What happened?
On the evening of 29 October 2026, an attacker emptied Binance hot wallets on 10 blockchains: Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon. Hot wallets are the online wallets an exchange uses to pay out customer withdrawals. Most of the money left in about 20 minutes, and a smaller second wave hit Avalanche and Polygon around 23:05 UTC. Estimates of the loss run from about $6.3B to $6.36B and $6.43B, which makes this the largest crypto theft on record.
How it happened?
Binance says the entry point may have been the laptop of a DevOps engineer, which gave the attacker access to a service container, and that it has found no evidence of a wallet private key leak. It has since reported "additional points of breach." The pattern on the blockchains reads differently: on the other nine chains, and from a second Ethereum wallet, Binance's wallets sent their balances out with ordinary, valid signatures, which investigators take to mean the attacker got Binance's own signing system to approve the transfers. On Ethereum the attacker added one more step, using a feature called EIP-7702 to install a small program on a Binance wallet that then emptied it.
Results so far. Between $2.7B and $2.84B was frozen within hours, almost all of it stablecoins that issuers such as Tether and Circle can block. The attacker still holds roughly $2.4B to $3.3B in Bitcoin, ETH and XRP, which can't be frozen.
Binance says it will cover all losses from its SAFU reserve and company funds, and that user funds are safe. Three analytics firms link the attack to North Korean state actors.
How the Binance incident unfolded
The first transfers came at 20:05 UTC on the XRP Ledger, where five Binance wallets sent 233 million XRP to a single address. Solana and Optimism followed within minutes. At 20:20 a Bitcoin hot wallet sent out 18,270 BTC, and a Tron wallet sent more than 600 million USDT right after that. Ethereum sits in the middle of this sequence: at 20:24, one transaction moved about $2.53B out of a single wallet.
Attack timeline by chain
- 20:05XRP Ledger$296M
- ~20:10Solana$96M
- ~20:10Arbitrum, Optimism, Base$39M combined, through ~20:36
- 20:20Bitcoin$1.47B
- 20:21Ethereum$3.79B
- ~20:22Tron$628M
- ~20:36Avalanche$28M, including the second wave
- ~23:05Polygon and Avalanche againPolygon $10M
Stablecoin issuers began freezing funds 56 minutes after the first transfer. Tether acted first, at 21:01, about 37 minutes after the big Ethereum transaction, and Circle followed three minutes later. Binance suspended deposits and withdrawals that night and published a written update at 02:23 UTC, a little over six hours after the first transfer. The table puts the main events in order.
How the attack worked
It took at least a day and a half to set up
Preparation took at least 36 hours: an operator wallet received three small withdrawals from the mixing service Tornado Cash on the morning of 28 October, the attacker tested its code on two wallets earlier on the 29th, and it then rehearsed the final version on a third wallet and sent the test funds back. On Ethereum, the program that later emptied a Binance wallet was deployed at 15:59 UTC, about four hours before the attack.
Where Binance thinks it started
Binance's update of 02:23 UTC, Oct 30, says its initial investigation "suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," and that it has "found no evidence of any wallet private key leak." Binance later added that its investigation "has uncovered additional points of breach," and co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action." A technical post-mortem is promised once the investigation is complete.
Nine chains relied on one signing system
The hard part was getting the right to have transfers signed. These wallets live on blockchains with different rules, different kinds of keys and different ways of signing, but once the attacker could get Binance's signing process to approve transfers, those differences stopped mattering. The same access was reused chain by chain: on the other nine chains, and from a second Ethereum hot wallet, Binance's wallets sent their balances to the attacker with ordinary, valid signatures, all within about half an hour. That is why investigators conclude:
"The most likely explanation is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains."
Early signs on Ethereum pointed to phishing of the authorizations, which could explain Ethereum but none of the other chains.
What the attacker did differently on Ethereum
On Ethereum the attacker went one step further. Since 2025, Ethereum has had a feature called EIP-7702 that lets an ordinary wallet lend its permissions to a smart contract. The wallet signs an authorization, and from then on the program's rules apply whenever anyone uses the wallet. The authorization stays in force until the wallet signs a new one.
The attacker's program is what analysts call a sweeper. It has one job, which is to take everything out of a wallet and send it to the attacker, and it takes orders from one address only. The target was one of Binance's best-known hot wallets, which analysts label Binance 14. Removing the sweeper would require that wallet to sign a new authorization pointing somewhere else, so the damage could not simply be switched off from outside.
There was one catch for the attacker. The authorization had to come from the wallet itself, signed with its key. That is the question behind this whole incident, because nobody outside Binance can say how the attacker obtained those signatures.
Why the attacker signed 50 authorizations
Each authorization is valid for one specific number. Every wallet counts the transactions it has sent, and an authorization works only if its number matches the wallet's count at the moment it lands. Binance 14 was busy paying out withdrawals, so nobody could know in advance exactly which count it would have reached. The attacker therefore signed authorizations for 50 consecutive counts, 18,914,775 through 18,914,824, and sent them together in one transaction. Exactly one matched, count 18,914,809, and the other 49 were discarded. That is how investigators read it, and it fits the numbers; the authorizations were signed in advance as a batch, which is one more sign of planning.
Nonce window
50 signed1 valid
$2.53B in one transaction, and the sweeper stayed
Three minutes and 24 seconds later, at 20:24:23, the attacker's address told the wallet to send out everything it held: 167,464 ETH plus 63 tokens, including more than 1.6 billion USDT. That one transaction is worth $2.53B, two-thirds of what was lost on Ethereum. For those 17 blocks the delegation was visible to anyone who looked at the wallet's code.
The sweeper then stayed in place, with six further actions through 23:56, picking up funds that arrived afterward, including 780 million USDC pulled from a linked Binance smart account at 20:41. Ripple and World Liberty Financial froze their tokens inside the compromised wallet, which stopped new deposits of those tokens from being taken. Binance says it has revoked the authorization of the affected address, and the chain confirms it: at 00:10:35 UTC on 30 October, Binance 14 signed a new authorization that reset its delegation, 3 hours 46 minutes after the sweep.
Binance 14 account changes
Stolen key or hijacked signer: why both can be true
Binance says it found no evidence that a private key leaked, while investigators say Binance's signing system signed for the attacker, and the two statements can both be true. A stolen key lets a stranger sign. A compromised signing system lets the real key sign whatever a stranger asks, and on the blockchain the two look the same: a valid signature. One tracing firm's reading is that "rather than stealing Binance's private keys, the attacker appears to have been able to get Binance's own systems to sign transactions on their behalf," and the missing fact is how the laptop was first compromised. Only Binance can say which it was.
Check the Ethereum transactions yourself
The attacker's operator address is 0x7C86…5CA0 and the sweeper contract is 0x63e8…6fAe. The sweeper's published source shows that only the operator address can give it orders, but who submitted that source is unknown, and we haven't confirmed it matches the attacker's original.
- Sweeper deployed: 15:59:11 UTC, block 26,299,449
- Binance 14 delegated to the sweeper: 20:20:59, block 26,300,753
- Binance 14 swept: 20:24:23, block 26,300,770
- Plain transfer from a second hot wallet: 20:24:47, block 26,300,772
- 780M USDC pulled from the smart account 0xEe7a…4055: 20:41:23, block 26,300,855
- Delegation reset by Binance: 30 Oct, 00:10:35
How much was taken
Tracing every transfer from Binance-attributed wallets and valuing each one at its price when the funds left gives $6.36B. Ethereum and Bitcoin account for most of it, and four assets make up 74% of the theft: USDT on Ethereum, BTC, USDC and USDT on Tron. The higher count, $6.43B across 11 chains, also includes NEAR and leaves out $169M that left Binance after withdrawals were suspended, which it reads as Binance moving its own funds.
What got frozen, and by whom
Between $2.7B and $2.84B froze within hours, depending on who counts and when: $2.7B at 00:30 UTC, about $2.8B in another count, $2.84B verified by the next morning and about $3B by Binance's own figure. Nearly all of it was stablecoins, because their issuers can block their own tokens.
Freezes after the sweep
How the attacker raced the freezes
The attacker knew the clock was running and tried to turn freezable stablecoins into assets nobody can block. $500M of stablecoins went into a wallet built to swap them, which in nearly 20 minutes turned $325M into $285M of ETH. The same sale shows up as about 325M USDT going to market makers and solvers for roughly 122,300 ETH, a discount of more than 10%, and in all about $786M of stablecoins was converted into ETH and TRX before the freezes landed.
Other routes were used too. A second wallet put about 60M USDT into the lending protocol Aave and borrowed about 19,760 ETH against it, after which Aave froze the affected markets; that blocked new activity but didn't take the attacker's funds. On Tron, 300M USDT went to a wallet supplying JustLend, and in another reading 234M USDT was swapped for 638M TRX. The attacker sold 48M of the 88.5M RLUSD on decentralized exchanges before Ripple froze the rest, and split the 18,270 BTC across 19 addresses, most holding 1,000 BTC, none of which had reached a service at the last check.
The laundering looks automated: thousands of transactions pass funds between addresses, often back to earlier ones, and many addresses first receive exactly 1 TRX, then more funds, then forward them.
What the attacker still holds
Counts of what is left range from about $2.4B, made up of more than 420,000 ETH and 18,270 BTC, to about $3.33B in assets that no issuer can freeze, spread over about 43 addresses: 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX, of which about $445M in XRP, SOL and NEAR hasn't moved at all. Both are snapshots of funds that are still moving.
Binance reaction
Binance suspended deposits and withdrawals, revoked the authorization of the affected address, brought in law enforcement and blockchain intelligence partners, and worked with them on the freezes. It says it will cover all losses from its SAFU fund and company funds, that user funds are safe, and that it will publish an updated Proof of Reserves once remediation is complete. Deposits were working normally by Friday, and Binance expects to restart withdrawals within 45 hours of its latest update.
What this means for you: an issuer freeze only reaches assets the issuer controls, so find out how much of your own hot-wallet balance sits in them, and who you would call for the rest.
Was it North Korea?
Possibly, and the reasons are easier to follow than the technical evidence suggests. Three analytics firms think so: two attribute the theft to TraderTraitor, a North Korean hacking unit, and the third calls it likely. Their case rests on four things.
The first is how the job was prepared. Earlier thefts that investigators link to North Korea, such as Bybit and KelpDAO, also began with small anonymous funding, long preparation and signatures made in advance and used in one burst, and the same pattern shows up here. The second is where some of the money went. Stolen Binance funds were seen mixing, in real time, with funds from last month's Bitget theft, which had already been attributed to North Korean actors, and one firm calls that its strongest evidence. Funds from both thefts reached the same Ethereum address, as ZachXBT first reported.
The third is the way in. Binance says the attack may have started with an engineer's laptop, and targeting employees is a route the FBI has warned North Korean groups use. The fourth is the scale: draining wallets on 10 blockchains with different signing systems in about half an hour takes a level of planning that very few groups could manage.
None of this is proof, and the most careful reading explains why. The overlap with Bitget is small, about $39,000 of Binance funds at the shared address against about $510,000 from Bitget, and that shows a shared laundering network, not necessarily the same hackers. The thief also left most of the stolen USDT unconverted for 37 minutes on Ethereum and 46 on Tron, where North Korean groups usually move faster. The laundering through market makers and lending protocols doesn't match the older pattern either, and the root cause is still unpublished, which that firm calls "the most diagnostic fact still missing." Finally, no government has confirmed anything, whereas after the Bybit theft the FBI named North Korea within five days.
Binance hasn't named a culprit. Teng said the investigation has not attributed responsibility to any individual, and Binance says it is working with law enforcement to confirm who is behind it.
What this means for you: don't wait for a name before you act. The freezes, the revocation and the first public updates all happened without one.
What we still don't know
Several basic questions are still open, and Binance's promised post-mortem should answer most of them.
How the attacker got in? The laptop is one entry point, and Binance says there were others. The way the laptop was first compromised is the most important missing fact.
How the signing system was built? Nobody outside Binance knows whether a policy layer was set, what it checked, or how an attacker managed to get signatures out of it.
Whether the Ethereum wallet stays clean. Binance reset the delegation on-chain at 00:10:35 UTC. Anyone can recheck by asking an Ethereum node for the code at 0x28C6…1d60: an empty result (0x) means the wallet is clear.
Who is responsible? Three firms point to North Korea, but we need to know more from Binance to make a solid claim.
Where the unfrozen money goes next? The first deposit of the 18,270 BTC or the 233M XRP to an exchange or other service will show where the attacker tries to cash out, and neither had moved to a service at the last check. An Aave position with $59.9M of collateral against $44.4M of debt also sits outside the verified frozen total.
We'll update this page once the story unfolds furhter.
Questions every exchange should be able to answer
This incident does show is a pattern that any business running hot wallets can test today, to make sure they are not prone to same tipe of events Binance faced. If the attacker stole key material, some of what follows wouldn't have helped; if the attacker took over the signing path, then all of it would matter.
Hot-wallet checks
