On 29 October, an attacker drained roughly $6.36 billion from Binance wallets on ten blockchains, most of it in about 20 minutes starting at 20:05 UTC. Blockchain analytics firm TRM put it at about four times the $1.5 billion Bybit hack of February 2025, making it the largest crypto theft ever recorded.
Binance’s early account points to a human-level weakness. A compromised laptop belonging to a DevOps engineer gave the attacker access to a service container, which was used to submit unauthorized withdrawal transactions. The exchange says it found no evidence of a wallet private key leak. The picture has already grown more complicated. Co-CEO Richard Teng said the attacker did not simply borrow one engineer’s permissions and that the intrusion was not a single click. Binance has since said it uncovered additional points of breach. The company has not attributed responsibility to any individual or group.
Teng has told users their money is safe, and Binance says it will cover all losses from its SAFU emergency fund and company funds. About $3 billion of the stolen assets has been frozen on-chain so far, although frozen funds are not recovered funds. Deposits were operating normally by Friday morning, while withdrawals remain suspended during a security overhaul of the withdrawal service. Bitcoin fell more than 4% to about $78,000 as the hack weighed on markets. Questions remain. Users on social media asked how one engineer’s laptop could lead to the loss of billions without a private key, and Binance has promised a detailed technical post-mortem without giving a date.
No public attribution has been confirmed. North Korea’s state-linked “TraderTraitor” group is the usual suspect for thefts of this size. The FBI attributed the Bybit heist to it, and Elliptic said early laundering patterns pointed to the same group in September’s $357 million Bitget hack. Resemblance is not proof, though. Binance’s own findings are still shifting, and North Korea denies state-backed theft.
Why the money matters
Crypto theft has become a state revenue stream. CertiK estimates North Korea has stolen about $6.75 billion across 263 incidents since 2016, calling it a primary state revenue mechanism. North Korean actors took roughly $643 million in the first half of 2026 alone, and Elliptic tracked more than 50 incidents linked to the country this year, worth about $1.2 billion. Against that backdrop, a single $6 billion day is a step change. If the thieves prove to be state-linked, it would be a sovereign windfall. If they are not, it shows that a criminal crew can now do what once required a state.
Laundering is the next battle. In one earlier major case, over 86% of stolen funds were laundered within a month through decentralized exchanges and cross-chain bridges. The frozen $3 billion suggests defenders may be moving faster this time, but much of the haul remains unaccounted for.
Other recent attacks
The French supermarket attack showed how little it can take to cause physical damage. On the night of 11–12 October, hackers remotely triggered forced defrost cycles in refrigeration systems across France. Attackers hijacked controllers running older Danfoss software and used the built-in defrost function to raise temperatures. Temperatures reportedly reached 50°C, causing fires and food loss in hundreds of stores. E. Leclerc, Intermarché, Carrefour, Monoprix and Coopérative U were all hit. No group has claimed responsibility and no ransom was demanded. Experts told Reuters the attack appears to have been easy to pull off, and more than 1,700 instances of the affected software were exposed to the internet in France. Danfoss said many units had reached end of life and no longer received security updates.
In the United States, water systems were the target. Suspected Iran-linked hackers breached more than 30 Minnesota water utilities on 26–27 July, exploiting a flaw in Rockwell industrial controllers. Michigan reported attacks on nine of its systems, and federal agencies said at least seven states were compromised, with no damage or injuries reported. US intelligence agencies believed Iran was highly likely responsible, though President Trump publicly rejected that view. The access could have been used to adjust chemical-treatment levels and water pressure.
Ordinary ransomware remains costly too. An attack on Marks & Spencer in April 2025 cost around £300 million after online and app orders were suspended.
Is this a new war?
Not new, but different. Cyber operations against states date back well over a decade, from Estonia in 2007 to Stuxnet around 2010 and the attacks on Ukraine’s power grid in 2015. What has changed is scale, ambition and ambiguity.
Cyber and conventional war now run together. The Middle East entered a critical phase of hybrid warfare after the escalation between Iran, the United States and Israel on 28 February 2026, and the water intrusions came after Iran stepped up cyberattacks following the US-Israeli war against it. Profit and strategy have also merged, since theft can fund a state and a financial hack can double as a geopolitical act. And digital attacks now cause physical damage: spoiled food, fires and tampering with water chemistry are real-world consequences.
Legally, most of this sits below the threshold of war. Treating a cyberattack as an armed attack requires severe, attributable effects, and attribution is slow and uncertain. Polling shows broad swaths of the public in key NATO countries consider attacks like those on hospitals to be acts of war, while governments’ responses have been restrained. The result is a gray zone, damaging enough to hurt and deniable enough to avoid retaliation.
How adversaries can bring a country to a standstill
The weakest link may be a single person. The Binance case suggests that attackers who compromise an engineer and pivot into internal systems that can authorize transactions can bypass strong cryptography entirely. Industrial equipment is exposed in a different way. Refrigeration units, water pumps and building systems were built for reliability, not hostile networks, and many sit on the open internet running unsupported software.
Supply chains concentrate the risk. One vendor’s software can sit in hundreds of stores or utilities, as the Danfoss controllers did across several rival chains, so one weakness hits them all. The damage then cascades, because power, water, telecoms, payments, logistics and refrigeration depend on one another. A cold chain failure empties shelves within days, a failed water plant halts hospitals, and an exchange outage freezes liquidity. Attackers need not break everything, only the node others rely on.
Time is another weapon. Experts expect adversaries to embed themselves in critical systems for months or years, so access gained quietly in peacetime can be activated in a crisis. Trust is a target as well. Draining an exchange that serves millions of users tests the confidence digital finance depends on, and a run on the platform can be as damaging as the theft itself. Perception does much of the work, too. The water intrusions caused no injuries, yet they dominated politics, and in hybrid conflict, perception itself becomes a weapon.
What resilience looks like
Most successful attacks exploit basics rather than novel techniques. Engineers with access to production systems need isolated, monitored devices, and no single session should be able to trigger large transfers. Big withdrawals should require independent approval, with rate limits and delays so that a compromised service cannot move billions in minutes. Control systems belong off the public internet or behind strict access controls, and end-of-life equipment that no longer receives patches should be retired. Segmenting networks keeps a breach in one system from spreading to others, and boards can press suppliers on their security, as analysts advised after the French incident. Utilities and retailers that can operate manually for days limit the damage when systems fail.
France’s economy minister said there is no risk of food shortages, and Binance says users will be made whole. Both reassurances may hold. But a country’s food supply, water and savings can be disrupted by attackers who never cross a border, and recovery in each case depends on defenses built before the attack.
