This page requires JavaScript to display.

Binance's $6.3B heist

Business · Heat 10.0 / 10 · 12 shows · 1h 3m airtime

Binance said on October 29, 2026 that it was investigating an apparent cyber heist of about $6.3 billion and suspended transactions. Its initial investigation points to a compromised engineer's laptop that let an attacker submit unauthorized withdrawals; the attacker submitted 50 signed EIP-7702 authorizations, and only the one matching Binance 14's next nonce, 18,914,809, was accepted. Tether and Circle have frozen about $3 billion in stablecoins, leaving roughly $3.3 billion with the hackers, against a $1 billion emergency reserve. TRM Labs attributes the heist to a North Korean group called Trader Trader, which carried it out in about 20 minutes. A co-founder said deposits were unaffected and withdrawals should resume in about 48 hours.

How 12 podcasts covered it

  1. WSJ What's News, 2026-10-30 (1:25 to 3:56)
    Reports the Binance heist figures and frozen funds
    Reports the Binance heist with the numbers behind it: about $6.3 billion taken, about $3 billion frozen, attribution to North Korea's Trader Trader, and the Polymarket hack the day before. Frames it around state-sponsored groups getting more ambitious and AI cyber tools as a growing worry.
    New angle: Hackers took about $6.3 billion from Binance and roughly $3 billion has been frozen.
  2. Morning Brew Daily, 2026-10-30 (21:42 to 23:04)
    Adds the compromised laptop mechanism
    Runs the heist as a sprint headline: the $6.3 billion figure, suspended withdrawals, Zhao's promise to cover losses and the Trader Trader attribution. Adds the one mechanism detail the record lacked - a compromised engineer's laptop that let an attacker reach a service container and submit unauthorized withdrawals.
    New angle: Binance's initial investigation points to a compromised engineer's laptop that let an attacker submit unauthorized withdrawals.
  3. Squawk Pod, 2026-10-30 (3:15 to 7:03)
    Adds Binance's response to the hack
    Reports the heist as the largest crypto hack ever and adds Binance's on-the-record response: deposits unaffected, withdrawals expected back in about 48 hours, all losses covered. Also puts TRM Labs' attribution and the market reaction on the record.
    New angle: Binance's co-founder said on X that deposits were unaffected and withdrawals should resume in about 48 hours.
  4. Global News Podcast, 2026-10-30 (10:59 to 14:00)
    Reports the breached laptop and frozen funds
    Reports Binance's disclosure of a breach traced to an engineer's laptop, the Trader Traitor attribution, the frozen funds and the muted Bitcoin reaction, set against North Korea's crypto-theft record.
    New angle: Binance says a breached engineer's laptop led to a hack linked to more than $6 billion, with about $3 billion located.
  5. Tech Brew Ride Home, 2026-10-30 (1:25 to 8:46)
    Reconstructs the EIP-7702 sweeper and the nonce
    Opens with the record $6.3 billion Binance breach and walks through the freeze, the SAFU shortfall and the EIP-7702 sweeper reconstruction, including the 50 signed authorizations and the single nonce that landed.
    New angle: The attacker submitted 50 signed EIP-7702 authorizations; only the one matching Binance 14's next nonce, 18,914,809, was accepted.
  6. Breaking Points with Krystal and Saagar, 2026-10-30 (45:22 to 53:31)
    Walks through the hack from Binance's statement
    Walks through the mechanics of the Binance hack from the company's own statement: a compromised engineer's laptop, a hijacked hot wallet, most funds gone in under 20 minutes, $3 billion frozen. Widens into crypto's safety narrative and AI breaking encryption.
    New angle: Hackers reached Binance's withdrawal systems through one engineer's laptop; about $3 billion has been frozen.
  7. Bloomberg Tech, 2026-10-30 (19:27 to 22:20)
    Reports the Binance breach and frozen stablecoins
    First coverage of the Binance breach: the laptop entry point, the $3 billion stablecoin freeze, the DPRK attribution from three analytics firms, and the muted market reaction. Binance says company funds cover the full loss.
    New angle: Binance says $6.3 billion was affected; about $3 billion in stablecoins is frozen and withdrawals are suspended until Sunday.
  8. TBPN, 2026-10-30 (9:01 to 15:03)
    Walks through the Binance heist numbers
    Walks through the heist's numbers: the $6.3 billion take against a roughly $1 billion Secure Asset Fund, the $3 billion Tether and Circle froze, and the $3.3 billion still loose. Notes Bitcoin fell only about 4% over five days, against roughly 25% after Mt. Gox.
    New angle: Tether and Circle froze about $3 billion of the $6.3 billion, leaving roughly $3.3 billion with the hackers.
  9. Closing Bell, 2026-10-30 (29:54 to 31:50)
    Recaps the heist and adds FBI and Secret Service roles
    Recaps the heist on air: North Korean attribution, $6.3 billion moved in about 20 minutes, the Bybit comparison, withdrawals paused until the rebuilt system passes testing, and the crypto sell-off. Stays inside the week's coverage, adding only the FBI and Secret Service roles.
  10. The Information's TITV, 2026-10-30 (33:31 to 44:38)
    Interviews a reporter on the frozen funds
    Interviews The Information's crypto reporter and a Predicate co-founder on the $6.3 billion Binance hack: the compromised engineer's laptop, a likely North Korean state actor, Circle and Tether freezing addresses within about 40 minutes, and the roughly $3 billion still exposed after freezes.
    New angle: About half the $6.3 billion was frozen, leaving roughly $3 billion exposed, against a $1 billion emergency reserve.
  11. Morning Wire, 2026-10-30 (3:44 to 5:04)
    Reports TRM Labs' attribution and 20-minute timeline
    Opens with the Binance heist as reported by TRM Labs - the $6 billion figure, the Trader Trader attribution, the 20-minute timeline and the frozen withdrawals - then pivots to a CrowdStrike report on a China-linked AI hacking campaign against 200-plus organizations.
    New angle: TRM Labs attributes the Binance heist to a North Korean group called Trader Trader, which pulled it off in about 20 minutes.
  12. This Week in Startups, 2026-10-30 (0:07 to 2:12)
    Opens with the heist and the frozen funds
    Opens the episode with the Binance heist: the $6.3 billion estimate, the suspended deposits and withdrawals, the compromised engineer's laptop, and the roughly $3 billion frozen on chain by Tether, Circle, Ripple and World Liberty Financial. The hosts spend the first minutes joking about how the hack might have started.
    New angle: Binance says a compromised engineer's laptop may have let the attacker submit unauthorized withdrawals.
  13. This Week in Startups, 2026-10-30 (2:14 to 7:27)
    Replays the 2021 warning and fills in CZ's history
    Plays Jason's July 2021 clip urging listeners to pull money off Binance, then fills in the CZ backstory - the Bank Secrecy Act plea, the four-month sentence at Lompoc, the 2025 pardon, his 90% stake - and credits him for backstopping the losses. Reaction and history, not new reporting on the hack.
  14. TBPN, 2026-10-30 (6:31 to 10:33)
    Breaks down the SAFU fund and frozen funds
    Walks through the Binance heist: the $6.3 billion take, the roughly $1 billion SAFU fund it blew past, the $3 billion frozen by Tether and Circle, and the TraderTraitor attribution. Notes Bitcoin fell only about 4% where Mt. Gox cost 25 to 27%.
    New angle: Hackers took $6.3 billion from Binance, roughly $3.3 billion of it still under their control.
  15. TBPN, 2026-10-30 (10:39 to 12:26)
    Reads CZ and Musk's exchange after the hack
    Reads the X exchange between CZ and Musk after the hack, including CZ's claim that Binance's SpaceX shares are worth more than a billion and a Binance staffer's reply that yearly revenue covers the losses without selling them. Also notes Chainalysis-style tracking graphics of the stolen funds.
    New angle: CZ says Binance's SpaceX shares are worth more than a billion dollars and need not be sold to cover the losses.
Unpacking...