How one laptop cost $6.3 billion
Lesson 1 of 16 in the course “Cybersecurity from Scratch”. Free, with animations and a quiz.
Meet Dan
Dan is 22 and works as a junior developer. He keeps his $3,000 of savings in crypto on an exchange, uses the same password on half of his sites and runs “free” cracked software on his laptop. Dan is sure hackers don’t care about him. Over the course we close his holes one by one. And yours along the way.
The biggest crypto theft in history
On the evening of 29 October 2026, about $6.3 billion left Binance’s hot wallets within a few hours, by the exchange’s own estimate. A hot wallet is an exchange wallet that stays online so customer withdrawals go through fast. The previous record was the Bybit hack in February 2025: $1.5 billion. The new one is about four times bigger.
Where it all started
Nobody broke the blockchain or some “secret code”. According to Binance’s first account, attackers took over the work laptop of a DevOps engineer, the person who looks after the servers. Through it they reached an internal service that can send withdrawals and made it sign their transfers. The exchange says no private keys leaked. Later Binance added that the laptop was not the only way in. Exactly how the laptop was hacked hasn’t been disclosed yet: a full report is promised.
And customers’ money?
Binance paused withdrawals right away and promised to cover all losses from its SAFU fund and its own money. SAFU is the exchange’s insurance fund for attacks like this. Stablecoin issuers Tether and Circle froze part of the loot, about $2.5–3 billion in total. Customers got lucky: the exchange is big and pays up. But remember: money on an exchange is only as safe as the exchange and your own account.
Who is behind it
Analytics firm TRM Labs links the attack “with high confidence” to the North Korean group TraderTraitor, which the FBI already blamed for the Bybit hack. Binance itself hasn’t confirmed this so far. These attacks share a pattern: they hack people and their computers. At Bybit in 2025 it was a computer of a developer at the Safe{Wallet} service. In 2024, according to the FBI, a fake recruiter sent a staff member at a partner of the Japanese exchange DMM Bitcoin a “test task” with malicious code, and then $308 million vanished.
Why this matters to you
North Korean hackers won’t come for Dan. But ordinary scammers use the same tricks: phishing, malware inside “cracked” programs, fake job offers and calls “from support”. The good news: basic protection stops almost all of these attacks, and it takes one evening. Step by step: accounts, devices, scams, crypto and a plan for when you get hacked. Now the trainer: check how protected you are today and remember your score.
Check yourself
- According to Binance’s first account, how did the hack start?
Correct answer: With an engineer’s hacked work laptop. Binance names a DevOps engineer’s laptop as the way in: through it the attackers reached the service that sends withdrawals. Later the exchange said there were several entry points. - What is an exchange’s hot wallet?
Correct answer: A wallet kept online so withdrawals go through fast. A hot wallet is always online: that makes it handy and also makes it vulnerable. Exchanges keep most funds in cold wallets with no internet. - What’s the main takeaway from this story for Dan?
Correct answer: The weak link is people and their devices, so he should protect his phone, laptop and accounts. Even a company with huge security had its door opened through one work laptop. Dan has no security team at all, so his devices and habits are all the protection he has.