameworks applied to financial services providers. The dependence on a few stablecoin issuers able to freeze billions of euros in an emergency also becomes a strategic issue, both for risk management and for financial sovereignty.