From PHP2Shell to Binance’s $6.3bn drain: inside the structural failures that caused Black October

The most terrifying detail about the largest heist in human history is that the cryptography worked exactly as designed. Nobody cracked a master private key on the evening of 29 October 2026. Instead, an attacker reached into an internal service container through a compromised DevOps engineer’s laptop and politely asked Binance’s signing infrastructure to empty itself.

In roughly 20 minutes, $6.3 billion vanished across 10 blockchains, including Bitcoin, Ethereum, Solana, and XRP. It shattered the grim benchmark set in February 2025, when North Korea’s Lazarus Group drained roughly $1.5 billion from Bybit.

As on-chain alerts lit up X, Binance co-founder Changpeng Zhao (CZ) delivered the first public admission in a starkly understated post: “User funds are safe! It does look like a hack on Binance. Appreciate the quick freeze from Tether (~$971m) and Circle (~$823m).” Minutes later, he added: “I don’t manage Binance (.com) anymore, but as a shareholder, I expect all user funds will be fully covered.”

By Friday, 30 October, roughly $3 billion in stolen stablecoins and tokens had been frozen on-chain; the FBI and TRM Labs had linked the heist with high confidence to North Korea’s TraderTraitor unit.

To calm a bleeding market that had just liquidated $1.49 billion in leveraged positions and dragged Bitcoin below $78,000, Binance CEO Richard Teng stepped forward in a video address to pledge a $6.34 billion corporate backstop.

“We are committed to covering all hacked losses through our company funds. Your assets are safe,” Teng said, insisting the drain only hit corporate hot wallets. “We never use any customer funds, so they are not impacted.”

Yet viewing the Binance heist as an isolated crypto failure misses the wider story. The 29 October drain was merely the finale of a 31-day global cybersecurity collapse. Throughout Black October, the defensive perimeters protecting web servers, banks, and digital asset rails failed simultaneously.

The PHP2Shell foundation crack

Seven days before Binance’s wallets were drained, Zhao posted a warning on X that now reads like a dark prophecy.

“Call me paranoid, but be extra careful visiting ANY website in the next few days, as some web admins are not always up-to-date with security patches,” Zhao wrote on 21 October, pointing to two newly disclosed flaws in the PHP programming language.

The next day, he followed up with an engineering truism: “No crypto wallet is 100% safe. No software is bug-free. No tech is 100% secure.”

The trigger for Zhao’s paranoia was PHP2Shell (tracked as CVE-2026-109618 and CVE-2026-109619). Carrying a critical 9.2 CVSS v4.0 severity rating, the twin use-after-free memory bugs affected every default installation of the core PHP runtime from version 5.4 through 8.5.11. Because PHP powers roughly 70% of the internet’s server-side plumbing, the flaw allowed unauthenticated attackers to execute remote code and leak server memory, including session tokens, TLS private keys, and database passwords, before a website’s application code even ran.

Worse, exploitation began around 17 October, four days before the PHP Group could ship its 21 October emergency patches (versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35). Cloudflare CTO Dane Knecht immediately reported “early attacks emerging”, warning that web application firewalls were only a temporary stopgap.

“This is a goldmine for hackers,” said Shahak Shalev, Global Head of Scam and AI Research at Malwarebytes. “They can hijack real websites to take advantage of the site’s reputation to do things like phishing people and serve malicious software from the trusted channel. The opportunities are endless.”

While crypto exchanges and modern fintechs build their core engines in Go, Rust, or TypeScript, security researchers at Halborn noted that PHP still runs the marketing sites, support portals, and back-office admin panels surrounding those platforms, many of which hold live API keys and webhook secrets.

31 days of global breaches

With the web’s foundational plumbing leaking, threat actors spent October harvesting credentials and breaching institutions across every continent.

In South Africa, pathology giant Ampath Laboratories was struck by the ByteToBreach ransomware group, the same threat actor that previously targeted Nigerian institutions, including Sterling Bank and the Corporate Affairs Commission (CAC) earlier in the year, which claimed to have exfiltrated 80 million patient records. 

Across traditional finance and retail, attackers ran riot. In South Korea, hackers used a Chinese AI tool to breach 16 financial firms by mid-month (stealing 68,000 records) before hitting Daishin Securities (38,490 records), Mirae Asset, and crypto exchange Bithumb’s internal groupware on 28 October. In Italy, fraudsters used a three-minute AI clone of a lawyer’s voice to trick executives at Fideuram (Intesa Sanpaolo’s private banking arm) into wiring $108 million to foreign accounts. In Japan, IT giant GMO Internet faced a $50 million ransom demand after its forex and cloud servers were breached, while retail giant MUJI exposed 27.26 million customer records, and Cathay Pacific lost 53,000 booking records via a supplier breach.

Before Binance was hit, hardware wallet maker Ledger disclosed on 12 October that rogue LTE eSIM implants hidden inside devices sold via third-party reseller CryptoBilis had siphoned $86 million in user funds. On 20 October, rival wallet maker Keystone had to destroy 18,835 unsold devices after a third-party tracking breach exposed 25,964 buyer records and a manufacturing verification key. By 28–29 October, Coinbase confirmed customer data exposure via analytics vendor Amplitude, and prediction market Polymarket halted international trading after $2.65 million was drained from over 700 accounts via a hijacked script from UK monitoring vendor DebugBear.

Why October broke the perimeter

Three structural shifts explain why global security failed all at once in October 2026.

First, workflow subversion has replaced key theft. As Zhao noted on 21 October, “AI doesn’t need to break Bitcoin’s cryptography to cause damage; leaked data already enables more phishing, social engineering, etc.” At Binance, the attackers never stole the private keys. They compromised an engineer’s workstation to reach a service container that requests withdrawals, and the signing layer blindly trusted the container. Once inside, the attackers weaponised Ethereum’s EIP-7702 feature to automate the cross-chain drain in minutes.

Second, offensive AI became autonomous. October was the month when cybercrime syndicates deployed agentic AI platforms built on commercial LLMs to scan for unpatched PHP2Shell servers, automate Active Directory takeovers via ConnectWise backups, and target over 400 financial institutions across Latin America and Asia faster than human teams could patch.

Third, the third-party vendor perimeter collapsed. From Polymarket’s DebugBear script and Coinbase’s Amplitude tracker to cloud credential leaks at Railway and LiteLLM, companies were repeatedly gutted through the external tools bolted onto their stacks.

Black October proved that a billion-dollar reserve fund and military-grade cold storage cannot save an ecosystem when a single unpatched PHP server, a poisoned vendor script, or a compromised engineer laptop can instruct the vault to empty itself.