What does the largest hack in history change for your security?

As of October 31, 2026: the largest theft in the history of money-over-networks is two days old. On October 29, attackers moved approximately $6.36 billion out of Binance hot wallets across 10 blockchains, most of it in about 20 minutes, per TRM Labs. That is 4 times the previous record — the $1.5 billion Bybit hack of February 2025 — and more than twice the $2.87 billion that all crypto hacks combined took in all of 2025, per TRM's 2026 Crypto Crime Report as cited by Al Jazeera. TRM Labs and Chainalysis both attribute the attack with high confidence to TraderTraitor, North Korea's state hacking unit. Around $2.7 billion was frozen within hours. And one number matters as much as the record itself: the count of quantum computers involved was 0. What failed was not encryption — it was the infrastructure that holds and uses the keys. Rosetta Quantum walks through what is measured, what it changes, and what the panic should actually be spent on.

What exactly happened on October 29?

In roughly 20 minutes starting at 20:05 UTC, wallets belonging to the world's largest crypto exchange were emptied across 10 chains — Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon — for approximately $6.36 billion valued at the moment of theft, per TRM Labs' October 30 analysis. A second wave at 23:05 UTC reached Avalanche and Polygon wallets. Binance suspended deposits and withdrawals, said it would cover all losses from its own resources, and warned the figure "may continue to increase", per Al Jazeera's October 30 summary. The breakdown by chain, every row from TRM Labs, October 30, 2026:

How did they get in?

The honest answer, 48 hours in: the root cause has not been published. What is on the record: Binance first pointed to a compromised engineer laptop, then reported "additional points of breach", and says it has found no evidence that any wallet's private key was leaked, per Al Jazeera. What the on-chain forensics show, per TRM Labs: preparation began at least 36 hours earlier, with small Tornado Cash withdrawals funding an operator wallet from October 28; on Ethereum the attacker used an EIP-7702 delegation carrying 50 pre-signed authorizations to turn a Binance hot wallet into a sweeper under attacker control — 3 minutes and 24 seconds later, 167,464 ETH and 1.615 billion USDT were gone; the other nine chains saw ordinary, validly signed transfers. TRM's assessment is that Binance's hot-wallet signing infrastructure was compromised: the attackers did not break the locks, they got the building to sign the doors open. The same pre-obtained-signatures-executed-in-one-burst pattern appeared in the Bybit hack of 2025 and the KelpDAO hack of April 2026, per TRM.

How does it compare with every record before it?

It resets the scale. The previous record, Bybit in February 2025, was $1.5 billion — an event the industry spent a year calling "the biggest hack in history", per Fortune's coverage of February 21, 2025. This is 4.2 times that. All crypto hacks of 2025 combined — nearly 150 attacks — took $2.87 billion, per TRM's 2026 Crypto Crime Report as cited by Al Jazeera: one incident on one evening outweighs that entire year by a factor of 2.2. Binance's SAFU emergency fund, built since 2018 for exactly this scenario, holds about $1 billion — the theft is more than six times its size, per Al Jazeera. Bitcoin fell to a six-week low of $76,368 and ether dropped more than 3% before prices steadied, per Al Jazeera.

Who did it, and why does that matter more than the money?

TRM Labs attributes the attack to TraderTraitor — the North Korean unit linked to the Lazarus Group — "with high confidence"; Chainalysis reached the same conclusion independently, observing stolen Binance funds commingling in real time with funds from September's Bitget theft, already attributed to North Korean actors. The FBI attributed the 2025 Bybit record to the same unit. Binance itself has not attributed responsibility. If the attribution holds, the largest theft in history was not a crime for profit alone: expert consensus cited by Al Jazeera is that North Korea's crypto theft funds the state, including its weapons programs. TRM's Ari Redbord put it in one line: "That makes this a global security issue, not just a crypto theft." A security team should read that twice — the adversary model for custody infrastructure now explicitly includes a state.

What failed — and what did not fail?

No cryptography was broken on October 29. Every transfer that drained those wallets carried a valid signature; the mathematics of the signatures worked perfectly — for the attacker. What failed was the layer the industry audits least and trusts most: the signing infrastructure — the systems and processes that decide what gets signed. That is the same lesson Bybit taught in 2025, now at 4 times the price. The counterweight is also worth measuring honestly: because most of the loot was in issuer-controlled stablecoins, about $2.7 billion was frozen within hours — Tether ≈1.77B USDT, Circle ≈825M USDC, Ripple 40.5M RLUSD, plus others, per TRM — with the first freezes beginning 69 minutes after the theft started, per Chainalysis. Centralization cut both ways: it concentrated the honeypot, and it enabled the fastest multi-billion-dollar asset freeze on record. The attacker still holds roughly $2.4 billion, including more than 420,000 ETH and 18,270 BTC, per TRM, and as Macquarie University's Sean Foley told Al Jazeera, assets on a centralized exchange are "only as safe as the exchange itself."

What should change in your security after this week?

Spend the panic on the perimeter that actually failed, not on the one in the headlines of vendor decks. Four moves, generalized from TRM's published recommendations and the incident record. First, treat signing infrastructure as the crown jewels: separate signing paths and approval quorums by chain and by wallet tier, so that one compromised path cannot authorize everything — the single-burst sweep is what turned a breach into a record. Second, monitor for standing authorizations: on Ethereum that means alerting on any EIP-7702 delegation from treasury wallets and keeping a tested, pre-approved revocation path; the generic version is an inventory of everything that can sign or pre-sign on your behalf. Third, assume preparation precedes execution: this attack was staged at least 36 hours out, per TRM — funding patterns, test transactions and permission changes are detectable before the burst. Fourth, screen counterparties against the laundering in progress: the stolen funds are moving through swaps, lending protocols and peel chains right now, per TRM and Chainalysis, and exposure is a compliance event you can measure. None of these four requires buying a product; all four require knowing your own cryptographic and signing inventory — which is the same discipline every post-quantum migration framework puts first.

Did quantum computing have anything to do with this?

No — and the zero deserves to be said out loud. Rosetta Quantum's public PQC board re-verified both counters today, October 31, 2026: 0 RSA-2048 keys broken by a quantum computer in the public record, and 0 public breaches attributed to a quantum attack. The largest hack in history needed zero qubits — it needed access to signing systems. That cuts against two kinds of noise at once. Against complacency: the threat to your data and your keys is not hypothetical future physics, it is present-day operational security, and $6.36 billion just priced it. And against quantum FUD: if a vendor uses this week's panic to sell you a quantum-themed box, the record says the money is being lost to key management, not to quantum computers — Rosetta's own sealed, refutable Q-Day call (RQ-PRED-QDAY-001: floor 2031, window 2033–2039, a judgment, not a measurement) is documented in the house forecast. The connection that is real: the migration that regulators already scheduled — NIST IR 8547, final since October 27, 2026, will deprecate RSA and ECC after 2030 and disallow them after 2035 — demands exactly the muscles this hack exposed as weak: a complete cryptographic inventory, separated signing paths, and the agility to rotate what you trust. Whether the next signature your infrastructure produces is ECDSA or ML-DSA, the question that mattered on October 29 will be the same: who decided it got signed? The harvest-now-decrypt-later arithmetic and the RSA expiry dates give that migration its calendar; this week gave it its budget argument.

What we don't know

The root cause: Binance has not published how the signing infrastructure was compromised, and its statement that no private key leaked coexists with TRM's assessment of compromised signing infrastructure and former Mt. Gox head Mark Karpeles' estimate that keys for at least two wallets were accessed, per Al Jazeera — these accounts have not been reconciled. The final size: Binance warned the $6.36 billion figure may still grow. The attribution: TraderTraitor is a high-confidence forensic assessment by TRM Labs and Chainalysis, not a court adjudication, and Binance itself has not attributed responsibility; North Korea routinely denies involvement. The recovery: whether the ≈$2.7 billion frozen returns to Binance, and whether any of the ≈$2.4 billion the attacker still holds becomes spendable, will play out over months. And whether this event changes custody architecture industry-wide, or becomes another record waiting to be broken, will be measurable only in the next incident's numbers — a re-verdict is committed in this channel when the root cause is published or a formal investigation reports.

Rosetta Quantum publishes verdicts with raw, reproducible data. This is educational content, not a product claim, and it recommends no vendor.