Binance Hack 2026: What Cyprus CASPs Must Test

Binance says attackers took roughly $6.3 billion from its wallets on ten blockchains on October 29, the largest crypto theft on record. Early findings in the Binance hack 2026 investigation point at the hot-wallet signing system, not a leaked private key. For a Cyprus custodian, that makes any DevOps path into the signing workflow a custody risk that no reimbursement fund can fix.

What did the Binance hack 2026 actually move?

Binance, the world’s largest cryptocurrency exchange, puts the loss at roughly $6.3 billion. TRM Labs, which followed each transfer on-chain, counted about $6.36 billion leaving Binance wallets across ten blockchains on October 29. Most of it moved within roughly 20 minutes. SecurityWeek headlined the story as a “$6 billion” theft.

The previous record was the $1.5 billion taken from Bybit in February 2025, and TRM’s figure is more than four times that. The 20-minute window matters more than the total. Issuer freeze desks, exchange incident bridges and law-enforcement requests rarely complete a first round that fast.

The figures differ by source and by hour. The table uses each source’s own number:

Figure	Source	Amount
Total loss	Binance	Roughly $6.3 billion
Total loss, ten chains	TRM Labs	About $6.36 billion
Frozen by 00:30 UTC, October 30	TRM Labs	About $2.7 billion
Frozen, running estimate	Binance	Roughly $3 billion
Still held in unfreezable assets	TRM Labs	420,000+ ETH and 18,270 BTC, about $2.4 billion

Binance halted withdrawals and pledged to reimburse all losses from company funds and its Secure Asset Fund for Users (SAFU), an emergency fund Binance set up in 2018 and finances itself. SAFU is neither an EU deposit-guarantee scheme nor a statutory investor-compensation scheme. Binance customers are being made whole by a corporate decision.

Clients of a MiCA-authorized custodian in Cyprus are owed more than a promise. Article 75(8) of MiCA, Regulation (EU) 2023/1114, makes a crypto-asset service provider offering custody liable to clients for lost crypto-assets, or lost means of access, caused by an incident attributable to it. Liability is capped at market value at the time of loss.

A self-funded pot can sit beside that duty, but it cannot replace a control that stops the withdrawal. The exposure also reaches beyond exchanges: an EMI with a digital-asset leg, or an iGaming operator running its own hot wallets, carries the same risk. Our earlier piece on why Cyprus crypto platforms need penetration testing sets out who is in scope.

Where did Binance say access started?

Binance’s first technical account points to an engineer’s endpoint, and it is worded as a hypothesis. The exchange said its initial investigation “suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.”

“Suggests” and “may involve” are the operative words. Forensics are still open, and Binance has not described the laptop, the container or the identity it ran under.

The same statement rules out one explanation, for now: “We have found no evidence of any wallet private key leak.” Together, the two statements sketch the working picture. A laptop reached a container allowed to submit withdrawals, and the keys stayed inside the signing system. On this telling, what failed was control over who may ask for a signature.

The attack was not improvised. TRM describes at least a day and a half of preparation: the operator wallet was funded with a few small Tornado Cash withdrawals, and the malicious code was trialed on other wallets before the live run. Monitoring that waits for one oversized withdrawal will catch only the final step of a rehearsed operation.

Any internal brief should keep Binance’s statements apart from inference. Stated: unauthorized withdrawals, no evidence of a key leak, a withdrawal halt and full reimbursement. Inferred: which laptop, which container identity, and whether one access path explains every chain.

The Digital Operational Resilience Act has applied since January 17, 2025, and Article 2 of the regulation brings MiCA-authorized crypto-asset service providers into scope, including its ICT incident classification and reporting rules. A Cyprus custodian in Binance’s position would have to classify the event from its own logs while its working theory still says “may.”

The clock is short. Under DORA’s incident-reporting technical standards, the initial notification is due within four hours of classifying an incident as major, and no later than 24 hours after becoming aware of it. An intermediate report follows within 72 hours of the initial one, and a final report within a month of the latest intermediate report.

For a Cyprus CASP, those reports go to CySEC. If the logs miss the engineer laptop and the container session, every one of them rests on a guess.

Why does the Ethereum trick fail on the other nine chains?

On Ethereum, TRM says the attackers abused EIP-7702 delegation. They sent a batch of 50 delegation permissions, all signed beforehand by a Binance hot wallet, so that one would match the wallet’s transaction count at execution time. The wallet ended up delegated to a contract only the attackers could command, and they used it to empty the wallet.

EIP-7702 went live with Ethereum’s Pectra upgrade on May 7, 2025, according to the Ethereum Foundation. It lets an ordinary account sign an authorization that delegates its execution to smart-contract code. Anyone holding that signed authorization can then submit it in a type-4 transaction.

Each authorization is bound to the account’s nonce, its running transaction count. Our reading of TRM’s account is that the 50 permissions covered a spread of future nonces, so at least one would still be valid whenever the attacker sent it. The reporting does not give the nonce values.

Under the EIP-7702 specification, a delegation stays in place until the account signs a new authorization, for example one pointing to the zero address. Rebuilding a laptop, rotating a cloud credential or restarting a container does not remove it. After any suspected signer abuse, someone has to check each treasury account’s delegation status and clear it with a signed wallet action.

TRM says the Ethereum activity first looked like phishing. The other nine blockchains ruled that out: there, Binance wallets paid the attackers through regular, validly signed transactions. “These wallets use different chains, key types and signing schemes. All of them produced valid signatures for the attacker within about half an hour,” TRM said.

TRM’s conclusion is the sentence a Cyprus custody lead should tape above the desk: the attacker most likely “gained the ability to make Binance’s hot wallet signing system sign transactions of its choosing across chains.”

A delegation trick on Ethereum cannot produce signatures with different key types on nine other networks. The common point sits upstream: a system built to sign, answering requests the attacker chose, within about half an hour.

Bybit’s February 2025 loss showed the same class of failure. In post-incident reports, wallet provider Safe and forensic firm Sygnia traced it to a compromised Safe developer machine that served malicious JavaScript to Bybit’s signers. Binance runs a different stack, but the lesson carries: control the service that prepares a transaction, and you can get it signed without touching the key.

Who is named, and what has Binance not said?

TRM names TraderTraitor; Binance does not. TRM attributes the attack to the North Korean unit with high confidence, citing on-chain and off-chain intelligence. Binance says it is cooperating with law enforcement to identify the attackers and has named no one. For now, the attribution is an outside assessment made while the victim’s own investigation is still open.

TRM lists overlaps with the Bybit heist and with the KelpDAO hack, which SecurityWeek dates to April 2026: an operator wallet funded through a mixer, preparation long before money moved, and signatures collected in advance and spent in one burst. Those markers support a comparison. They are not confirmation from Binance.

Chainalysis reached the same view by following the money. CEO Jonathan Levin said his firm also believes TraderTraitor is the likely perpetrator, after investigators found proceeds from the Bitget exploit a month earlier mixed with funds taken from Binance. Blockchain investigator ZachXBT named the Lazarus Group, the broader label under which North Korean crypto theft is often reported.

The laundering breaks with Bybit, where proceeds moved heavily through cross-chain bridges. This time, TRM says, the attackers mostly used large trades with market makers and lending platforms. A monitor tuned to bridge hops will under-report that route, and so will a watchlist that covers your own wallets but ignores a counterparty suddenly bidding size at a discount.

The FBI attributed the Bybit theft to TraderTraitor. A 2022 joint advisory from the FBI, CISA and the US Treasury described the group’s methods: recruitment-themed lures sent to employees of crypto firms, often developers and operations staff, and trojanized cryptocurrency applications that end up on their machines.

Binance’s laptop-and-container hypothesis resembles that record, but the resemblance does not prove a lure was used here. Plenty of Cyprus firms recruit platform engineers over LinkedIn and messaging apps, then let those laptops reach CI and a signer API. The question to test is whether a single engineer’s session can be used to make the signer move client funds.

What did issuers freeze, and what can they never freeze?

Stablecoin issuers moved fast, but much of the haul was already beyond their reach. By 00:30 UTC on October 30, TRM counted about $2.7 billion frozen, a little over 40 percent of its loss estimate. According to the same TRM tally, Tether locked roughly 1.77 billion USDT and Circle about 825 million USDC.

Binance’s own estimate of frozen assets is higher, at roughly $3 billion. One figure is a timed snapshot from an outside tracker; the other is the victim’s running count. Quote each with its source.

Ripple and World Liberty Financial froze smaller amounts. Arbitrum’s Security Council used its emergency powers to move about $30 million out of an attacker wallet, an intervention by chain governance rather than by a token issuer. Few networks have that power, and most of this money did not wait for them.

To stay ahead of the issuers, the attackers sold USDT for ETH at more than 10 percent below market price. The discount bought an exit from tokens with address blocking into assets that have none. TRM says they still hold over 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can freeze.

For a Cyprus CASP or EMI, a recovery plan that amounts to “call Tether and Circle” covers only half the exposure. Rehearse that call anyway, on a 24/7 path that also reaches exchanges, chain security contacts and law enforcement, with wallet addresses, transaction IDs and timestamps ready to send.

The call does nothing for native ETH and BTC once a swap clears, and nothing to stop the signer from producing the next withdrawal.

What should a Cyprus custodian be able to prove?

A Cyprus custodian should be able to prove that a compromised DevOps session cannot obtain an arbitrary signature. Binance’s hypothesis runs from a laptop to a container that submitted withdrawals. TRM’s runs from that kind of access to a signer that signed on ten chains.

MiCA, DORA and CySEC ICT-risk reviews all ask for the same evidence: who can request a client-asset movement, what policy the signer enforces, and how fast an out-of-policy request is seen.

Map privileged access before you debate North Korea. Everyone and everything that can touch CI, the orchestrator, the withdrawal service or the signer API belongs on one list. Key-ceremony holders are easy to list. Firms tend to miss the SRE laptop, the pipeline role and the break-glass account that can open a shell in the withdrawal container, and that shell sits inside the custody boundary.

On CASP and EMI engagements we keep finding the same split. The customer-facing service checks destination and amount. The signer, or the vendor API in front of the HSM, signs whatever a trusted cluster identity sends it. Once an attacker becomes that identity, the front-end check never runs.

The policy has to live inside the signing boundary: destination allow-lists, amount and velocity caps, and limits on which contract calls are permitted. Alert on EIP-7702 type-4 transactions, unexpected delegations and signatures requested for nonces not yet used. A dashboard of completed withdrawals will not show the authorization that armed the drain.

A MiCA and CASP penetration test that stops at the trading interface and never tries to obtain a bad signature has not tested custody.

If a withdrawal goes out anyway, preserve the path before reimaging. Endpoint, container and orchestration audit logs, CI artifacts, cloud identity logs and signer request records are what the DORA reports rest on. Compare what was approved with what was signed and broadcast, rebuild, then check whether any treasury account is still delegated.

Bring three documents to the next audit: the signer policy, the privileged-access map and a timed record of the last incident drill. A pledge like SAFU is a commercial choice; MiCA liability attaches to the custodian either way.

How do you test a laptop that can reach the signer?

Start from a compromised engineer laptop and ask whether that session can make the signer move value. An assumed breach assessment fits when production access is already broad and you need the blast radius. The foothold to model is a platform machine with a path into CI, a deployment container or the withdrawal service.

Write pass-fail questions a board can read. From that foothold, can the tester obtain any of the following?

• A signature for an address outside the allow-list.
• A transfer that exceeds the velocity cap.
• A withdrawal call rewritten into a token approval or a delegation.
• The same service account repeating that request on a second chain.

A yes is a finding even when the private key never leaves the HSM. In Binance’s account, the keys stayed put and the withdrawals still went out.

Pair the technical test with an authorized check on the lure. Do engineering and treasury staff report a fake recruiter or a fake tooling update, and how fast is the session killed and the signer identity disabled?

For firms required to run it, DORA threat-led penetration testing adds the detection question: did the SOC see the container session and the out-of-policy signer request before value left? The report should list which identities could request a signature, which policy rejected a bad destination, and the minute the alert fired.

What is still unconfirmed?

Several load-bearing points are still open, and none of them should delay the response work. Binance has not identified the laptop, the employee or the attackers. TRM’s TraderTraitor call, Levin’s comments for Chainalysis and ZachXBT’s Lazarus assessment are outside judgments. No CVE, malware family or indicator list has appeared in the reporting so far.

Only Ethereum is named; the other nine chains are not. The loss figures vary by source, as the table above shows, and the frozen total depends on whose count and which hour you use.

A Cyprus custodian does not need those answers to act. It can test signer reach from a DevOps role, alert on unexpected delegations and write the issuer call tree now. The Binance theft shows what a signing-workflow failure costs at the top of the market. The same missing control fails just as completely at a firm with a smaller book, and under MiCA the custodian, not a goodwill fund, owes the client.

FAQ

How much did hackers steal from Binance in October 2026?

Binance puts the October 29, 2026 loss at roughly $6.3 billion. TRM Labs tracked about $6.36 billion leaving Binance wallets across ten blockchains, most of it within about 20 minutes. SecurityWeek headlined the story as a "$6 billion" theft.

Did Binance lose private keys in the 2026 hack?

Binance says it found no evidence of any wallet private-key leak. Its initial investigation suggests a compromised DevOps engineer's laptop gave the attacker access to a service container that submitted unauthorized withdrawals. TRM Labs assesses that the attacker most likely could make Binance's hot-wallet signing system sign transactions of its choosing.

Will Binance reimburse users after the $6 billion hack?

Binance halted withdrawals and pledged to reimburse all losses from company funds and its Secure Asset Fund for Users (SAFU). SAFU is a fund Binance runs itself, not a statutory compensation scheme. Under MiCA, an EU custodian carries its own legal liability for client losses from incidents attributable to it.

Who is behind the Binance hack, Lazarus or TraderTraitor?

TRM Labs attributes the theft to TraderTraitor, a North Korean unit, with high confidence. Chainalysis CEO Jonathan Levin also named TraderTraitor as the likely perpetrator, and ZachXBT named the Lazarus Group, the broader label for North Korean crypto theft. Binance has not named the attackers and says it is working with law enforcement.

How much of the Binance theft was frozen by Tether and Circle?

By 00:30 UTC on October 30, TRM Labs counted about $2.7 billion frozen in total, including roughly 1.77 billion USDT locked by Tether and about 825 million USDC locked by Circle. Binance estimates the frozen total at roughly $3 billion.

What is EIP-7702 and was it used in the Binance hack?

EIP-7702, introduced with Ethereum's Pectra upgrade in May 2025, lets an ordinary account delegate its execution to smart-contract code by signing an authorization. TRM Labs says the attackers used 50 pre-signed authorizations from a Binance hot wallet to delegate it to an attacker-controlled contract and empty it.

If a DevOps laptop can ask your signer for a withdrawal, measure that path in a scoped exercise. CyprusPentest runs assumed breach assessment for Cyprus CASPs, EMIs and treasury teams.