The attacker behind the largest crypto theft on record took control of a machine Binance trusted, then sent the money to wallets nobody has to answer for.
On 29 October 2026, Binance suspended withdrawals and put the impact of a security breach at about $6.3 billion. If the figure holds, it is the largest crypto theft ever recorded, roughly four times the size of the Bybit hack in February 2025.
It is a hard day for Binance's users and team, and nobody in this industry wanted to see it. What happened to the money after it left says a lot about where digital finance is still exposed, so it is worth looking at closely.
What Happened, as Far as We Know
Binance's initial investigation points to a compromised laptop belonging to a DevOps engineer. From there, an attacker reached a service container and submitted withdrawals nobody had approved. Co-CEO Richard Teng later said the attack involved a more complex process than the misuse of one engineer's permissions, and that there was no evidence of any wallet private key leak.
The figures are still moving. Binance put the frozen total at about $3 billion, Tether froze about $1.56 billion in USDT, and Circle's CEO reported more than $800 million in USDC. Binance has pledged to cover customer losses.
Bybit lost its funds through blind signing on a smart contract wallet. Here, a trusted machine signed what it was told to sign. The attackers got in by different routes, and the laundering differed too, but in both cases the money landed in wallets with no accountable owner.
The Common Thread Is the Exit
Stolen funds on a public chain usually follow a familiar path. They land in wallets with no known owner, then move through decentralised exchanges, bridges, mixers or, as here, market makers and lending protocols, until investigators lose the trail.
So far, the money that has been stopped was stopped by someone answerable for it: a stablecoin issuer, the exchange itself, a network's security council, or the authorities working with them. Everything else kept moving, because on most chains a wallet is just a key pair and nobody has to say who holds it.
This hack also became a race between assets that can be frozen and assets that cannot. Stablecoins are the easiest to stop because the issuer controls the token, which is how Tether and Circle were able to freeze funds. Bitcoin and ether have no issuer, so, as Chainalysis head of research Eric Jardine told CNBC, investigators have to trace the funds and step in when they reach an exchange or another platform that cooperates.
The attacker seems to have understood this from the start. According to blockchain analytics firm Elliptic, 434 million USDT was swapped for ether through Uniswap, 1inch and market makers at an implied loss of 12% to 26%, a sign the attacker was putting speed ahead of value, and a second wallet borrowed against its stablecoins on Aave. Elliptic has verified $2.84 billion of frozen funds, 44% of the theft and almost all of it USDT and USDC. The rest is being swapped into ether and other assets that cannot be frozen.
Privacy and Anonymity Are Different Properties
Privacy means the people you deal with do not see your personal details. Anonymity goes further: even a court cannot establish who controls an account. Most public chains offer pseudonymity, which comes close: every address can be traced, but nothing ties it to a person who must answer for it. Concordium was designed to give privacy without anonymity.
Every account on Concordium is linked to a Concordium ID, a credential issued by an independent Identity Provider after an off-chain identity check. Concordium never sees the documents, and the providers that do, such as Notabene, Digital Trust Solutions and Global Finreg, never see what the account does on-chain. A counterparty sees a valid account and, if it asks, a proof of the facts it needs, such as age or nationality.
How Identity Disclosure Works
The protocol's link between a person and their accounts can only be opened through a legal process, and no single party controls it. It starts when an authority obtains a court order in the Privacy Guardians' jurisdiction, plus one in the Identity Provider's if it sits elsewhere, and serves them. The Privacy Guardians are independent law firms that each hold a cryptographic key share rather than any personal data. Two out of three must currently cooperate, and the Identity Provider has to take part as well, since it holds the identity record.
Each party holds one piece. The Identity Provider knows who the person is but not what their accounts do, and the Privacy Guardians can open the link but hold no personal data. None of them can act alone, and no single party, Concordium included, can open the link alone.
For everyday users, nothing is revealed. An account used to receive stolen funds is different, because court orders can follow it back to whoever passed the identity check.
What This Would and Would Not Change
Identity at the protocol level would not have stopped a compromised laptop. Endpoint security, withdrawal controls and key management are still the first line of defence on any chain.
The difference is where the money can go. A thief could not receive funds in an account with no identity behind it. Each account the money touches traces, through court orders, to whoever passed the identity check, even if that turns out to be a stolen identity or a mule. That should make laundering costlier, and it gives investigators a starting point that does not depend on the attacker making a mistake.
There are limits. A criminal can try a stolen or purchased identity, funds can be bridged to other chains, a court process takes time, and an attacker abroad may sit beyond any court's reach, so disclosure gives recourse after the fact rather than a freeze in the moment.
Token issuers also get their own controls. Protocol-Level Tokens (PLTs) let the issuer pause its token and, if the token is set up with them, keep allow and deny lists. Tether and Circle write these controls into each token's own contract, whereas on Concordium they are a standard protocol feature an issuer can switch on, so a PLT can sit on the freezable side of that race from launch.
Why This Matters More as Machines Move Money
The Binance breach ran through a machine with the right to move funds, and once it was hijacked, its transactions looked exactly like legitimate ones. AI agents are starting to get the same kind of payment rights, so the exit question will apply to them too: when a compromised agent pays out, where can the money land?
On Concordium, agents work on the same identity layer as people. Every account an agent pays into is linked to a verified identity like any other, and through the Agent Registry the agent itself can carry the Verified by Concordium badge, which shows that an accountable party stands behind it without revealing who. Verify Once. Prove Everywhere. Reveal Nothing.
The Road Ahead
Binance will publish a technical report, and the industry will tighten endpoint security because of it. What it will not fix is the exit. While stolen funds can still land in wallets with no known owner, large breaches will keep ending with a trail that goes cold.
For anyone building wallets, exchanges or agents, it is worth asking where money can go when it leaves your system without permission.
Join the Concordium community and follow us on X.