Binance exploit analysis

On the evening of 29 October 2026, assets began leaving Binance hot wallets across ten blockchains, most of it within about twenty minutes of 20:05 UTC. TRM Labs traced every transfer to attacker-controlled addresses and valued each one at the price of the asset when it was taken, arriving at $6.36 billion. Binance's own figure is around $6.3 billion (web3isgoinggreat). Chainalysis's estimate is reported as about $5.91 billion by Bitcoin.com and about $6.4 billion by Decrypt. On any of these figures this is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025.

Two methods of taking the same wallets

Ethereum was the largest single outflow, about $3.79 billion, and the only chain where the attacker changed how a Binance wallet behaved. EIP-7702, introduced in Ethereum's Pectra upgrade in May 2025, lets a wallet hand control of its behaviour to a smart contract by signing an authorization that persists until the wallet signs a new one. At 20:20 UTC the operator submitted one transaction containing 50 such authorizations, each signed by the Binance hot wallet and each pointing it at a sweeper contract that accepts instructions only from the operator (TRM Labs).

The batch worked because of how authorizations are counted. Every wallet keeps a running count of its transactions, called a nonce, and an authorization is valid only at the count the wallet has reached when it executes. A Binance hot wallet processes a steady flow of withdrawals, so its count keeps moving forward, and signatures prepared for 50 consecutive counts guaranteed one would still be valid. One matched, which was all the attacker needed, and the signatures had been produced in advance as a batch.

Three minutes and 24 seconds later, the operator told the hot wallet to send its entire balance to an address it controlled, moving 167,464 ETH and 63 tokens including 1.615 billion USDT. The delegation stayed in place, and the operator swept the wallet again six times as new funds arrived. The same wallet also served as the executor of a separate Binance smart account, which gave the attacker a route to 823 million USDC.

The other nine chains involved no delegation. The XRP Ledger was hit first, with five wallets sending 233.46 million XRP to one address between 20:05 and 20:09 UTC. At 20:20 a Binance Bitcoin hot wallet sent 18,270 BTC, which began splitting into round 1,000 BTC and 100 BTC pieces inside the same block. A Tron hot wallet sent 612.7 million USDT and 46.4 million TRX within two minutes, and Avalanche and Polygon were hit at 23:05. A further Ethereum hot wallet sent 28,006 ETH, 55.7 million USDT and 25.9 million RLUSD by ordinary signed transfer.

Preparation and cause

TRM says preparation began at least 36 hours before the theft. The operator wallet received three small Tornado Cash withdrawals on the morning of 28 October, and on 29 October the operator tested its code on two wallets before rehearsing the final version on a third. Four hours later the same code was installed on a Binance hot wallet.

Early indicators on the Ethereum activity pointed to the authorizations being phished. That covers Ethereum and leaves the other chains unexplained, where the wallets sit on different chains and use different key types and signing schemes. All of them produced valid signatures for the attacker within about half an hour. TRM's assessment is that the attacker gained the ability to make Binance's hot wallet signing system sign transactions of its choosing across chains, and the batch of 50 pre-signed authorizations suggests the access may have been limited in time, or that signatures had to be requested through a system.

Binance has not published a root cause. Its initial findings point to a DevOps engineer's compromised laptop, which gave access to a service container used to submit unauthorized withdrawals. It has found no evidence of a leaked wallet private key, and has since said it uncovered additional points of breach (BleepingComputer). A laptop is an entry point, while a signing system producing valid signatures for wallets on ten chains within hours is what the transaction data shows.

Attribution

TRM attributes the attack to TraderTraitor, North Korea's state-sponsored hacking unit, with high confidence, based on on- and off-chain intelligence, and says the Tornado Cash funding, the early staging and the pre-signed batch match earlier North Korea-linked heists (TRM Labs). ZachXBT reached a similar conclusion hours earlier (Bitcoin.com). Chainalysis said its strongest evidence was seeing the stolen funds commingling in real time with the proceeds of the Bitget exploit a month earlier (Decrypt).

On 31 October the FBI named TraderTraitor in a statement of its own, saying North Korea was responsible for the theft of more than $6 billion from Binance on or about 29 October 2026. It said it had observed the actors converting stolen assets into ether, and urged private sector entities to block transactions with or derived from the addresses they are using to launder the funds (CBS News). It had named the same group for the $1.5 billion Bybit theft of February 2025 (TRM Labs).

Freezes and the money that moved

Tether, Circle, Ripple and World Liberty Financial froze about $2.67 billion of stablecoins, and Arbitrum's Security Council forced 8,426 ETH and 74.6 million ARB out of the attacker's wallet on that network at 00:08 UTC, for roughly $2.7 billion in total (TRM Labs).

The attacker raced the freezes. About 325 million USDT was sold to professional fillers and market makers through UniswapX and other intent-based contracts for about 122,300 ETH, a price near $2,650 per ETH against a market trading around $2,300, a discount of more than 10%. The remaining 175 million USDT from that batch was frozen, and a second wallet borrowed about 19,760 ETH against 60 million USDT on Aave before Aave froze the affected markets. TRM counts more than 420,000 ETH and 18,270 BTC still in the attacker's hands, about $2.4 billion beyond the reach of any issuer.

The exchange's position

Binance suspended withdrawals on several networks on the night of the attack. By 30 October it said roughly $3 billion had been frozen and promised a detailed technical post-mortem (Bitcoin.com). It reserved more than $6.34 billion of company funds to cover the loss, $5 billion of it already held in the stolen tokens, and is buying the rest through market and over-the-counter channels (Decrypt). Withdrawals restarted in phases at 06:00 UTC on 1 November, and by 12:36 UTC all 15 networks and assets in the first phase were open. Binance put replenishment at about 95% of the impacted amount, up from 90% earlier, and has committed to a post-incident report once its investigation concludes (Bitcoin.com).

The link to the Bitget theft

One other incident in this corpus is tied to this one by more than timing (Bitget exploit analysis). Attackers took $387.5 million from Bitget on 24 September 2026, and Chainalysis found the stolen Binance funds commingling with the proceeds of that theft. Bitget's chief executive Gracy Chen said at the time that the company believed a North Korean cybercrime group may be behind it (web3isgoinggreat).

The two differ in how much could be clawed back. Circle and Tether froze $318,000 of the Bitget haul, and the vast majority had been swapped into decentralized cryptocurrencies that have not been frozen. Here the freezes reached about $2.7 billion, and the difference tracks what was still in stablecoins when the issuers acted. In both cases the exchange has said it will absorb the loss: Bitget says it has sufficient assets to cover the stolen funds, and Binance says it will cover all losses from its SAFU fund and company funds (BleepingComputer).