Binance Hack: Inside the $6.3B Hot Wallet Theft

The Binance hack drained an estimated $6.3 billion from the exchange’s hot wallets across roughly 10 blockchains on the evening of October 29, 2026. The Binance hack is a hot wallet compromise in which an attacker made Binance’s own withdrawal infrastructure sign and send funds to attacker-controlled addresses, mostly within about 20 minutes.

Binance has confirmed the incident, and the evidence points to a serious, well-resourced operation: staged in advance, executed across chains at once, and built to get unauthorized transactions through the controls meant to stop them. About $3 billion has been blocked through on-chain freezes, and Binance has committed to paying for the rest.

Key Takeaways

• Record loss: Binance estimates the impact of the October 29, 2026 hot wallet theft at around $6.3 billion, about four times the $1.5 billion Bybit theft and the largest crypto heist on record
• Highly prepared operation: The attacker drained about 10 blockchains in roughly 20 minutes, with withdrawals pushed through Binance’s own signing path as if they were legitimate
• Entry point: Binance’s initial investigation suggests a compromised DevOps engineer’s laptop gave the attacker access to a service container used to submit withdrawals
• Half contained: About $3 billion is frozen on-chain, and Binance says it will cover all remaining losses from its SAFU fund and company funds
• Attribution: Two blockchain analytics firms link the theft to North Korea’s TraderTraitor; Binance and governments have not confirmed attribution

Binance Hack at a Glance

Incident	Unauthorized hot wallet withdrawals at Binance
Date	October 29, 2026, starting around 20:05 UTC
Estimated Loss	Around $6.3 billion (Binance estimate); independent estimates range from $6.36 billion to $6.4 billion
Blockchains Affected	About 10, including Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon
Initial Access (Preliminary)	Compromised DevOps engineer laptop leading to service container access
Private Key Exposure	No evidence found (Binance)
Frozen So Far	About $3 billion on-chain (Binance)
Loss Coverage	Binance to cover all losses from SAFU and company funds
Attribution	Assessed by blockchain analysts as TraderTraitor (North Korea); not confirmed by Binance or governments
Service Status	Withdrawals paused; Binance expects to begin resuming them within 48 hours of an October 30, 2026 update

Binance Hack Timeline

What Happened in the Binance Hack?

Attackers pushed unauthorized withdrawal transactions through Binance’s hot wallet infrastructure on October 29, 2026, moving an estimated $6.3 billion in crypto to attacker-controlled wallets. The outflows hit about 10 blockchains at once. Binance confirmed a security incident, suspended withdrawals, and revoked authorization for the affected address.

What Did Binance Say in Its Official Statement?

Binance published a Security Incident Update on October 30, 2026, laying out its preliminary findings and response. The key points:

• Likely cause: The initial investigation suggests the incident may involve a compromised DevOps engineer’s laptop, which let the attacker reach a service container and submit unauthorized withdrawal transactions
• Keys: Binance has found no evidence of any wallet private key leak
• Impact: The estimated total impact is around $6.3 billion, with about $3 billion frozen on-chain through blockchain partners
• Coverage: Binance will cover all losses from the SAFU fund and company funds, and says user funds are safe
• Containment: Binance suspended deposits and withdrawals during security checks and revoked the affected address authorization
• Next steps: Law enforcement and blockchain intelligence partners are engaged, and Binance will publish a technical post-mortem and an updated Proof of Reserves

How Did Attackers Get Into Binance’s Systems?

A compromised DevOps engineer’s laptop is the most likely starting point, based on Binance’s initial investigation. From there, the attacker reached a service container that could submit withdrawal transactions. Binance adds that the compromised computer was only the first stage, and that its investigation has not assigned responsibility to any individual employee.

As of October 30, 2026, Binance has not published a full root cause or explained how the attacker moved from the container to signed withdrawals.

How Sophisticated Was the Binance Attack?

The on-chain evidence points to a carefully engineered operation. Blockchain tracing shows the attacker funded an operator wallet on October 28, then deployed and tested code early on October 29. When the theft began, Binance wallets on about 10 chains sent funds out within roughly 20 minutes.

The withdrawals carried valid signatures from Binance’s own hot wallet infrastructure, so the approval path that should have blocked them signed them instead. Analysts assess that the attacker gained the ability to make Binance’s signing system approve transactions of its choosing across chains.

How Much Crypto Was Stolen From Binance?

Binance puts the total impact at around $6.3 billion. Independent tracing values the stolen assets at $6.36 billion at the moment they were taken, and another analytics firm raised its estimate to about $6.4 billion on October 30. The gap reflects different pricing snapshots and timing.

When Did the Binance Hack Happen?

The first unauthorized transfers began around 20:05 UTC on October 29, 2026, when five Binance wallets sent XRP to a single attacker address. Bitcoin, Tron, Solana and Ethereum outflows followed within roughly 20 minutes. A second wave hit Avalanche and Polygon around 23:05 UTC, and smaller sweeps continued until about 23:56 UTC.

What Role Did EIP-7702 Play in the Ethereum Drain?

EIP-7702, an Ethereum feature that lets a regular account delegate its behavior to smart contract code, was used to empty one of Binance’s Ethereum hot wallets. The attacker submitted a single transaction carrying 50 authorizations signed by that wallet, each pointing to an attacker-controlled sweeper contract.

The 50 authorizations covered consecutive nonces, guaranteeing one would be valid at execution time. About three and a half minutes later, the wallet’s full balance, including 167,464 ETH and 1.615 billion USDT, moved to the attacker. EIP-7702 only provided the sweep mechanism; the hot wallet still had to sign those authorizations first.

Were Binance Private Keys Leaked?

Binance says it has found no evidence of any wallet private key leak. The on-chain pattern is consistent with that: apart from the EIP-7702 sweep, funds on Ethereum and the other chains left through ordinary signed transfers. That pattern fits an attacker who controlled what the signing system approved, rather than one holding stolen keys.

Who Is Behind the Binance Hack?

Blockchain analysts attribute the theft with high confidence to TraderTraitor, a North Korean state-backed cluster often grouped under the Lazarus umbrella. Their assessment cites on-chain and off-chain intelligence and overlaps with earlier thefts, including small Tornado Cash withdrawals for staging and signatures obtained in advance. A second analytics firm says TraderTraitor likely carried it out.

Other investigators are more cautious. One person familiar with crypto investigations told reporters the theft is not yet definitively attributed. As of October 30, 2026, neither Binance nor any government agency has publicly named the attackers.

Is the Binance Hack Linked to the Bitget Hack?

Possibly. An independent on-chain investigator found that funds from the Binance hack and from the September 2026 Bitget exploit were commingled at the same address after passing through THORChain, and said the same actor is likely behind both. Bitget had already said it suspected North Korean attackers in its roughly $387 million loss. Neither exchange has confirmed a shared attacker.

How Much of the Stolen Crypto Has Been Frozen?

Binance reports about $3 billion frozen on-chain as of October 30, 2026, close to half of the estimated loss. Stablecoin issuers did most of the work because they can blacklist addresses holding their tokens, and the first large freezes landed within about 40 minutes of the main Ethereum sweep.

• Tether: Froze more than $1.567 billion in USDT tied to the theft
• Circle: Froze more than $800 million in USDC, in coordination with law enforcement
• Other issuers and protocols: Ripple froze RLUSD, World Liberty Financial froze USD1, First Digital froze FDUSD, and Aave froze affected lending markets
• Arbitrum Security Council: Forced about $30 million in ETH and ARB out of an attacker wallet

Where Is the Rest of the Stolen Money Going?

Roughly $2.4 billion remained under attacker control as of 00:30 UTC on October 30, 2026, mostly more than 420,000 ETH and 18,270 BTC. The bitcoin is moving through a peel chain that splits it into 1,000 BTC and 100 BTC pieces.

The cash-out moved fast, and the attacker accepted heavy losses to stay ahead of the freezes:

• Discounted swaps: About 325 million USDT went to market makers through UniswapX and other intent-based contracts for roughly 122,300 ETH, an implied price near $2,650 per ETH while ether traded around $2,300 to $2,350, a discount of more than 10%
• DeFi borrowing: A second wallet supplied 60 million USDT to Aave and borrowed about 19,760 ETH before Aave froze the affected markets
• Tron routing: 300 million USDT moved to a wallet supplying JustLend, while another 200 million USDT passed through hop wallets to Uniswap, where 30 million was frozen
• Stablecoin dumping: About 48 million RLUSD was sold on decentralized exchanges between 21:42 and 22:01 UTC, until Ripple froze the remaining 40.5 million

Later reporting shows some funds moving through THORChain, a cross-chain swap protocol, an early sign of the cross-chain laundering stage seen after earlier North Korea-linked thefts.

Are Binance User Funds Safe?

Binance says user funds are safe and that it will cover all losses from its Secure Asset Fund for Users (SAFU) and company funds. With about $3 billion frozen, that commitment means Binance absorbs the unfrozen remainder itself. The stolen assets came from Binance’s hot wallets, and an updated Proof of Reserves will follow remediation.

The SAFU fund was created in 2018 to protect users in extreme cases and reportedly holds about $1 billion in bitcoin, so it cannot absorb a loss of this size alone; Binance says company funds will cover the rest. SAFU last covered a major theft in May 2019, when attackers stole 7,000 BTC from Binance.

Can I Withdraw From Binance Right Now?

Not yet. As of October 30, 2026, Binance withdrawals remain paused while the team works on enhancements to the withdrawal service and related address controls. Co-CEO Yi He said in an update at 04:17 UTC on October 30 that withdrawals should begin resuming within 48 hours and that deposits operate normally.

Was Binance.US Affected?

Binance.US was not affected, as live incident coverage of the exchange’s statements noted. Binance.US runs as a separate platform, and the unauthorized withdrawals came from Binance’s global hot wallets. Customers of either platform should treat unsolicited messages that reference the hack with suspicion, since attackers often use major incidents as phishing bait.

How Did the Crypto Market React to the Binance Hack?

Prices fell as news of the theft spread. Bitcoin slid below $77,000, BNB dropped about 7% and ether lost about 5% over 24 hours. Leveraged traders took the brunt, with about $1.55 billion in liquidations over the same period, $1.34 billion of them long positions.

The estimated loss equals roughly 4% of the about $144 billion in assets Binance held before the hack. Market makers Wintermute and GSR disclosed exposure to Binance of less than 20% and less than 5% of net equity, respectively, while Coinbase said it is blocking transfers to compromised wallets.

How Does the Binance Hack Compare to the Bybit Hack?

The Binance hack is about four times the size of the $1.5 billion Bybit theft in February 2025, which the FBI attributed to TraderTraitor. Both began with a compromised developer machine: in Bybit’s case, one belonging to its wallet provider Safe{Wallet}. In both, legitimate signing systems ended up approving the attacker’s transactions.

What Indicators Should Defenders and Exchanges Track?

Binance has not published indicators of compromise, so the indicators below come from public on-chain analysis and explorer labels. Exchanges, bridges and DeFi protocols can screen deposits against these addresses, and wallet operators can watch for the transaction pattern behind the Ethereum drain.

Type	Indicator	Context
Ethereum address (attacker)	0x8532FA14ACAf483729C449b8458aedDb900543D4	Received about 195,460 ETH from the main receiving wallet at 20:38 UTC on October 29, 2026; labeled Binance Hot Wallet Exploiter 8 on Etherscan
Ethereum address (attacker, frozen)	0x5227f603C1eE34CE3C06eFe6477003BDfCCB2f8c	Main receiving wallet funded by the Binance 14 hot wallet; holds 971.1M USDT and 823M USDC frozen by Tether and Circle
Transaction pattern	EIP-7702 (type-4) transaction carrying 50 authorizations across consecutive nonces	Delegated a Binance Ethereum hot wallet to an attacker-controlled sweeper contract at 20:20 UTC
Funding pattern	Small Tornado Cash withdrawals into a fresh operator wallet	Staging that began on the morning of October 28, 2026

Recommendations for Exchanges, Custodians and Crypto Users

Engineer and DevOps endpoints are now a direct path to hot wallet funds. TraderTraitor has a long record of targeting crypto staff, including DevOps personnel, with social engineering such as fake job offers carrying trojanized applications. The priorities below aim to make sure a single compromised laptop can never reach a service that submits withdrawals.

• Isolate signing paths: Separate hot wallet signing infrastructure by chain and wallet tier so one foothold cannot drain every network
• Harden privileged endpoints: Treat DevOps and engineering laptops as tier-zero assets with strict device posture checks, phishing-resistant MFA and short-lived credentials for production access
• Restrict EIP-7702 use: Configure signers to reject unexpected EIP-7702 authorizations, and alert on batches of authorizations spanning a range of nonces
• Add withdrawal circuit breakers: Enforce velocity limits and anomaly-based holds on hot wallet outflows, especially simultaneous drains across chains
• Screen counterparties: Exchanges, market makers and DeFi protocols should screen deposits and fills against addresses labeled as linked to the Binance theft
• Train for recruiter lures: Brief staff on fake job offers, coding tests and trojanized tools, which North Korean operators favor for initial access
• Watch for scams: Users should rely only on official Binance channels and ignore messages offering refunds, “recovery” services or account verification links

How SOCRadar Supports Crypto Platform Defense

Thefts like this one typically begin before any funds move, with targeted lures, stolen sessions and reconnaissance on staff. SOCRadar helps crypto platforms catch those early signals:

• Cyber Threat Intelligence: Tracks North Korea-linked activity such as TraderTraitor’s tooling and lure themes, so teams can tune detections early
• Dark Web Monitoring: Alerts when employee credentials or session data from infostealer logs surface in underground markets, a common precursor to privileged access
• Brand Protection: Spots fake recovery sites and impersonation domains that appear after high-profile incidents and target worried users

Combined with internal telemetry and strict signing controls, these signals give exchanges and custodians more time to act before an attacker reaches the systems that can move funds.