Binance hack: $6.3B drained after attackers got its own systems to sign

What happened

On 29 October 2026, funds left Binance hot wallets on ten blockchains in about 20 minutes, starting at about 20:05 UTC on the XRP Ledger (TRM Labs). Estimates of the total differ by source:

It is the largest crypto theft on record, more than four times the $1.5 billion Bybit theft of February 2025, which the FBI attributed to the same North Korean activity, “TraderTraitor” (FBI PSA on Bybit).

TRM Labs’ breakdown by chain: Ethereum about $3.79 billion (200,630 ETH plus 185 other tokens, including 1.875 billion USDT and 823 million USDC), Bitcoin about $1.47 billion (18,270 BTC), Tron about $628 million, XRP Ledger about $296 million, Solana about $96 million, Arbitrum, Optimism and Base about $39 million together, Avalanche about $28 million and Polygon about $10 million (TRM Labs).

How the money was moved

• Ethereum, through EIP-7702. At 20:20 UTC one transaction carried 50 authorizations, all validly signed by the key of a Binance Ethereum hot wallet. EIP-7702, added in Ethereum’s Pectra upgrade in May 2025, lets a wallet delegate its behaviour to a smart contract; these authorizations pointed the hot wallet at a “sweeper” contract that obeyed only the attacker. An authorization is only valid at the wallet’s current nonce, and the hot wallet’s nonce kept moving with normal withdrawals, so the attacker had obtained signatures for 50 consecutive nonces in advance. About three and a half minutes later the sweeper emptied the wallet of 167,464 ETH and 63 tokens, including about 1.6 billion USDT (TRM Labs; Elliptic).
• The delegation stayed in place. Because the wallet kept pointing at the sweeper, the attacker swept new deposits that arrived afterwards (TRM lists re-sweeps between 20:41 and 23:56 UTC) and used the wallet’s role as executor of a Binance smart account to pull 823 million USDC (TRM Labs).
• Every other chain, ordinary signed transfers. On Bitcoin, Tron, the XRP Ledger, Solana and the rest, funds left in normal transactions signed for the attacker within about half an hour. TRM and Elliptic both conclude that the attacker could make Binance’s hot-wallet signing system sign arbitrary transactions, rather than having stolen private keys. TRM adds that the batch of 50 pre-signed authorizations suggests the access was time-limited or went through a request system (TRM Labs; Elliptic).

How the attacker got in (as disclosed so far)

Binance’s first notice says the incident “may involve a compromised DevOps engineer’s laptop”, which the attacker used to reach a service container and submit unauthorized withdrawal transactions. Binance says it has found “no evidence of any wallet private key leak” and has promised a technical post-mortem (Binance). Co-CEO Richard Teng later said the attacker “did not simply use one engineer’s permissions”, and Binance said it had “uncovered additional points of breach” without naming them (The Hacker News). No root cause has been published yet. How the laptop was compromised has not been disclosed.

Preparation

TRM traced the attacker’s operating wallet to three small Tornado Cash withdrawals starting on the morning of 28 October, at least 36 hours before the theft. Early on 29 October the attacker deployed and tested the attack code on two wallets, rehearsed the final version on a third, and installed the same code on the Binance hot wallet about four hours later (TRM Labs).

Freezes and recovery

• Tether froze the main 971.1 million USDT wallet at 21:01 UTC, 37 minutes after the main sweep, and about 1.77 billion USDT in all. Circle froze about 825 million USDC, Ripple 40.5 million RLUSD, World Liberty Financial 27.8 million USD1, and the Arbitrum Security Council moved about $30 million out of attacker addresses (TRM Labs).
• Frozen totals differ by source and time: Binance about $3 billion, Elliptic $2.85 billion verified, TRM about $2.7 billion. Elliptic counts about $3.25 billion still under the attacker’s control across more than 800 addresses (Elliptic).
• The attacker raced the freezes: within about 20 minutes it swapped $325 million of stablecoins for ETH, which issuers cannot freeze (Chainalysis).
• Binance suspended withdrawals, revoked the affected address authorization and said it would cover all losses (Binance). On 31 October it reported that 90% of the stolen assets had been replenished, and it began reopening withdrawals in phases on 1 November (Binance announcements; Elliptic).

Who did it

• TRM Labs attributes it to North Korea’s TraderTraitor with high confidence, citing the Tornado Cash funding pattern, long staging and pre-obtained signatures fired in one burst (TRM Labs).
• Chainalysis also attributes it to TraderTraitor; its strongest evidence is stolen funds mixing in real time with funds from the Bitget theft of September 2026, which had been attributed to North Korea (Chainalysis).
• The FBI attributed the theft to North Korea, naming TraderTraitor, late on 31 October UTC, as reported by Elliptic (Elliptic). We have not found the FBI’s own notice yet and will link it when it is published.

Am I affected?

• Binance customers. Binance says user balances are covered and deposits were not affected. Follow Binance’s own announcements for withdrawal status, and be wary of messages offering “refunds” or asking you to “verify” an account: incidents like this are followed by phishing.
• Exchanges, custodians, payment processors and anyone running a signing service. You have the same exposure if a person or a service can submit requests to your signer and the signer will sign whatever it is asked. Ask:

1. Who can reach the signer? List every host, container, service account and human role that can submit a signing request. Is any of them reachable from an engineer’s laptop?
2. What does the signer check? Does it independently verify the destination, the amount and the transaction type, or does it trust the caller?
3. Would it sign this? A transaction that sends a wallet’s whole balance; an EIP-7702 authorization (a “type 4” transaction or a signed delegation tuple); signatures for many future nonces at once.
4. Would anyone notice in minutes? The main sweep happened 3.5 minutes after the authorizations landed, and most chains were drained within half an hour.

# Ethereum: has one of your hot wallets been delegated with EIP-7702?
# A delegated EOA has code starting with 0xef0100 followed by the delegate address.
cast code <hot-wallet-address> --rpc-url "$ETH_RPC_URL"
# Empty (0x) means no delegation. 0xef0100... means the wallet now runs that contract's code.

What to do now

• Treat engineer endpoints as the perimeter of the signer. TraderTraitor and related North Korean groups have repeatedly reached victims through fake job offers and coding tests that get staff to run malware (FBI PSA; Elliptic). Production signing paths should not be reachable from a developer laptop; require separate, hardened admin workstations and short-lived, hardware-bound credentials.
• Make the signer enforce policy, not the caller. Destination allowlists for hot-wallet withdrawals, per-transaction and per-hour value limits, and a hard refusal of whole-balance sweeps, enforced inside the signing service or HSM policy so that a compromised upstream service cannot bypass them.
• Refuse EIP-7702 delegations by default. Hot wallets rarely need to sign authorization tuples. Block them in signing policy, and alert if any company wallet’s on-chain code becomes non-empty.
• Never sign ahead. Signing requests for future nonces, or many nonces at once, should be refused outright.
• Detect in minutes, not hours. Alert on outflows above a threshold per wallet per minute, and have a pre-agreed freeze route with stablecoin issuers. In this incident freezes started 37 minutes after the main sweep and still saved billions.
• Separate wallets by function. The delegated wallet was also the executor of a separate smart account, so one compromise reached a second pool of 823 million USDC.

Why this is part of the Vulnpocalypse

The Vulnpocalypse is about attackers getting faster and better at turning access into impact. Here the cryptography held; what failed was the infrastructure and people around it. Staging took at least 36 hours, and the theft itself took about 20 minutes. Analysts also noted large-scale automated laundering, with thousands of transactions in a short period (Chainalysis). Elliptic says it cannot tell from on-chain data whether AI agents were involved (Elliptic).

Sources

• Binance, Security Incident Update, 30 October 2026, and follow-up recovery updates on 31 October and 1 November.
• TRM Labs, North Korea steals USD 6.36 billion from Binance.
• Chainalysis, Binance exploit: latest findings and response, 30 October 2026.
• Elliptic, Binance: the largest hack in history, updated 1 November 2026.
• The Hacker News, Binance suffers security breach.
• CNBC, $6.3 billion Binance hack is largest crypto theft on record.
• FBI, PSA I-022625-PSA on the Bybit theft (background on TraderTraitor).