Binance, the world’s largest cryptocurrency exchange, has confirmed a security incident estimated at around $6.3 billion (£4.7bn) — widely described as the largest crypto theft on record. Blockchain analysts put the on-chain haul even higher, at about $6.36 billion.
The attack hit on 29–30 October 2026, dwarfing the $1.5 billion Bybit breach of February 2025. Binance says user funds are safe and that it will cover every loss. Roughly $3 billion has already been frozen on-chain. But the deeper story is more serious than the headline number: investigators say this was not a cracked vault. It looks like a compromise of the process that opens the vault.
What Binance has confirmed
Co-CEO Richard Teng said the initial investigation suggests the incident may have started with a compromised DevOps engineer’s laptop. That access allegedly let an attacker reach a service container and submit unauthorised withdrawal transactions.
Teng stressed two points. First: this was not a simple “one-click” action using one engineer’s permissions. It was a more complex attack. Second: Binance has found no evidence of a wallet private key leak, and has not attributed responsibility to any individual.
A later update sharpened the picture. After looking beyond the laptop theory, Binance said it had uncovered “additional points of breach.” It has not publicly listed those extra points yet. The exchange promised a full technical post-mortem once facts are verified, plus an updated Proof of Reserves after remediation.
Founder Changpeng Zhao (CZ), who no longer runs day-to-day operations, said the incident “does look like a hack on Binance,” insisted user funds are safe, and publicly asked Elon Musk to stop “trolling” after Musk reacted to online comparisons with the FTX collapse.
Binance also said it has reserved more than $6.3 billion to cover the incident, with about $5 billion already held in the exact token assets that were impacted. Remaining purchases, it said, may take longer. Frozen assets sit outside that figure and remain subject to recovery and verification.
How big was the attack?
TRM Labs, a major blockchain intelligence firm, reconstructed the outflow in detail. On 29 October, starting around 20:05 UTC, attacker-controlled addresses received funds from Binance-linked wallets across ten blockchains. Most of the value moved in roughly 20 minutes. A second wave around 23:05 UTC hit Avalanche and Polygon.
TRM’s approximate breakdown includes:
- Ethereum: about $3.79bn, including roughly 200,630 ETH plus large stablecoin and token balances
- Bitcoin: 18,270 BTC, about $1.47bn
- Tron: hundreds of millions in USDT/TRX, about $628m
- XRP Ledger: about 233.46 million XRP, around $296m
- Solana: about 970,500 SOL, around $96m
- Smaller hits on Arbitrum, Optimism, Base, Avalanche and Polygon
Independent researchers describe the same pattern: hot wallets on multiple networks signing attacker-bound transfers in a tight window — behaviour that looks less like one stolen seed phrase and more like control of Binance’s hot-wallet signing layer.
How the Ethereum leg worked
On Ethereum, the attacker used EIP-7702 — a feature from Ethereum’s May 2025 Pectra upgrade that lets an ordinary wallet temporarily hand control of its behaviour to a smart contract by signing an authorisation.
According to TRM, at 20:20 UTC the operator submitted a transaction containing 50 pre-signed authorisations for a Binance hot wallet. Each pointed that wallet to a sweeper contract the attacker controlled. Because hot wallets process constant withdrawals, their transaction count (nonce) keeps moving. Signing a batch of consecutive nonces raised the odds that one authorisation would still be valid at execution. One matched. That was enough.
Minutes later, the sweeper drained the wallet. TRM says one sweep alone moved 167,464 ETH and dozens of tokens, including more than a billion USDT. The delegation stayed active, so later deposits into that hot wallet were swept again through the evening. Separately, another Binance Ethereum wallet sent large balances via ordinary signed transfers, with no delegation trick required.
Security researchers stress an important distinction: EIP-7702 appears to have been an execution path, not proof that Ethereum’s protocol itself was broken. If an attacker can force valid signatures out of an exchange’s signing system, they can drain funds through many mechanisms. EIP-7702 may have made a one-shot sweep cleaner; the root question is how those signatures were obtained.
Check Point’s Jayant Dave put it bluntly to the BBC: attackers did not break encryption or steal private keys; they took over the system that tells the keys what to sign. “A strong vault doesn’t matter if someone controls the process that opens it.”
Who is behind it?
Binance says it is working with law enforcement and has not publicly named a culprit.
TRM Labs attributes the attack, with high confidence, to TraderTraitor — a North Korean-linked unit also associated with the Lazarus Group cluster. The FBI previously named the same group for the Bybit hack. TRM cites staging that began at least 36 hours earlier, Tornado Cash funding patterns, advance signature preparation, and burst execution matching earlier North Korea-linked incidents, including Bybit and the April 2026 KelpDAO case.
That is analyst attribution, not a court verdict. North Korea has historically denied such accusations. Treat it as a serious, evidence-based industry assessment — still open until governments and Binance publish confirmed findings.
The freeze race
Speed mattered after the theft as much as during it.
Binance reported about $3 billion frozen with partners. TRM’s accounting includes roughly $2.67 billion in stablecoins from Tether, Circle, Ripple and World Liberty Financial, plus emergency action by Arbitrum’s Security Council — about $2.7 billion frozen in total in TRM’s reporting window.
The attacker did not wait. TRM says they raced freezes by selling USDT to market makers and borrowing ETH against USDT on Aave, converting freezable stables into harder-to-claw-back assets. After freezes, TRM estimated the attacker still controlled more than 420,000 ETH and 18,270 BTC — roughly $2.4 billion beyond easy issuer reach — plus other unfrozen balances.
That is why recovery will be a long chase through peel chains, swaps, bridges and OTC desks — not a weekend cleanup.
Market shock and the trust problem
Bitcoin fell about 5% after the news, briefly near the mid-$76,000s in some reports. Ether, Solana and XRP also dropped. Binance claims roughly 35–36% of crypto market share; when the largest exchange is hit, confidence wobbles everywhere.
History makes investors nervous for another reason. After FTX collapsed in 2022, “your funds are safe” became a phrase markets distrust. Binance is not FTX, and it has publicly reserved matching assets to cover the hit. Still, proof will be withdrawals restoring cleanly, Proof of Reserves updating, and frozen funds converting into verified recoveries — not press statements alone.
Timeline of Binance’s response
Based on BBC live reporting and company updates:
- Thu 21:29 GMT — Binance investigating a potential security issue; funds “completely safe”
- Later Thursday — withdrawals paused; Binance Alpha trading suspended
- 23:22 — ~$2.54bn frozen reported
- Fri 00:13 — company says it will cover all losses; deposits and withdrawals temporarily suspended
- 00:52 — frozen assets ~$3bn
- 02:25 — DevOps laptop theory; impact ~$6.3bn
- 07:37 — Teng: complex attack, not one-click; no individual blamed
- 08:47 — “additional points of breach”; withdrawals targeted to resume in ~45 hours
- Later Friday — recovery of affected assets begun; $6.3bn reserved to cover losses
What this means for India and every digital finance team
This is an operational security story with implications far beyond crypto exchanges. Banks, fintechs, payment processors and any company with automated money movement face the same class of risk.
If an attacker can compromise an engineer endpoint, then abuse privileged internal services that instruct signing or payment systems, encryption of keys in cold storage will not save you. The control plane is the target.
Practical lessons for Indian exchanges, fintechs, UPI-adjacent wallets and custodians:
- Separate signing authority by chain, wallet tier and environment
- Treat EIP-7702-style delegations and bulk multi-nonce authorisations as compromise indicators
- Require dual control and out-of-band approval for withdrawal-service changes
- Assume phishing / fake-job malware against DevOps and security staff is a primary threat
- Pre-negotiate freeze playbooks with stablecoin issuers and chain security councils
- Screen deposits against labelled attacker addresses in real time
- Never ask customers to “move funds to a safe wallet” via DM or email during an incident — that is how secondary scammers harvest victims in the panic
Confirmed vs still unknown
Confirmed or strongly evidenced:
- Incident around 29 October 2026 with multi-chain hot-wallet outflows
- Binance impact estimate ~$6.3bn; TRM on-chain estimate ~$6.36bn
- Largest known crypto theft by size, dwarfing Bybit’s $1.5bn
- No evidence so far of leaked wallet private keys, per Binance
- ~$3bn frozen reported by Binance; major issuer freezes documented by analysts
- Company pledge to cover losses via SAFU + company funds
Not fully confirmed / easy to oversell:
- Exact full list of “additional points of breach”
- Final court-proof identity of the attackers
- That every user will feel zero friction before remediation finishes
- That unfrozen BTC/ETH will be recovered quickly
- That EIP-7702 itself was a protocol vulnerability rather than an abused feature
Bottom line
The Binance hack is not just a record number. It is a case study in modern financial cybercrime: patient staging, endpoint compromise, signing-system abuse, multi-chain execution in minutes, and a race against stablecoin freezes.
Binance says it can absorb the loss. Markets will believe that when withdrawals, reserves and recoveries prove it. Everyone else in digital finance should treat this as a warning about privileged access — because the next target will not need to crack cryptography if they can capture the button that signs.
FAQ
What happened to Binance?
Attackers moved roughly $6.3–$6.36 billion from Binance-linked hot wallets across multiple blockchains on 29 October 2026. Binance confirmed a security incident and pledged to cover losses.
Was this the biggest crypto hack ever?
Yes, by current public estimates — about four times the $1.5 billion Bybit hack in 2025.
How did hackers get in?
Binance’s initial probe points to a compromised DevOps laptop that helped reach a service container used for unauthorised withdrawals, plus additional undisclosed breach points. Analysts say the pattern fits compromise of hot-wallet signing infrastructure.
Did private keys leak?
Binance says it has found no evidence of a wallet private key leak so far.
Who did it?
Unconfirmed officially. TRM Labs attributes it with high confidence to North Korea-linked TraderTraitor. That remains an intelligence assessment, not a final legal finding.
Are user funds safe?
Binance says yes and that it will cover all losses from SAFU and company funds, with billions reserved and ~$3bn frozen so far. Users should verify updates only via official Binance channels and ignore phishing “support” messages.
