Binance hack: how $6.3 billion left in 20 minutes — and what it teaches us

On the evening of Thursday 29 October, billions of dollars began leaving wallets belonging to Binance, the world's largest cryptocurrency exchange. Within about 20 minutes, hot wallets on the XRP Ledger, Bitcoin, Tron, Ethereum, Solana and five other blockchains had sent their balances to addresses controlled by a single attacker. By the time the dust settled, the estimated total was around $6.3 billion — roughly four times the $1.5 billion taken from Bybit in February 2025, and the largest crypto theft ever recorded.

Binance says user funds are safe and that it will cover every loss. Blockchain investigators say the attack bears the fingerprints of North Korea. And Binance's own early explanation is almost disarmingly ordinary: one engineer's laptop. This briefing pulls together what has been reported so far, separates the confirmed from the attributed from the guessed, and explains what the rest of us can take from it.

What happened?

Binance first said only that it was investigating "a potential security issue". Its founder Changpeng Zhao, who stepped down as CEO in 2023 and no longer runs the exchange, wrote that it "does look like a hack" and that "user funds are safe". Within hours, Tether and Circle announced billions in frozen stablecoins, and withdrawals on Binance were suspended.

Late on Thursday, Binance published its first substantive statement. It is worth reading in its own words, because everything else in this story hangs off it:

The timeline

Times are UTC and come mainly from TRM Labs' on-chain analysis, cross-checked against reporting from CNBC, NBC News, The Crypto Times, FinanceFeeds and Aave's governance post. The first hours were chaotic, and early estimates of the loss ranged from about $2.5 billion to more than $3.3 billion because only the first transfers were visible.

1. 28 October, morning — the attacker's operator wallet receives three small withdrawals from Tornado Cash, a mixing service. TRM dates preparation to at least 36 hours before the theft.
2. Early 29 October — the operator deploys a first version of its attack code and tests it on two wallets. Later it rehearses the final version on a third wallet and routes the test funds back to itself. Four hours after the rehearsal, the same code is installed on a Binance hot wallet.
3. 20:05–20:09 — five Binance wallets on the XRP Ledger send 233.46 million XRP to one address, each left with only its minimum balance. First theft of the night.
4. Shortly after 20:10 — Binance wallets on Solana and Optimism follow.
5. 20:20 — a Binance Bitcoin hot wallet sends 18,270 BTC to an attacker address, which immediately splits it into round 1,000 BTC and 100 BTC pieces. In the same minute, a single Ethereum transaction carrying 50 authorizations is submitted (explained below). Within two minutes a Binance Tron hot wallet sends 612.7 million USDT and 46.4 million TRX.
6. 20:24 — about three and a half minutes after the delegation, the attacker's contract sweeps a Binance Ethereum hot wallet: 167,464 ETH and 63 tokens in one transaction. The wallet is swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 as new deposits arrive.
7. 20:58–21:01 — one attacker wallet supplies $60 million of USDT to Aave and borrows about 19,760 ETH against it. Racing the freezes.
8. 21:01 and 21:04 — Tether freezes 971 million USDT in the main receiving wallet, 37 minutes after the main sweep. Circle freezes 823 million USDC three minutes later, in coordination with law enforcement.
9. 21:42 onwards — Aave's guardians begin freezing markets across all networks (finished by 23:04). Ripple freezes RLUSD around 22:00, and World Liberty Financial freezes USD1 shortly after. Binance suspends withdrawals around 22:15.
10. 23:04–23:05 — a second wave: Binance wallets on Avalanche and Polygon send funds out, including 444,537 AVAX. Aave's governance team noted this "suggests the compromise was still active more than two hours later".
11. 23:35 — Binance says the verified frozen total has reached $2.54 billion.
12. 30 October, 00:08 — Arbitrum's Security Council uses emergency powers to move 8,426 ETH and 74.6 million ARB out of the attacker's wallet.
13. ~02:25 — Binance publishes the statement quoted above. By 03:49 it puts the verified frozen amount at about $3 billion. Co-founder Yi He later says deposits are unaffected and that she expects withdrawals to begin resuming within 48 hours.

How much was taken?

The headline number depends on who is counting and when. Binance says about $6.3 billion. TRM Labs, valuing every transfer at the price at the moment it was taken, counts about $6.36 billion (about $6.23 billion at later prices). Chainalysis put it at around $5.9 billion at the time of the attack. These are not contradictions so much as different cut-off times and pricing methods. TRM's per-chain breakdown:

For scale: Bybit in February 2025 lost about $1.5 billion in one asset on one chain. Binance lost across ten chains, in key types and signing schemes that have almost nothing in common. That detail turns out to matter a great deal.

How did it happen?

Three layers of evidence are available, and they fit together better than you might expect.

Layer 1 — What Binance says

A DevOps engineer's laptop was compromised. That gave the attacker access to a service container (a running, automated piece of Binance's infrastructure), from which they could "submit unauthorized withdrawal transactions". Binance says it found no evidence of a wallet private key leak. It has not said how the laptop was compromised, what the container did, or why a request from it was honoured.

Layer 2 — What the blockchain shows (TRM Labs)

TRM's reconstruction describes a patient, rehearsed operation: small mixer-funded wallets, a test of the attack code on throwaway wallets, a full dress rehearsal, then installation on a real Binance hot wallet four hours later. Then the burst. Two different mechanisms appear on-chain.

• On Ethereum, the attacker used an EIP-7702 delegation to turn a Binance hot wallet into a sweeper it controlled.
• On the other nine chains, Binance wallets simply sent funds to the attacker through ordinary signed transfers — no clever contract tricks. Another Binance Ethereum hot wallet did the same, with no delegation at all.

Layer 3 — The EIP-7702 trick, explained

Ethereum's Pectra upgrade (May 2025) introduced EIP-7702. It lets an ordinary wallet say, by signing an "authorization": from now on, run this smart contract's code when anyone calls me. The arrangement stays in place until the wallet signs a new one. It is a useful feature for things like batched transactions — and a powerful weapon if someone else holds a valid authorization signed by your wallet.

Here is what TRM observed. At 20:20 the operator submitted one transaction containing 50 authorizations, each signed by the Binance hot wallet and each pointing it to a "sweeper" contract that obeys only the attacker. Every wallet keeps a running transaction count (a nonce), and an authorization only works at the exact count the wallet has reached when it executes. A busy exchange wallet processing withdrawals never stands still, so the attacker prepared signatures for 50 consecutive counts to guarantee that one would match. One did. The signatures had been produced in advance, as a batch.

Three minutes and 24 seconds later, the operator told the now-controlled wallet to send everything to an attacker address: 167,464 ETH and 63 tokens in a single transaction. And because the delegation stayed in place, anything deposited afterwards was swept too. The same wallet also acted as the executor of a separate Binance smart account, which let the attacker pull out 823 million USDC.

Putting it together

Early on-chain commentary suggested the Ethereum authorizations might have been phished from a signer. TRM points out that this would explain Ethereum and nothing else. Wallets on ten chains, with different key types and signing schemes, all produced valid signatures for the attacker inside about half an hour — and a second batch followed 2½ hours later. In TRM's assessment, the most likely explanation is that the attacker gained the ability to make Binance's hot-wallet signing system sign transactions of its choosing, across chains. The batch of 50 pre-signed authorizations suggests the access may have been time-limited, or that signatures had to be requested through a system. TRM adds: "Binance has yet to publish a root cause."

What we think this means — analysis, not confirmed findings

What follows is our reading of the public facts. It is a hypothesis consistent with what Binance and TRM have said, not an official post-mortem, and Binance's report may differ.

1. They did not need to steal the key

"No private key leak" and "ten chains drained" can both be true. FinanceFeeds, one of the outlets that picked this up, put the point sharply: the attacker did not need to steal the key, "only to reach the machine that uses it". If a service container is allowed to request signatures — which any automated withdrawal system must be — then whoever controls that container can ask the signer for signatures, and the key never has to leave its vault. Strong key storage protects the key. It does not, by itself, protect what the key can be asked to sign.

2. A laptop is a skeleton key to production

A DevOps engineer typically holds the access that automated systems depend on: cloud consoles, container platforms, CI/CD pipelines, secrets managers. A compromised laptop — via malware, a stolen session, a poisoned download, a fake job offer — can inherit all of it, quietly, during normal working hours. We described the browser-session version of this in our briefing on infostealers and session hijacking; the same logic applies to an engineer's laptop, only with far more at stake.

3. It is the Bybit playbook, one step closer to the money

In 2025, attackers compromised a developer's workstation at Safe{Wallet}, a third-party wallet provider, stole cloud session tokens (bypassing MFA), and altered code so that Bybit's own signers approved a malicious transfer they believed was routine. The FBI attributed it to TraderTraitor. This time the reporting points to the exchange's own engineer, and to the signing path rather than a signer's screen:

The common thread: the two largest exchange thefts on record both trace back to one engineer's computer rather than to broken cryptography. TRM notes further shared features, including with the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that starts well before the theft, and signatures obtained in advance then used in one burst.

4. The open questions that matter

• How was the laptop compromised, and how did that become access to a production container?
• What was the container allowed to do, and why could it get signatures across ten chains?
• Why did no independent policy check (per-transaction limits, destination allow-lists, velocity limits, anomaly detection) stop a multi-billion-dollar outflow before the money was gone?
• Were the 50 pre-signed authorizations produced during a short access window, or on request?
• How long was the attacker inside before 29 October?

Who is behind it?

TRM Labs attributes the attack "with high confidence" to TraderTraitor, a North Korean state-sponsored unit it calls the country's elite hacking team, "based on robust on and off-chain intelligence". Chainalysis CEO Jonathan Levin said the firm assessed it was likely carried out by the same group, citing links to previous attacks. The FBI named TraderTraitor as responsible for Bybit.

Two caveats. Binance has not named an attacker, saying it is working with law enforcement "to confirm the identity of these criminals", and no government agency or regulator had commented publicly at the time of reporting. Attribution from blockchain analytics firms is typically careful and often right, but it is an assessment, not a verdict.

Where did the money go?

Stolen funds are only worth something if they can be moved and cashed out, and this is where the first hours of the incident turned into a race between the attacker and the rest of the industry.

The freezes

Stablecoin issuers hold a "kill switch" on their tokens, and several used it quickly. By TRM's count, about $2.7 billion was frozen as of 00:30 UTC; Binance's own figure is about $3 billion, which reflects later freezes and a different counting method.

First Digital (FDUSD) also said it had frozen tokens linked to the attack. Aave froze lending markets on 16 networks (V3) and four (V4), 175 and 117 reserves respectively, to stop the attacker using them — a different thing from freezing the stolen assets themselves. Binance co-CEO Yi He credited Ripple with stopping roughly $200 million from moving; TRM confirmed the on-chain freeze of $40.5 million of RLUSD.

The attacker's counter-moves

The attacker sprinted to turn freezable stablecoins into assets nobody can switch off, and paid heavily for the speed:

• Discounted sales. About 325 million USDT was sold to professional market makers through UniswapX and other intent-based contracts for about 122,300 ETH — an effective price near $2,650 when ETH traded around $2,300–2,350, a discount of more than 10%. TRM's point: real-time address screening by those counterparties would have flagged it.
• Borrowing. $60 million of USDT supplied to Aave to borrow roughly 19,760 ETH, before the markets were frozen. Aave says the position is over-collateralised and does not put its suppliers at risk.
• Other venues. 300 million USDT moved to a wallet supplying it to the JustLend protocol on Tron; 200 million moved through hop wallets and Uniswap; 48 million of the stolen RLUSD was sold on decentralised exchanges before Ripple froze the rest.
• Peel chains. The 18,270 BTC was split into round pieces within the same block, a technique designed to make funds harder to follow.

Net result, per TRM: the attacker still controls more than 420,000 ETH and 18,270 BTC — about $2.4 billion in assets beyond any issuer's reach, exceeding any previous theft even after the freezes. Based on past thefts, TRM expects the next stage to involve cross-chain bridges, swap services and over-the-counter brokers, and says the laundering so far, built on large swaps through market makers and lending protocols, differs from the bridge-heavy pattern after Bybit.

Can it be recovered?

Partly, and slowly. Ari Redbord of TRM Labs, a former US federal prosecutor, told CNBC: "A freeze stops the money from moving, and recovery follows through legal process." Law enforcement typically needs a court order or seizure warrant before working with issuers, and "Tether and Circle can freeze, burn and reissue, which allows frozen USDT and USDC to be returned to a victim." Bitcoin and ether have no issuer, so investigators must trace them to exchanges and services that can intercept them. Chainalysis's Eric Jardine: "There is no standard recovery timeline. A technical freeze may happen quickly, while returning funds can take months or years."

Can Binance absorb it?

Binance says it will cover all losses from its SAFU emergency fund and company funds. SAFU was reported to hold roughly $1–1.2 billion, which would cover only part of the unfrozen loss. Fundstrat's Sean Farrell told CNBC that "this does not currently appear to create meaningful solvency risk for Binance", estimating about $3.3 billion unfrozen and assuming frozen stablecoins are eventually returned. His tell: "how quickly withdrawals resume and whether outflows stay orderly."

Markets wobbled but did not break. Bitcoin fell about 3–4%, to a six-week low below $76,500; ether fell to around $2,185; Coinbase shares dropped about 5% and Strategy nearly 6% in extended trading. Funds held on exchanges are not automatically insured, as NBC News noted, so any compensation is the company's commitment rather than a legal guarantee.

Red: why attackers love this one

• The payoff is liquid, global and irreversible once it moves. Roughly $2.4 billion of it was beyond any freeze within hours.
• The weak point was a person's laptop, not the blockchain. Compromising one engineer scales to every system that engineer can touch.
• The tooling is patient and rehearsed: mixer-funded wallets, tests on throwaway wallets, a dress rehearsal, then one burst.
• New protocol features create new levers. EIP-7702 turned a signed authorization into full control of a wallet.
• Speed beats coordination. Freezes took 37 minutes for Tether and 40 for Circle; a determined attacker only needs the first minutes.

Blue: what exchanges, custodians and engineering teams should do

TRM published specific recommendations. We have added our own, labelled as analysis.

From TRM Labs' guidance

• Monitor for EIP-7702 delegations on treasury wallets. A delegation shows up as code at an address that should have none and should trigger an immediate alert. Keep a tested, pre-approved method for signing a revocation.
• Reject EIP-7702 authorizations in signing policy unless expected. A request for many authorizations across a range of nonces should be treated as an indicator of compromise.
• Separate signing infrastructure and approval paths by chain and wallet tier. Here one actor obtained valid signatures on ten chains within hours.
• Screen counterparties. Compliance teams should screen deposits against labelled attacker addresses; market makers and solvers should screen before filling large orders.

# Foundry's `cast`; any JSON-RPC eth_getCode call works the same way
cast code 0xYourTreasuryWallet --rpc-url $RPC_URL

# 0x                       -> plain wallet, no code attached
# 0xef0100<20-byte addr>    -> delegated to that contract. Investigate now

Treat the snippet as an illustration of the check, not a monitoring system: in production, alert on the transition from "no code" to "delegated", on every wallet you control, on every EVM chain you use.

Our analysis: assume the laptop will fall

• Make the signing path independent of whoever asks. A policy engine that sits outside the requesting service, enforces destination allow-lists and per-transaction and per-hour limits, and cannot be reconfigured from the same machines that submit requests.
• Keep hot wallets small. A hot wallet is for the next hour of withdrawals, not the next quarter. Anything above a working balance belongs behind slower, human-approved controls.
• Treat engineer endpoints as tier-zero assets. Dedicated, hardened devices for anyone with production access; short-lived credentials; no standing access to signing infrastructure from general-purpose laptops; device-posture checks before access is granted.
• Phishing-resistant authentication everywhere (passkeys and hardware keys), plus protection against session theft, since stolen sessions walk past MFA.
• Alert on the unusual, not just the forbidden. A sudden sign request for every chain at once is a pattern no legitimate day produces. Detection that fires in minutes matters when the entire theft takes twenty.
• Pre-arrange your freeze playbook. Named contacts at stablecoin issuers, chain security councils and DeFi guardians, tested before the day you need them. The industry's response here was fast because relationships already existed.
• Rehearse the breach. The attacker rehearsed. Have you?

If you hold crypto on an exchange

1. Do not panic-withdraw through a link. Go to the official app or type the address yourself. Binance warned users to rely only on official channels and ignore unofficial links and requests for account information.
2. Expect a wave of scams. "Compensation portals", "recovery services", fake support agents and DMs offering to claim your share are standard follow-ups to any big incident. Nobody legitimate needs your seed phrase, password or 2FA code.
3. Lock down your own account: a passkey or hardware security key rather than SMS, an anti-phishing code, and a withdrawal address allow-list if the platform offers it.
4. Remember what an exchange balance is. It is a claim on the company, not an insured deposit. Spread what you cannot afford to lose, and watch for the updated Proof of Reserves and the post-mortem.
5. Do not move to self-custody in a hurry unless you understand it. Rushed migrations are when people lose coins to phishing.

The lesson for everyone else

The most important asset in your company may be an engineer's laptop. Most organisations do not hold $6 billion in a hot wallet, but many have a similar shape: one person's device that can deploy to production, change DNS, approve payments or read the customer database. Map that path and harden it as if it were the crown jewels, because to an attacker it is.

Protect what can be requested, not just what can be stolen. Key vaults, HSMs and secrets managers are essential, but the question in this incident is "who or what is allowed to ask for a signature?" Apply the same thinking to cloud roles, deploy pipelines and payment approvals.

Speed is a control. The attacker's whole plan ran on minutes. Freezes, revocations and kill-switches only help if someone is empowered to use them before the meeting. We made the same point about patching in our PHP2Shell briefing — the two incidents occurred eight days apart and no connection between them has been reported, but the lesson about decision speed carries over.

Communicate carefully in the first hours. Binance's first statements were cautious and changed within minutes (FinanceFeeds reports two edits in 13 minutes). That is normal when facts are incomplete, and it is why we do not treat early numbers as final.

Binance hack FAQ

What happened in the Binance hack?

On 29 October 2026 an attacker moved about $6.3 billion out of Binance wallets across ten blockchains, most of it within roughly 20 minutes from 20:05 UTC. Binance confirmed a security incident, suspended withdrawals and said its initial investigation suggests a compromised DevOps engineer's laptop was involved.

How much was stolen?

About $6.3 billion by Binance's estimate; $6.36 billion by TRM Labs at the time-of-theft prices; around $5.9 billion by Chainalysis's early estimate. Roughly $2.7–3 billion has been frozen, and TRM estimates about $2.4 billion remains in the attacker's hands.

Who did it?

TRM Labs attributes it with high confidence to North Korea's TraderTraitor, and Chainalysis says it was likely the same group. Binance has not named an attacker and no government has publicly attributed the attack yet.

Was a private key stolen?

Binance says it found no evidence of a wallet private key leak. TRM's analysis suggests the attacker instead gained the ability to make Binance's signing system sign transactions for them. The post-mortem will clarify.

Are my funds safe?

Binance says yes and has pledged to cover all losses. Analysts quoted by CNBC do not see a meaningful solvency risk at present, but exchange balances are not insured deposits. Watch for the Proof of Reserves update and the resumption of withdrawals.

What is EIP-7702?

An Ethereum feature (Pectra, May 2025) that lets a wallet delegate its behaviour to a smart contract by signing an authorization. The attacker used 50 pre-signed authorizations to point a Binance hot wallet at a sweeper contract and drain it.

Sources

• TRM Labs — North Korea steals USD 6.36 billion from Binance in the largest hack in history
• Binance — statement on X, 30 October 2026 (also published as a Binance support announcement)
• CNBC — Binance's $6.3 billion hack: what we know and what comes next
• NBC News — Binance targeted in $6.3 billion crypto heist, the largest ever
• The Crypto Times — Binance hack update: $6.3B impact, $3B frozen after DevOps laptop breach
• The Crypto Times — Binance hack: CZ says exchange appears hacked, assures user funds are safe
• FinanceFeeds — Binance hack: $6.3B loss traced to engineer's laptop
• Aave governance — Binance hot wallet exploit: Aave's response
• DailyCoin — Binance hack: $6.3B stolen in largest crypto heist, $2.7B frozen
• Hindustan Times — Binance traces $6.3 billion hack to one engineer's compromised laptop
• The Economic Times — Biggest crypto heist in history: how Binance's $6 billion hack rattled markets
• Wilson Center — The Bybit heist: what happened and what now (background on the 2025 precedent)