On the evening of 29 October 2026, the world's largest crypto exchange suffered the biggest cryptocurrency theft ever recorded. Binance now estimates that about US$6.3 billion in assets was affected. That is roughly four times the previous record, the $1.5 billion Bybit hack of February 2025.
If you run a business in the UK rather than a crypto exchange, you might wonder why this matters to you. Here is the uncomfortable answer. According to Binance's early findings, the way in was not an exotic flaw in blockchain technology. The preliminary investigation points to a compromised laptop belonging to a DevOps engineer. Almost every UK business has at least one laptop like that.
This article explains what happened, who is suspected, where the money went and what Binance customers should do now. Then it turns to what matters most for UK businesses: eight practical steps you can take this week, and how GSS Tech Solutions can help. Everything below reflects public reporting up to 30 October 2026, and the story is still developing.
Binance hack at a glance
Question | Short answer |
|---|---|
What happened? | Binance says a security incident affected about $6.3 billion in assets on 29 October 2026 (Binance). |
How did the attackers get in? | Early findings point to a compromised DevOps engineer's laptop. That gave access to a service container and let the attacker submit unauthorised withdrawals (CoinDesk). |
Were private keys stolen? | Binance says it has found no evidence of a wallet private key leak (Forbes). |
Who is suspected? | TRM Labs says it has high confidence in North Korea's TraderTraitor group (AFP via Yahoo Finance). |
How much is frozen? | About $3 billion, including $2.3 billion in USDT and USDC stablecoins (CoinDesk). |
Who covers the losses? | Binance says it will use its SAFU emergency fund and company funds (Forbes). |
Can I use Binance? | Deposits are reported as normal. Withdrawals are expected to resume within 48 hours of the 30 October update (FinanceFeeds). |
What happened in the Binance hack?
Late on Thursday 29 October, funds began leaving Binance wallets without authorisation. Within hours, industry figures were calling it a hack, stablecoin issuers were freezing assets, and Binance had paused withdrawals.
Timeline of the Binance hack
When | What happened | Source |
|---|---|---|
29 Oct, around 20:20 UTC | Reports say the attack began, targeting Binance's main Ethereum hot wallet | |
29 Oct, 22:15 UTC | Binance halts withdrawals | |
29 Oct, evening | Co-founder Changpeng Zhao says it looks like a hack. Tether and Circle start freezing funds | |
29 to 30 Oct | Binance puts the impact at about $6.3 billion, says about $3 billion is frozen and pledges to cover all losses | |
30 Oct, 04:17 UTC | Co-CEO Yi He says withdrawals should resume within 48 hours and deposits continue normally |
How big is the Binance hack? The numbers
Different firms give slightly different totals because they value assets at different moments and trace wallets in different ways.
Measure | Figure | Reported by |
|---|---|---|
Binance's estimated impact | About $6.3 billion | |
Assets moved, per TRM Labs | About $6.36 billion across 10 blockchains, most within about 20 minutes | |
Chainalysis estimate at time of theft | About $5.9 billion | |
Assets Arkham linked to suspect wallets | Nearly $6 billion across 55 addresses | |
Frozen so far | About $3 billion | |
Share of Binance's holdings | About 4% of the roughly $144 billion held before the hack |
How did the Binance hack happen?
Binance's preliminary account is short. A DevOps engineer's laptop appears to have been compromised. That gave the attacker access to a service container, which is a small, self-contained piece of back-end software. From there, the attacker submitted withdrawal transactions that nobody at Binance had approved. Binance says it has found no evidence that any wallet private keys leaked (CoinDesk).
Think of it as a simplified analogy. The vault door was never picked. Someone obtained a staff member's keycard and persuaded the building's own systems to open it.
Binance's preliminary account of the attack, matched with the safeguards covered in the steps below.
What we still do not know
How the laptop was compromised. Phishing, malicious software and other routes are all possible, and Binance has not said.
Why existing controls did not stop the withdrawals sooner.
The final loss figure, which is still being verified.
Binance has said it will publish a detailed technical post-mortem once its investigation is complete (CNBC). We will update this article when it does.
Why this matters beyond crypto
Strip away the blockchain and the pattern is familiar. A privileged person's device is compromised, an internal system trusts that device, and money or data moves. Axios notes the attack follows a run of high-profile breaches this month. The same chain can play out at a UK retailer, clinic or software firm.
Who is behind the Binance hack? The North Korea link
Several security firms point towards North Korea. TRM Labs says it has high confidence the attack was carried out by TraderTraitor, an elite North Korean hacking group. Investigator ZachXBT named the Lazarus Group as the likely attacker, and Blockaid's chief executive said the tactics were consistent with North Korean operations (CoinDesk).
There is precedent. The FBI previously identified TraderTraitor as responsible for the Bybit hack in February 2025 (CNBC). TRM Labs reports that North Korea-linked actors accounted for 76% of global crypto hack losses in the first four months of 2026, up from 64% in 2025. North Korea has previously rejected such accusations.
The attribution reported so far comes from private blockchain-intelligence firms and investigators. Treat it as a strong working assessment rather than a final finding.
Binance's loss is about four times the previous record. Sources: Binance, CoinDesk, AFP via Yahoo Finance. Bitget is shown at CoinDesk's figure of over $350 million, while Forbes reports about $388 million.
Where did the stolen money go, and can it be recovered?
Freezing is working, but only partly. Tether froze more than $1.5 billion in USDT and Circle froze more than 800 million USDC (Forbes). Stablecoin issuers can block transfers from affected addresses, so attackers try to swap into assets nobody can freeze.
Asset type | Can an issuer freeze it? | What the attacker did |
|---|---|---|
USDT and USDC stablecoins | Yes | Issuers froze large amounts. The attacker moved some through Uniswap and borrowed against stolen USDT on Aave (CoinDesk) |
Bitcoin and ether | No central issuer | CoinDesk reported about $1.4 billion of bitcoin split across 19 wallets |
Who pays? Binance says it will cover all losses. Its SAFU fund holds roughly $1 billion to $1.2 billion, depending on the source. One analyst quoted by CNBC estimates that could cover about a third of the unfrozen loss, with Binance's own funds making up the rest.
Is recovery guaranteed? No. Frozen funds are not the same as returned funds. Binance says it is working with law enforcement and blockchain investigators (Forbes). The same Forbes report notes that exchange Bitget froze only about $1.1 million of the roughly $388 million it lost in September.
Is my money on Binance safe?
When talking about what the Binance hack means for users and the market, Binance says user funds are safe and that it will cover all hacking losses (CoinDesk). FinanceFeeds noted that early statements about deposits and withdrawals were not always consistent, so rely on Binance's official channels for the latest position.
UK customers should also know that the FCA has repeatedly warned that cryptoassets are not protected by financial compensation schemes. A company promise to cover losses is not the same as a legal safety net.
What Binance customers should do now
These are just recommendations, not financial advice.
Use only Binance's official announcements and verified accounts. Ignore emails, messages or ads offering "recovery" or "compensation" links, because scammers exploit headlines like this one.
Turn on phishing-resistant two-factor authentication, such as a passkey or hardware key, and use withdrawal address whitelisting if your platform offers it.
Review how much you keep on any one exchange.
Avoid rushed decisions driven by fear.
Why should UK businesses care about the Binance hack?
Because the lesson is about people, devices and permissions, not coins. The table below translates the incident into everyday terms.
What happened at Binance | The everyday UK equivalent | Quick fix |
|---|---|---|
One engineer's laptop was compromised | A developer or office manager's laptop with admin logins saved | Separate hardened admin profile plus a security key |
A service container could submit withdrawals | A website, app or pipeline with broad access to payments or data | Least privilege and a second approver for high-risk actions |
Funds moved across 10 chains in about 20 minutes | Refunds, payouts or exports abused in minutes | Alerts and automatic limits |
Partners froze assets quickly | Your bank, card processor and cloud host can act, if you call them fast | A written escalation list |
Binance promised a post-mortem | Most small firms never review incidents | A short, blameless review after every incident |
An illustrative scenario (not a real case). A UK online retailer's developer keeps saved logins for the cloud console and payment dashboard on a laptop. The laptop catches malware from a fake invoice attachment. Within minutes, the attacker could issue refunds, change payout details or push new code. Now replay it with three changes. The developer uses a separate admin profile with a security key, refunds above £500 need a second approver, and an alert fires when payout details change at 2am. Same attacker, very different outcome.
8 practical steps to protect your business this week
Step | Typical effort (our estimate) | Main benefit |
|---|---|---|
1. Harden admin and developer laptops | Half a day | Stops one stolen device becoming a full breach |
2. Use phishing-resistant MFA | 1 to 2 hours | Makes stolen passwords far less useful |
3. Apply least privilege and dual approval | 1 to 2 days | Limits what any one account can do |
4. Keep secrets off laptops and out of code | 1 to 3 days | Removes easy-to-steal keys |
5. Add alerts and automatic limits | 1 to 2 days | Catches abuse in minutes, not days |
6. Patch fast and cover Cyber Essentials basics | Ongoing | Closes known gaps |
7. Write and rehearse an incident plan | Half a day | Faster response, meets reporting duties |
8. Review supplier and agency access | 1 day | Shrinks third-party risk |
Step 1: Treat admin and developer laptops as crown jewels
Anyone who can deploy code, change cloud settings or approve payments holds a master key. Give them a hardened device or separate admin profile, switch on full-disk encryption and automatic updates, install endpoint protection, and keep personal browsing off it.
Try this: list everyone with admin access and check which device each person uses.
Step 2: Use phishing-resistant multi-factor authentication
Passwords leak. Where possible, use passkeys or hardware security keys rather than text messages, starting with email, cloud consoles, code repositories and payment dashboards.
Step 3: Apply least privilege and split high-risk duties
Give each person and each system only the access it needs. For anything that moves money or changes production systems, require a second approver.
Try this: set an approval threshold for refunds, payout changes and deployments.
Step 4: Keep secrets off laptops and out of code
API keys, tokens and passwords belong in a secrets manager, not in spreadsheets, chat or source files. Prefer short-lived credentials and rotate them when staff leave or a device goes missing.
Step 5: Watch for the unusual and set automatic limits
Funds left Binance across 10 blockchains in about 20 minutes, which shows how fast automated abuse moves. Alerts for odd-hour logins, large transfers and changed bank details, plus daily limits, buy you time to react.
Step 6: Patch quickly and cover the Cyber Essentials basics
The NCSC's Cyber Essentials scheme is built around five technical controls: firewalls, secure settings, access control, malware protection and software updates. Smaller organisations can also use the NCSC's Cyber Action Toolkit. If your website runs on PHP, our guides How to Check If Your Website Is Affected by PHP2Shell and PHP2Shell: Patched but Not Safe? are good starting points, and our free PHP Version Checker helps you see where you stand.
Step 7: Write down your incident plan and practise it
Decide in advance who isolates a device, who calls your bank, payment provider and cloud host, and who talks to customers. If personal data is involved, UK GDPR requires you to report a notifiable breach to the ICO within 72 hours of becoming aware of it. A 30-minute tabletop exercise twice a year is enough to find the gaps.
Step 8: Review supplier and agency access
Agencies, freelancers and software tools often hold keys to your systems. Remove unused accounts, require MFA for every external user, and agree in writing who owns the code and the access. Our guide Who Owns the Code? What UK Law Says When You Hire a Software Development Agency explains the legal side.
How GSS Tech Solutions can help
GSS Tech Solutions is a UK digital agency with offices in London and Leeds. We hold Cyber Essentials Plus and ISO 27001 certificates, and follow the Cyber Security Policy. We do not give investment advice or provide crypto custody. Our focus is the software and infrastructure around your business.
Challenge | How we can help | Service |
|---|---|---|
Deployment pipelines and cloud access that are too permissive | CI/CD, infrastructure as code, 24/7 monitoring, and security and compliance checks | |
Ageing servers and legacy infrastructure | Plan and run a move to the cloud | |
Custom systems that handle money or sensitive data | Bespoke builds with clear roles and approval flows | |
Online stores and payment journeys | Build and manage e-commerce platforms | |
Spotting unusual activity | Monitoring dashboards and models that flag odd patterns | |
Public websites that need steady maintenance | Build and maintain websites on supported platforms |
Scope depends on your project, and we confirm it in a free quote. Contact us on 0203 599 8122 or contact@gsstechsolutions.co.uk.
Binance Hack FAQs
Here are answers to the frequently asked questions.
How much was stolen in the Binance hack?
Binance estimates about $6.3 billion in assets was affected. Other firms put it between roughly $5.9 billion (Chainalysis) and $6.36 billion (TRM Labs). About $3 billion has been frozen (CoinDesk).
How did the Binance hack happen?
Binance's early investigation suggests a compromised DevOps engineer's laptop gave an attacker access to a service container, which was used to submit unauthorised withdrawals. The company says it found no evidence of a private key leak.
Who hacked Binance?
TRM Labs says it has high confidence in North Korea's TraderTraitor group, and other investigators point to the Lazarus Group. This comes from private firms and is not a final finding.
Is my money on Binance safe?
Binance says user funds are safe and that it will cover all losses. Cryptoassets are not covered by the UK's financial compensation scheme, so follow Binance's official channels and manage your exposure carefully.
When will Binance withdrawals resume?
Co-CEO Yi He said on 30 October that Binance expected to begin resuming withdrawals within 48 hours (FinanceFeeds). Check Binance's official announcements for the latest position.
Can the stolen crypto be recovered?
Part of it, possibly. About $3 billion is frozen, but frozen is not the same as returned, and assets without a central issuer are harder to stop. Bitget's September hack shows recovery can be very limited.
Could a hack like this happen to a small UK business?
The scale is different but the pattern is the same: a compromised device, trusted access and fast abuse. The eight steps above, and the NCSC's Cyber Essentials controls, address exactly that.
Do UK businesses have to report a cyber attack?
If a personal data breach is likely to risk people's rights and freedoms, you must report it to the ICO within 72 hours of becoming aware. Your insurer, bank or sector regulator may also need to know.
Final Words
The Binance hack is the largest crypto theft on record, yet its likeliest starting point was ordinary: one engineer's laptop. That is the real lesson for UK businesses. You do not need a billion-pound vault to be a target. You need a privileged device, a trusting system and a few quiet minutes.
The good news is that the fixes are practical. Harden your admin devices, use phishing-resistant MFA, split high-risk approvals, move secrets out of reach, set alerts and limits, and rehearse your response. If you want a second pair of eyes, GSS Tech Solutions can help you build and secure the systems behind your business. Get a free quote and tell us what you are protecting.
This article is general information and not financial advice.
