The Binance theft

What happened

On the evening of 29 October 2026, money started leaving Binance, the world’s largest cryptocurrency exchange, on the XRP Ledger at 20:05 UTC. Within about 20 minutes, its hot wallets on ten blockchains had sent most of $6.36 billion to addresses the attackers controlled.¹ Binance puts the loss at about $6.3 billion; Elliptic, which counts slightly differently, has $6.43 billion.²

That is more than four times the $1.5 billion taken from Bybit in February 2025, the previous record.²

Hot wallets are the wallets an exchange keeps online to pay out customer withdrawals. Every one of the transfers here was signed by Binance’s own systems.¹

How it worked

On every chain except Ethereum, the wallets simply sent their funds out in ordinary signed transfers. The Bitcoin hot wallet sent 18,270 BTC in one go; the Tron wallet sent 612.7 million USDT.¹

On Ethereum the attacker used EIP-7702, a feature added in the Pectra upgrade of May 2025. It lets an ordinary wallet hand its behaviour to a smart contract by signing an authorization. The handover lasts until the wallet signs a new one.³

At 20:20:59 UTC the attacker sent one transaction carrying 50 such authorizations, all signed for Binance 14, one of the exchange’s busiest hot wallets. Each authorization only works if its nonce, a counter that goes up with every transaction the wallet sends, matches the wallet’s current count. Binance 14 has sent more than 31 million transactions and its count changes by the minute, so the attacker signed for 50 consecutive values, 18,914,775 to 18,914,824, and let the network discard the 49 that didn’t match.^{4 5}

The one that matched pointed Binance 14 at the attacker’s sweeper contract. About three and a half minutes later, a single call emptied it: 167,464 ETH, about 1.6 billion USDT and 62 other tokens.¹ Because the delegation stayed in place, the sweeper kept taking customer deposits as they arrived, until the last sweep at 23:56.³ Binance 14 could also operate a separate Binance smart account, which is how the attacker got 823 million USDC out of it.¹

Ethereum worked as designed, carrying out a valid signature from the wallet’s own key.³ The attacker could probably have taken the money without EIP-7702; Blockaid’s chief executive said it simply let them do it in one sweep.⁶

How the attackers got in

Binance hasn’t published a root cause, and its account has changed twice so far.

At 02:25 UTC on 30 October it said the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions”, and that it had “found no evidence of any wallet private key leak”.^{7 4} By that morning it said it had found “additional points of breach”.⁶ Its co-CEO, Richard Teng, then said the attack “was not carried out by one person”, that the attackers used a self-destruct mechanism to wipe their tools and traces, and that the Ethereum delegation “did not pass through our normal approval controls”.⁸

TRM Labs, Elliptic, Blockaid and Crystal Intelligence all think the attacker got Binance’s signing systems to sign its transactions, and left the keys where they were.^{1 2 6 5} TRM calls this “the most likely explanation”. The ten chains use separate key stores and two different signature schemes, and all of them produced valid signatures for the attacker within about 30 minutes.³ The attacker pre-signed 50 authorizations because it couldn’t predict the wallet’s nonce, which suggests it had the signer only briefly, and Binance later revoked the delegation from Binance 14 itself, so it still held that key.^{3 5}

Mark Karpelès, who ran Mt. Gox, disagrees. He told Reuters the attackers had probably got the keys to at least two Binance wallets.⁹

Who did it

TRM Labs attributes the theft to TraderTraitor, North Korea’s main crypto-theft unit, with “high confidence”.¹ Chainalysis says the same.¹⁰ Elliptic calls it likely but not certain.² TraderTraitor is the group the FBI named for the Bybit theft.¹

The strongest link is on-chain. On 30 October some of the stolen funds reached the same address as funds from the theft from Bitget, another exchange, in September, which Chainalysis and Elliptic attribute to North Korea.¹⁰ The overlap is small: about $39,000 from Binance against about $510,000 from Bitget. That shows a shared laundering network, which professional launderers sell to more than one client.³ TRM also points to the same preparation as earlier North Korean thefts: small Tornado Cash withdrawals to fund an operator wallet, a rehearsal, then pre-signed transactions fired off in one burst.¹

The laundering looks different from North Korea’s usual work. After Bybit it moved fast, mostly through cross-chain bridges; this time more than $2.6 billion in stablecoins was still sitting in attacker wallets when it was frozen.³

No government has attributed the attack. The FBI has said only that it is aware of it and is coordinating with partners.² Binance says its investigation “has not attributed responsibility to any individual”.⁹

Where the money went

Stablecoins are the one part of a theft like this that can be stopped, because Tether, Circle and the other issuers can freeze tokens at an address. Tether froze the attacker’s main wallet at 21:01 UTC, 37 minutes after the Ethereum sweep, and Circle froze 823 million USDC there three minutes later.¹ Tether’s chief executive said it had frozen more than $1.567 billion in USDT.¹¹ Ripple, World Liberty Financial, First Digital and Paxos froze their own tokens; Arbitrum’s Security Council and Optimism’s governance moved funds out of attacker wallets.^{2 6} By 31 October Elliptic counted $2.85 billion frozen or seized, 94% of it stablecoins.² None of the frozen money has been returned to Binance yet.³

Before the freezes landed, the attacker sold about $786 million in stablecoins for ether and TRX, including 434 million USDT for 160,451 ETH at a loss of 12% to 26%.² One wallet deposited 59.9 million USDT on the lending protocol Aave and borrowed 19,762 ETH against it, and 300 million USDT went to JustLend on Tron.³ Aave froze its markets as a precaution and lifted the freeze the next day.⁶

Nobody can freeze bitcoin, ether or XRP. As of 31 October the attackers still held about $3.2 billion of them, including 519,104 ETH, the 18,270 BTC and 233 million XRP.² None of the bitcoin has moved since the first hour.³ Since early on 30 October TRX has been leaving one Tron wallet in hundreds of small transfers at random amounts, about every 96 seconds, which looks automated.² No cash-out through an exchange, mixer or broker had been confirmed by 30 October.³

What Binance did

Binance suspended withdrawals at about 22:15 UTC on 29 October, about two hours after the first transfer out and more than an hour after Tether’s first freeze.⁵ It paused deposits overnight too, then reopened them.^{6 12}

“Binance will absorb the financial impact of these stolen funds, not our users,” its co-CEOs Yi He and Richard Teng wrote.¹³ Teng said more than $6.34 billion of company funds had been set aside, $5 billion of it already in the tokens that were taken, and that “we never use any customer funds, so they are not impacted”.⁸ The money comes from SAFU, the reserve fund Binance set up in 2018, and its corporate treasury.¹³ SAFU alone holds about $1 billion, in bitcoin.⁹

Binance says it will restart withdrawals in phases from 1 November, after security checks. It plans a full proof-of-reserves report on 2 November and a technical post-mortem after that.^{13 12}

Bitcoin fell to a six-week low of $76,368 and ether to $2,178 on 30 October.⁹ BNB, Binance’s own token, fell about 8%.⁶ The chair of the US Commodity Futures Trading Commission, Michael Selig, said the breach proved the case for the crypto rules his agency had proposed that month.¹⁴

What isn’t known yet

Binance hasn’t said how the attacker reached its signing systems, what the other points of breach were, or how the transfers on chains without EIP-7702 were approved.⁵ Nobody outside Binance can yet say whether a key left the company, and no government has named the attacker. It’s also unclear how much of the frozen $2.85 billion will come back, or when. “A freeze stops the money from moving, and recovery follows through legal process,” said Ari Redbord of TRM Labs.¹⁵

This alert will be updated as Binance publishes its findings.

What it means for you

If you hold funds on Binance, your balance is not what was stolen, and Binance says it is covering the loss itself. The real risk now is scams: messages offering to release a stuck withdrawal, pay compensation or recover funds.

If you run a wallet, Binance kept separate keys on every chain and still lost the lot, because each signer signed what it was asked to, much as Bybit’s signers did. Cointegrity and Crystal Intelligence suggest signers that refuse kinds of message they have no reason to sign, such as EIP-7702 authorizations, and an alert the moment code appears at an address that should have none.^{3 5}

Footnotes

1. TRM Labs, North Korea steals USD 6.36 billion from Binance in the largest hack in history, 30 October 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰

2. Elliptic, The largest theft in history: North Korea likely behind the $6.4 billion Binance hack, updated 31 October 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰

3. Cointegrity, The Binance hack of 29 October 2026: preliminary analysis, 30 October 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹²

4. crypto.news, Binance hack: how one wallet trick led to a $6.3 billion breach, 30 October 2026, citing Blockaid’s analysis. ↩ ↩²

5. Crystal Intelligence, Binance hack: what we know and what teams should do now, 30 October 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

6. Cointelegraph, Binance’s record $6.3B crypto hack as it happened, live coverage, 29 and 30 October 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

7. Binance, preliminary findings, on X, 30 October 2026. ↩

8. Decrypt, Binance sets aside $6.34B to cover hack losses, CEO says ‘your assets are safe’, 30 October 2026. ↩ ↩²

9. Al Jazeera, Binance says $6.3bn stolen in biggest crypto heist in history: what we know, 30 October 2026. ↩ ↩² ↩³ ↩⁴

10. Chainalysis, Binance hack: tracing the $6.4 billion theft to North Korea, 30 October 2026. ↩ ↩²

11. NBC News, Binance targeted in $6.3 billion crypto heist, the largest ever, 29 October 2026. ↩

12. Forkast via Yahoo Finance, Binance says a compromised engineer’s laptop may have opened the $6.3B drain, 30 October 2026. ↩ ↩²

13. crypto.news, Binance reserves $6.34B after hack, targets phased withdrawals, 31 October 2026. ↩ ↩² ↩³

14. CNBC, $6.3 billion Binance hack is largest crypto theft on record, 29 October 2026. ↩

15. CNBC, Binance’s $6.3 billion hack: what we know and what comes next, 30 October 2026. ↩