Article
On 29 October 2026, from 20:05 UTC, funds left Binance hot wallets on several blockchains. Binance puts the loss at about 6.3 billion dollars; on-chain analytics firms reach similar figures (6.36 billion for TRM Labs, about 6.4 for Chainalysis). The exchange suspended deposits and withdrawals and said it will cover the losses through its SAFU fund and its own funds.
What follows is the picture as of 30 October: Binance has not yet published a root cause analysis, and outside reconstructions rely on the transactions visible on-chain.
The entry point according to Binance
In its preliminary findings Binance points to a DevOps engineer’s compromised laptop, from which the attacker would have reached a service container and submitted unauthorized withdrawal transactions. Binance says it has found no evidence of stolen private keys. In a later update, however, it said it had found additional points of breach, and co-CEO Richard Teng clarified that the attacker did not simply use one engineer’s permissions. How the laptop was compromised and what the other points are has not been disclosed.
What the transactions show
On Ethereum, at 20:20 UTC, a transaction sent from an attacker wallet carried 50 EIP-7702 authorizations, all signed with the key of the hot wallet Fireblocks identifies as Binance 14. One valid authorization is enough to activate the delegation: according to Fireblocks there were 50 so that at least one would be valid when processed. EIP-7702, introduced with the Pectra upgrade, lets a key-controlled account (EOA) run the code of a smart contract: here the delegation pointed to an attacker contract that sweeps funds. A little over three minutes later 167,464 ETH and 63 tokens left the wallet, including about 1.6 billion USDT (TRM Labs data). As long as it stays in place, the delegation allows new withdrawals without further signatures: TRM Labs records later sweeps up to 23:56 UTC. Binance then revoked the authorizations on the affected address.
On other networks, such as Bitcoin, funds left in ordinarily signed transactions, which EIP-7702 does not explain. According to TRM Labs the attacker gained the ability to make the hot wallet signing system sign transactions. This reading is consistent with what Binance said about private keys, but the exchange has not confirmed it.
Frozen funds and attribution
Stablecoin issuers such as Tether and other operators froze part of the funds: Chainalysis estimates about 2.8 billion blocked in total. TRM Labs attributes the attack with high confidence to the North Korean group TraderTraitor and places the start of the preparation more than 36 hours earlier. Chainalysis reaches the same conclusion from commingling with funds stolen from Bitget and says the attacker’s operational wallet was funded through Tornado Cash. Neither Binance nor any government authority has confirmed the attribution.
What can already be drawn
- An EIP-7702 authorization moves no funds, but makes the wallet run another contract’s code while it stays in place. The rules that decide what may be signed must recognise this kind of operation and treat it separately, not only transfers: this is also Fireblocks’ point.
- The workstations of people who run the infrastructure are a path to the signing system. Network separation, privileged access approved by more than one person and limits on amount and destination narrow what a single compromised workstation can achieve.
- Monitoring must also cover wallet state changes, such as a code delegation, as well as unusual outflows.
What remains uncertain
- How the laptop was compromised and what the other points of breach are.
- How the attacker obtained signatures on networks other than Ethereum.
- The final amount and the recoverable share. To follow: the root cause analysis promised by Binance, the announced proof of reserves, the resumption of withdrawals and any confirmation of the attribution by authorities.
Sources
- TRM Labs, North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
- Chainalysis, Binance Hack: Tracing the $6.4 Billion Theft to North Korea
- Fireblocks, Deconstructing the Binance Exploit
- BleepingComputer, Binance links $6.3 billion crypto theft to compromised DevOps laptop
- EIP-7702: Set Code for EOAs