The largest theft in the history of financial markets did not happen on a trading floor or through a rogue banker. On October 29, 2026, an attacker moved approximately $6.36 billion out of Binance wallets across ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. By the time most of the world woke up, the money was gone.
That makes this the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Bybit was supposed to be the wake-up call. It was not loud enough.
What Boards Need to Understand About the Method
The entry point matters as much as the scale. Binance’s initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions, with no evidence of any wallet private key leak. A single endpoint. A single employee. $6.3 billion gone.
TRM Labs said several features of this attack match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO bridge exploit in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance then executed in one burst.
TRM Labs attributed the attack with high confidence to TraderTraitor, a North Korean state-sponsored hacking unit, based on on-chain and off-chain intelligence. Chainalysis also said the hack was likely carried out by the DPRK-linked TraderTraitor cluster. No government has formally attributed the Binance attack yet, but the FBI publicly named TraderTraitor in the Bybit case.
Two days before the hack, Binance said it had blocked North Korea-linked attacks that used fake job interviews to get people to run malicious code. That context is striking. The attacks are layered and relentless, probing one vector while executing through another.
The Gold Angle: Systemic Risk as a Price Input
Precious metals investors should read this as a systemic signal, not a crypto story. Bitcoin fell more than 4% to roughly $78,000 on Friday as the hack weighed on crypto markets. That kind of forced selling and sentiment deterioration across digital assets tends to push capital toward hard assets with no counterparty risk.
The divergence between institutional gold demand and Bitcoin flows was already visible before this event. Central banks were buying gold while ETF funds chased Bitcoin’s August rally, a split in demand base that a hack of this scale can only widen.
Gold holds no hot wallet. It cannot be drained in 20 minutes through a compromised laptop. Every episode that erodes institutional confidence in centralized digital custody reinforces the case for physical metal and metal-backed instruments as the reliable store of value in a portfolio. State-sponsored theft at this scale is a geopolitical event, not just a technology failure, and geopolitical risk has historically been one of the most consistent drivers of gold demand.
The Containment Picture
Early Friday, TRM said it had tallied around $2.7 billion in frozen assets, including roughly $1.77 billion USDT locked by Tether and about $825 million USDC locked by Circle. Roughly $3.3 billion in assets remained unfrozen as of Friday morning, still in the hands of the attackers.
Binance said it plans to use its emergency SAFU fund and company reserves to compensate affected users. SAFU has been promoted as roughly a $1 billion backstop, though its market value can fluctuate with the assets it holds. Binance has not yet detailed how it structures the remainder of the coverage.
Bottom Line
The Binance hack is not a one-off event. It is the latest in a run of major DPRK-linked thefts that have increasingly targeted exchanges and crypto infrastructure. Experts and U.S. officials have said North Korea has turned to crypto hacking as a source of badly needed foreign currency to support its economy and fund its nuclear program. That mission will not pause because one target is now frozen. The attackers are patient, well-resourced, and improving.
For precious metals investors, the lesson is structural. When the world’s largest exchange can be emptied through one engineer’s laptop in 20 minutes, the argument for assets that exist outside any network, any signing infrastructure, and any single point of failure becomes harder to dismiss. October 2026 is making that case with unusual force.