Security analysis · 31 October 2026

Binance hack explained: how $6.36 billion left the world's largest crypto exchange in 20 minutes

By Hasan, Co-founder, Excelytech · October 31, 2026

On the evening of 29 October 2026, attackers emptied Binance hot wallets on ten blockchains, the largest crypto theft ever recorded. The headline detail is a new Ethereum feature called EIP-7702, but the real story is older and more useful to every business: someone got a trusted signing system to approve payments it should never have approved. Here is how it worked, what is still unknown, and what to take from it.

What actually happened

Billions of dollars started leaving Binance wallets at about 20:05 UTC on Thursday 29 October. Within minutes, wallets on the XRP Ledger, Ethereum, Bitcoin, Tron and Solana had sent their balances to addresses controlled by one attacker. A second wave followed around 23:05 UTC on Avalanche and Polygon. Binance confirmed a security incident, suspended deposits and withdrawals on several networks and said user funds were safe.

This was not a smash-and-grab. On-chain evidence shows preparation that started at least 36 hours earlier, a rehearsal on a test wallet a few hours before the real thing, and then one coordinated burst. That pattern matches earlier North Korea-linked heists, including Bybit in 2025.

How the attack worked

There are two legs to the attack, and the second one matters most. On Ethereum, the attacker used an unusual technique to turn one of Binance's busiest hot wallets against itself. On the nine other chains there was no trick at all: Binance's own wallets signed ordinary transfers to the attacker. Those wallets use different chains, key types and signing schemes, yet all of them produced valid signatures for the attacker within about half an hour.

The Ethereum leg: EIP-7702 in plain English

A normal Ethereum wallet is just a key. Since the Pectra upgrade in May 2025, EIP-7702 lets such a wallet sign an authorization that says: from now on, run this smart contract's code whenever anyone calls me. The wallet keeps its balance and its tokens, but its behaviour now comes from the contract, and that arrangement stays until the wallet signs a new one.

That is useful for features like batching payments. It is also exactly what an attacker wants if they can obtain the wallet's signature: a way to install their own "sweep everything" logic on a wallet that holds billions.

Was EIP-7702 broken?

No, and it is worth saying clearly because the headlines blur it. The chain data shows no flaw in EIP-7702. The feature only does something when the account itself has signed an authorization. What it changed was the shape of what a signature could do: instead of one fixed transfer with a visible amount and recipient, one signature could hand the wallet's whole behaviour to attacker-chosen code. An Ethlabs researcher made the same point publicly within hours.

The unanswered question: how did they get the signatures?

Early commentary suggested the authorizations had been phished. That could explain Ethereum, but not the other nine chains, which used different key types and signing schemes and all signed within about half an hour. TRM's assessment is that the attacker most likely gained the ability to make Binance's hot wallet signing system sign transactions of its choosing. Here is where the public record stands:

Whatever the final details, the pattern is familiar to anyone who defends networks: a privileged developer or operations machine, a service with the power to move money, and approval controls that, according to one technical analysis, checked the things they were built to check (recipient, amount) but could not inspect what a type-4 authorization actually does, because it carries neither.

Timeline: from rehearsal to revocation

All times are UTC. The preparation is as important as the theft itself.

Where the money was taken from

TRM traced every transfer from Binance-attributed wallets to attacker-controlled addresses and valued each at its price when it moved. Ethereum alone accounts for more than half, but Bitcoin took a $1.47 billion hit too. Valued at later prices, the same assets were worth about $6.23 billion, which is why you will see both $6.3 billion and $6.36 billion quoted.

The race: freezes against laundering

Most of what the attacker took on Ethereum was in stablecoins, and stablecoin issuers can freeze their tokens. That turned the first few hours into a race. The attacker needed to swap into assets nobody can freeze, such as ETH and BTC, faster than issuers could react.

How the attacker tried to outrun the freezes

• Discounted selling. About 325 million USDT was sold to market makers through intent-based trading contracts for about 122,300 ETH. That works out to roughly 10% or more below the market price, a steep price for speed.
• Borrowing against stablecoins. A second wallet supplied 60 million USDT to the Aave lending protocol and borrowed about 19,760 ETH against it. Aave then froze the affected markets. On Tron, 300 million USDT went into JustLend.
• Peel chains. The 18,270 BTC was split into round 1,000 and 100 BTC pieces inside a single block, which makes tracing harder.
• Automation. Chainalysis described laundering patterns it had not seen before, with thousands of automated transactions in a short window.

TRM expects the next stage to involve cross-chain bridges, swap services and over-the-counter brokers, which is where exchanges and compliance teams are being asked to watch for incoming funds.

Who is behind it

TRM Labs attributes the hack with high confidence to TraderTraitor, the North Korean unit the FBI named in the Bybit theft. The features match: small Tornado Cash withdrawals funding an operator wallet, staging well before the theft, and signatures obtained in advance then used in one burst. Chainalysis told CNN it has high confidence in a North Korea link. The laundering route, built on market makers and lending protocols rather than bridges, differs from Bybit's. Binance has not named a perpetrator, so treat attribution as strong analyst judgment, not a court finding.

What it means for Binance customers

• Binance says user funds are safe and that it will cover all losses, including from its SAFU fund and company funds.
• Withdrawals were suspended while it reworked address controls and withdrawal systems; its co-founder Yi He said they were expected to resume by Sunday 1 November.
• An updated proof of reserves is promised once remediation is complete.
• Bitcoin and ether prices fell sharply after Binance confirmed the breach.

One expert quoted by CNN made the wider point: the world's largest exchange was leaning on emergency freezes and reimbursement promises, which is a hard sell to institutions that want to trust crypto with far more capital.

What every business can learn from this

You may never touch crypto, and the lessons still apply. This was not an exotic cryptographic break. It was a failure of the oldest security idea there is: control who and what can ask a trusted system to do something powerful.

Protect the machines that can move money or change systems

The best public lead so far is an engineer's laptop that may have reached a service able to submit withdrawals. In your business the equivalents are the admin PC that can reach your backup console, your Microsoft 365 or Azure admin accounts, and the server that holds payment credentials. Keep those machines patched, use strong endpoint protection, and do not use them for email and general browsing.

Do not let one path approve everything

Here a single actor obtained valid signatures for wallets on ten chains within hours. The business version is separation of duties: different credentials for different systems, approval for sensitive changes, and no shared admin account that unlocks everything.

Alert on change, not just on loss

A simple alert on "this wallet suddenly has code" would have flagged the delegation within a block. Your equivalents are alerts for new admin accounts, new forwarding rules, new scheduled tasks and backup jobs that were switched off or had their retention shortened.

Plan for the day it works anyway

Binance survived because it had reserves, a rapid freeze network and a public promise to make customers whole. Your small business needs its own version: clean, immutable backups the attacker cannot reach, a restore you have tested, and a written plan for the first hour. If you want help checking the second point, read our backup restore test checklist.

Checklist for security and treasury teams

Sources

• TRM Labs: North Korea steals USD 6.36 billion from Binance
• DEV Community: How EIP-7702 delegation emptied a hot wallet
• crypto.news: How one wallet trick led to a $6.3 billion breach
• Gizmodo: How hackers stole $6.3 billion from Binance in minutes
• Bloomberg: Binance estimates $6.3 billion hacked in crypto's biggest heist
• CNN: Suspected North Korean hack hits the world's largest crypto exchange
• CNN Business: Hackers just stole $6 billion in crypto

This article reflects public information as of 31 October 2026. Binance has not yet published its post-mortem, so the root cause, attribution details and recovery figures may change. It is general information, not investment or legal advice.