How One Laptop Stole $6.3 Billion in About 20 Minutes

 


By Shakeel Ahmed — AI Growth Lab

Answer first: the Binance hack was not a break-in through a vault door. Investigators say a single compromised DevOps engineer's laptop gave an attacker a way into a service container, and from there unauthorised withdrawals drained an estimated $6.3 billion — the largest crypto theft ever recorded.

That number is hard to grasp, so here is the scale. The previous record was the $1.5 billion Bybit theft in 2025. This one is roughly four times bigger. At one point, wallets linked to the hacker reportedly held $5.7 billion, including about $1.5 billion in Bitcoin and $900 million in Ether.

What actually happened

Binance is the world's largest crypto exchange. Before the hack it held about $144 billion in customer assets, according to reporting on the incident. On 2026-10-29, something went wrong very fast:

  • An attacker compromised a DevOps engineer's laptop
  • That access reached a service container inside Binance's systems
  • Unauthorised withdrawals were triggered from hot wallets
  • Binance paused withdrawals while it investigated
  • No leak of wallet private keys has been found so far, according to Binance's account

The distinction matters. A private key leak would mean the keys themselves were stolen. What investigators describe instead is abuse of access — a trusted system, used by an untrusted person.

Why 20 minutes was enough

Crypto moves at machine speed. Once withdrawals start, there is no bank clerk to phone, no cheque to stop, and no business day to wait for. The attacker did not need to break every lock. They needed one working path and enough time to use it before alarms, freezes and human decisions caught up.

That is also why the recovery race started instantly. Binance and partners moved to freeze funds across the crypto system. About $3 billion was frozen, including roughly $2.3 billion in USDT and USDC stablecoins. Stablecoins can be frozen by their issuers in a way Bitcoin cannot, which is one reason the frozen total climbed so fast.

The money Binance put aside

Binance said it set aside $6.34 billion to cover losses and that user funds are safe. That statement is important, but it is not the same as saying nobody lost anything. It means Binance, as a company, is absorbing the hit rather than passing it to customers — at least on its own account of events.

Withdrawals were paused first, deposits were later reopened, and a full resumption was expected in roughly 45 to 48 hours, around Sunday morning. For ordinary users, that pause was the most visible part of the crisis: money you could see, but could not move.

The market reaction was instant

Fear spread faster than facts. Bitcoin fell about 5% to below $77,000, Ether fell about 6%, and Binance's own BNB token fell about 10%. None of those falls prove the crypto system itself was broken. They show how much confidence matters in a market where trust is the product.

The shocking lesson

The most shocking part is not the size. It is the simplicity. A company holding $144 billion was not beaten by a supercomputer. It was beaten, on the current account, by one laptop, one container, and a chain of trust that nobody broke in time.

That is why security teams now talk less about stronger walls and more about smaller blast radius: fewer people with broad access, shorter-lived credentials, withdrawals that need more than one approval, and automatic stops when amounts spike. A single point of access should never be worth $6.3 billion.

What to watch next

  • Whether the frozen $3 billion grows, or whether more funds move beyond reach
  • Whether investigators confirm the North Korea link with public evidence
  • Whether Binance publishes a full technical timeline, not just a summary
  • Whether other exchanges quietly tighten the same kind of DevOps access

Related reading on AI Growth Lab: AI agents and the new security risks, How offline AI training changes trust, Why robots and physical AI need new safety rules

Sources: reporting by CoinDesk, Al Jazeera, CNN and The Hindu on the Binance hack, the frozen funds and the market reaction.

Comments

Post a Comment

Popular posts from this blog

92 Million Jobs Gone by 2030: What AI Is Really Doing to Your Career

Image
By Shakeel Ahmed Every few months, a new headline declares the end of human work. AI writes code, reads X-rays, drives trucks, drafts contracts, and now — with the arrival of always-on AI agents — it watches your inbox, investigates bugs, and prepares reports while you sleep. In short: The World Economic Forum's Future of Jobs Report 2025 projects 92 million roles displaced by 2030 — and 170 million created, for a net positive. Measured data already shows impact: Goldman Sachs counted 16,000 net U.S. job losses per month from AI displacement, U.S. employers attributed 116,175 job cuts to AI in 2026, and Stanford found employment for software developers aged 22-25 fell nearly 20% since 2024. The question is no longer whether AI will change work. It is how much, how fast, and what humans are supposed to do when the dust settles. This article does what most coverage does not: it separates what the data actually shows from what the panic implies, walks through the numbers field by...
Read more

AI Wrote the Code for 16 New Viruses — and Every One Came Alive

Image
By Shakeel Ahmed — AI Growth Lab   Imagine an AI writing a recipe — except the recipe is a virus , and when scientists cooked it in the lab, it came alive. In short: On August 6, 2026, Stanford researchers announced in Science that their AI, Evo 2, designed 16 viruses that never existed before. Scientists built all 16 from the AI's code, and every one worked — they hunted, infected, and killed their bacterial targets. The breakthrough could lead to AI-designed treatments for drug-resistant infections, but experts warn the same technology could be misused. That's exactly what happened. On August 6, 2026, Stanford researchers announced in the journal Science that their AI had designed 16 viruses that never existed before . Scientists built them from the AI's code. All 16 worked — they hunted, infected, and killed their targets. How an AI Wrote Living Code Think of DNA as a recipe book written with only four letters: A, T, C, G. The Stanford team built an AI called Evo 2 th...
Read more

Iran-Linked Cyberattacks on the United States: What Is Reported, What Is Suspected, and What Is Still Unconfirmed

Image
  By Shakeel Ahmed — AI Growth Lab Iran-linked hackers have been reported in recent weeks targeting a broad range of American critical infrastructure, including water systems, telecommunications, energy facilities, and military and medical systems. The key fact to keep in mind first is this: many of these links are reported as suspected, based on sources speaking anonymously, and are not yet publicly confirmed by the Pentagon or by a released forensic report. What has been reported Water systems, July 2026: In late July 2026, coordinated attacks hit water systems in Minnesota, in more than 30 communities, and in at least six other states, with some reports expanding the scope to around a dozen states and over 100 facilities. The attacks focused on internet-connected programmable logic controllers, the devices that control pumps, wells, towers, and lift stations. US agencies, including CISA, the FBI, and the NSA, have warned since April 2026 that Iranian-affiliated actors are explo...
Read more