The most alarming aspect of what has been described as the largest heist in human history is that the cryptography worked exactly as designed. No one cracked a master private key on the evening of 29 October 2026. Instead, an attacker reportedly reached an internal service container through a compromised DevOps engineer’s laptop and instructed Binance’s signing infrastructure to empty itself.

In roughly 20 minutes, $6.3 billion disappeared across 10 blockchains, including Bitcoin, Ethereum, Solana, and XRP. The incident surpassed the previous grim benchmark set in February 2025, when North Korea’s Lazarus Group drained roughly $1.5 billion from Bybit. Binance’s incident was reported here: https://technext24.com/news/hackers-steal-6-3-bn-from-binance-crypto-heist/

As on-chain alerts spread across X, Binance co-founder Changpeng Zhao (CZ) issued the first public admission in a notably restrained post: “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether ($971m) and Circle ($823m).” The post is available at https://x.com/cz_binance/status/2113029289155178716?a=_Um3FD_EavLoFhA6AWU\u0026s=19.

Minutes later, Zhao added: “I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

By Friday, 30 October, roughly $3 billion in stolen stablecoins and tokens had been frozen on-chain — under half of the total taken. The FBI and TRM Labs had linked the heist with high confidence to North Korea’s TraderTraitor unit.

The attack came as the market absorbed $1.49 billion in liquidated leveraged positions and Bitcoin fell below $78,000. Binance CEO Richard Teng responded in a video address, pledging a $6.34 billion corporate backstop.

“We are committed to covering all hacked losses through our company funds. Your assets are safe,” Teng said, insisting that the drain had affected only corporate hot wallets. “We never use any customer funds, so they are not impacted.”

Viewing the Binance heist as an isolated crypto failure, however, overlooks the broader pattern. The 29 October drain was the finale of a 31-day global cybersecurity collapse. Throughout what became known as Black October, defensive perimeters protecting web servers, banks, and digital-asset infrastructure failed at the same time.

The PHP2Shell foundation crack

Seven days before Binance’s wallets were drained, Zhao posted a warning on X that later appeared prescient. “Call me paranoid, but be extra careful visiting ANY website in the next few days, as some web admins are not always up-to-date with security patches,” he wrote on 21 October, referring to two newly disclosed vulnerabilities in PHP. The related report is available at https://technext24.com/policy-and-tech/nigeria-php2shell-cybersecurity-response/.

The next day, he followed up with an engineering maxim: “No crypto wallet is 100% safe. No software is bug-free. No tech is 100% secure.” His second post is available at https://x.com/cz_binance/status/2113462904435642556?a=jQb9RLbCOmUH6MqtmH8\u0026s=19.

The vulnerabilities behind Zhao’s warning were known as PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619. The twin use-after-free memory bugs carried a critical CVSS v4.0 severity rating of 9.2 and affected every default installation of the core PHP runtime from version 5.4 through 8.5.11.

PHP powers roughly 70% of the internet’s server-side infrastructure. The vulnerabilities allowed unauthenticated attackers to execute remote code and expose server memory—including session tokens, TLS private keys, and database passwords—before a website’s application code ran.

Exploitation reportedly began around 17 October, four days before the PHP Group released emergency patches on 21 October. The patched versions were 8.5.12, 8.4.27, 8.3.36, and 8.2.35, the releases that operators of affected servers needed to install to close the exposure. Cloudflare CTO Dane Knecht promptly reported “early attacks emerging” and warned that web application firewalls offered only a temporary stopgap.

“This is a goldmine for hackers,” said Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes. “They can hijack real websites to take advantage of the site’s reputation to do things like phishing people and serve malicious software from the trusted channel. The opportunities are endless.”

Crypto exchanges and modern fintech companies often build their core systems in Go, Rust, or TypeScript. However, security researchers at Halborn noted that PHP remains widely used for the marketing sites, support portals, and back-office administration panels surrounding those systems. Many of those services contain live API keys and webhook secrets.

As this underlying web infrastructure came under pressure, threat actors spent October harvesting credentials and breaching institutions across every continent.

In South Africa, pathology company Ampath Laboratories was attacked by the ByteToBreach ransomware group. The same threat actor had previously targeted Nigerian institutions, including Sterling Bank and the Corporate Affairs Commission (CAC), earlier in the year. ByteToBreach claimed to have exfiltrated 80 million patient records.

Attackers also targeted traditional financial and retail companies. In South Korea, hackers used a Chinese AI tool to breach 16 financial firms by mid-month, stealing 68,000 records. They later targeted Daishin Securities, exposing 38,490 records, as well as Mirae Asset and the internal groupware of crypto exchange Bithumb on 28 October.

In Italy, fraudsters used a three-minute AI-generated clone of a lawyer’s voice to persuade executives at Fideuram, Intesa Sanpaolo’s private-banking arm, to transfer $108 million to foreign accounts. In Japan, IT company GMO Internet faced a $50 million ransom demand after its foreign-exchange and cloud servers were breached. Retailer MUJI exposed 27.26 million customer records, while Cathay Pacific lost 53,000 booking records in a supplier breach.

The digital-asset sector faced additional incidents before Binance was attacked. Hardware-wallet maker Ledger disclosed on 12 October that rogue LTE eSIM implants hidden in devices sold through third-party reseller CryptoBilis had siphoned $86 million in user funds.

On 20 October, rival wallet maker Keystone said it had to destroy 18,835 unsold devices after a third-party tracking breach exposed 25,964 buyer records and a manufacturing verification key. By 28–29 October, Coinbase confirmed that customer data had been exposed through analytics vendor Amplitude. Prediction market Polymarket halted international trading after a hijacked script from UK monitoring vendor DebugBear drained $2.65 million from more than 700 accounts.

Three structural shifts

Three structural changes help explain why security failures appeared across the global system at the same time in October 2026.

First, workflow subversion has increasingly replaced direct key theft. As Zhao wrote on 21 October, “AI doesn’t need to break Bitcoin’s cryptography to cause damage; leaked data already enables more phishing, social engineering, etc.”

At Binance, the attackers reportedly did not steal private keys. They compromised an engineer’s workstation, reached a service container that requests withdrawals, and exploited the signing layer’s implicit trust in that container. After gaining access, they weaponised Ethereum’s EIP-7702 feature—a protocol capability that lets ordinary blockchain accounts take on smart-contract-like programmability—to automate the cross-chain drain within minutes.

Second, offensive AI became autonomous. During October, cybercrime groups deployed agentic AI platforms built on commercial large language models—autonomous systems capable of chaining together multi-step tasks with minimal human oversight—to scan for unpatched PHP2Shell servers, automate Active Directory takeovers through ConnectWise backups, and target more than 400 financial institutions across Latin America and Asia faster than human teams could patch them.

Third, the perimeter surrounding third-party vendors collapsed. Polymarket’s DebugBear script and Coinbase’s Amplitude tracker were among the external tools used to reach affected companies. Cloud credential leaks at Railway and LiteLLM illustrated the same weakness: organizations were repeatedly compromised through tools added to their technology stacks.

Black October demonstrated that a billion-dollar reserve fund and military-grade cold storage cannot protect an ecosystem when a single unpatched PHP server, poisoned vendor script, or compromised engineer’s laptop can instruct a vault to empty itself.