Binance Hack Becomes Largest Crypto Heist in History

The cryptocurrency world awoke to its worst nightmare on October 29, 2026, when Binance, the largest digital asset exchange on the planet, disclosed a security breach of unprecedented scale. In what blockchain intelligence firms are calling the largest crypto theft on record, an attacker drained approximately $6.3 billion from Binance hot wallets across eleven blockchain networks in a matter of hours. The figure dwarfs every previous heist in the industry, including the $1.5 billion stolen from Bybit in February 2025, and has sent shockwaves through digital asset markets already grappling with a difficult year.

How the Attack Unfolded

According to blockchain analytics firm TRM Labs, the first unauthorized transactions began at approximately 20:05 UTC on October 29. Five Binance wallets on the XRP Ledger sent 233 million XRP to a single attacker-controlled address. Within thirty minutes, Binance hot wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum, and Avalanche were also drained. A second wave targeted wallets on Avalanche and Polygon shortly after 23:00 UTC.

The sheer speed was staggering. TRM Labs estimated that most of the $6.36 billion moved in roughly twenty minutes. On Ethereum alone, $3.80 billion was taken across 186 different tokens, including 1.9 billion USDT and 823 million USDC. The attacker also stole 18,270 BTC, worth approximately $1.48 billion, along with 612.7 million USDT on the Tron network. A single transaction on Ethereum moved $2.53 billion in one shot at 20:24 UTC.

The Entry Point

Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop as the likely entry point. The attacker reportedly used that access to infiltrate a service container and submit unauthorized withdrawal transactions. Crucially, Binance stated it found no evidence of leaked private keys. Instead, the attacker manipulated Binance’s own signing infrastructure to authorize the fraudulent withdrawals.

The exchange later revised its assessment, saying its investigation had uncovered additional points of breach beyond the compromised laptop. A comprehensive root-cause report is expected once the investigation concludes.

The EIP-7702 Exploit

On Ethereum, the attacker exploited EIP-7702, a feature introduced in the 2025 Pectra upgrade that allows a regular wallet to delegate its behavior to a smart contract. The attacker submitted fifty pre-signed authorizations, each covering a different nonce, ensuring that at least one would be valid. This delegation handed control of a Binance hot wallet to a malicious sweeper contract that emptied it of 167,464 ETH and 1.6 billion USDT.

The delegation remained active even after the initial theft, allowing the attacker to sweep new deposits into the compromised wallet at least six more times over the following three and a half hours. This persistent access mechanism represents a troubling new attack vector that exchanges and wallet providers will need to address urgently.

The Industry Rapid Response

Once the breach was detected, the cryptocurrency ecosystem mobilized with remarkable speed. Stablecoin issuers, which retain the ability to freeze their own tokens, acted within minutes:

• Tether froze 1.18 billion USDT in the attacker’s main Ethereum wallet at 21:01 UTC, just 37 minutes after the funds arrived, then froze four additional attacker addresses within 17 minutes.
• Circle froze 823 million USDC three minutes after Tether’s action.
• Ripple froze stolen XRP on its ledger.
• World Liberty Financial and Paxos froze additional stablecoin holdings.
• The Arbitrum Security Council took emergency action to move assets out of the attacker’s reach.
• First Digital and other smaller issuers also participated in the freeze.

According to Elliptic, a blockchain intelligence firm, approximately $2.84 billion in stolen funds have been verified as frozen on-chain, close to Binance’s own estimate of $3 billion. However, the attacker still controls roughly $3.33 billion in assets that cannot be frozen by any issuer, including 511,861 ETH, 18,270 BTC, 233 million XRP, and 670 million TRX spread across approximately 43 addresses.

Attribution: North Korea TraderTraitor

Both TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group associated with the Lazarus Group. TRM Labs stated it made the attribution with high confidence based on robust on-chain and off-chain intelligence. The FBI previously named the same group as responsible for the $1.5 billion Bybit hack in February 2025.

Elliptic’s analysis confirmed that some stolen funds reached addresses previously associated with the suspected DPRK exploit of Bitget. The attack methods, including the use of Tornado Cash for preparation and the exploitation of emerging Ethereum features, are consistent with TraderTraitor’s known playbook.

Preparation and Rehearsal

Preparation for the attack began at least 36 hours before execution. On October 28, an attacker-controlled wallet received three small withdrawals from the Tornado Cash mixer, a service that obscures the origin of cryptocurrency. The following day, the attack code was tested on two wallets and rehearsed on a third approximately four hours before it was deployed against Binance. This level of preparation underscores the sophistication and resources of state-sponsored cybercrime operations.

Market Impact and Binance Response

The hack sent immediate ripples through crypto markets. Bitcoin fell 4% to approximately $77,465, while Ethereum dropped 4% to $2,239. BNB, Binance’s native token, declined sharply amid concerns about the exchange’s stability. Other major altcoins including XRP, Solana, and Dogecoin also posted losses as risk-off sentiment swept the market.

Binance moved quickly to reassure users. The exchange announced it would cover all losses associated with the incident and has reserved more than $6.34 billion in company funds for this purpose. Deposits and withdrawals were temporarily suspended across all networks while the investigation proceeded, though the exchange indicated it would resume operations incrementally as each blockchain was confirmed secure.

Implications for the Crypto Industry

The Binance hack raises profound questions about the security of cryptocurrency exchanges and the broader digital asset ecosystem. Several key implications emerge:

• Exchange security gaps: The attack exploited operational infrastructure rather than cryptographic weaknesses. Even the largest and most resourced exchange was vulnerable to a compromised employee device.
• Stablecoin freeze mechanisms work: The rapid response by Tether, Circle, and other issuers demonstrated that freeze functionality can contain a significant portion of stolen funds, though it cannot prevent the theft of non-freezable assets like Bitcoin and Ethereum.
• New smart contract risks: The EIP-7702 delegation exploit highlights how protocol upgrades can introduce unexpected attack surfaces that malicious actors can weaponize.
• State-sponsored threats: The attribution to North Korea TraderTraitor group confirms that nation-state actors remain the most formidable threat to cryptocurrency infrastructure.
• Regulatory scrutiny: An incident of this magnitude will inevitably intensify regulatory pressure on exchanges, particularly around custody practices, employee access controls, and incident response protocols.

Looking Ahead

The $6.3 billion Binance hack will be remembered as a watershed moment for the cryptocurrency industry. While the rapid freezing of $3 billion in stablecoin assets demonstrates the ecosystem growing ability to respond to crises, the fact that an attacker was able to drain the world largest exchange in under four hours reveals how much work remains to be done on security fundamentals.

For investors and market participants, the incident serves as a stark reminder of the risks inherent in centralized cryptocurrency custody. The attack also underscores the growing influence of state-sponsored cybercrime groups in the digital asset space and the need for coordinated international response mechanisms.

Binance has pledged a detailed technical post-mortem once its investigation concludes. The industry will be watching closely, as the lessons from this attack will shape security practices, regulatory frameworks, and investor confidence for years to come. In the meantime, the attacker still holds more than $3 billion in unfrozen assets, a haunting reminder that even the most dramatic freeze response cannot fully undo the damage once a breach of this scale has been executed.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous