Binance's $6.3B Hack: How Attackers Hijacked Its Signing System

By Jaspal Singh October 30, 2026 Updated: October 30, 2026

Attackers drained about $6.3 billion from Binance hot wallets on 29 October 2026, the largest crypto theft on record. They did not crack any cryptography. Blockchain analysts believe they took control of the exchange's own signing system, which then approved their withdrawals on ten blockchains in roughly half an hour. Binance says it will cover every loss.

What Happened

The main theft began at about 20:05 UTC on Thursday, 29 October, when five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single attacker address. Over the next half hour, Binance hot wallets on Solana, Optimism, Bitcoin, Tron, Ethereum and several other networks were emptied too. According to the timeline published by TRM Labs, most of the money moved in about 20 minutes. A second wave hit Binance wallets on Avalanche and Polygon shortly after 23:00 UTC.

The loss figures differ by counter and by the moment prices were taken. Binance put the impact at about $6.3 billion in its official support announcement. TRM Labs counted $6.36 billion, Chainalysis estimated $5.9 billion at the time of theft, and Elliptic counted $6.43 billion at prices on the morning of 30 October. Every one of those numbers is roughly four times the $1.5 billion taken from Bybit in February 2025, which was the previous record.

The biggest single pieces, per TRM, were about $3.79 billion on Ethereum (including 200,630 ETH, 1.875 billion USDT and 823 million USDC), 18,270 BTC worth about $1.47 billion, 612.7 million USDT plus 46.4 million TRX on Tron, and the 233 million XRP.

Binance suspended all deposits and withdrawals. Its initial investigation said the breach "may involve a compromised DevOps engineer's laptop" that gave the attacker access to a service container used to submit withdrawal transactions, and that it had found no evidence that wallet private keys leaked. Co-CEO Richard Teng later wrote on X that the attacker "did not simply use one engineer's permissions," and the company said it had found additional points of breach. Co-CEO Yi He said the company would cover all hacking losses from its SAFU insurance fund and company money. Binance said it expected withdrawals to resume within about 48 hours, after a security overhaul of its withdrawal service.

Why It Matters

The size is the headline, but the method is the real story. In earlier exchange hacks, attackers usually stole private keys or tricked staff into signing one bad transaction. Here, analysts at both TRM and Elliptic think the attacker reached the machinery that signs Binance's transactions and told it what to approve. That is why wallets on ten different chains, using different key types and signature schemes, all produced valid signatures for the thief within minutes of each other.

That matters to anyone who keeps money on a centralised exchange. When you deposit coins on Binance, you hold an IOU, not the coins. The exchange keeps most deposits in offline cold storage and a smaller share in online hot wallets so withdrawals can be paid instantly. The hot wallet tier is supposed to be small enough that losing it would not hurt. A $6 billion hot wallet loss shows how large that "small" tier has become at the world's biggest exchange.

It also matters because of who analysts think did it. TRM attributes the theft with high confidence to TraderTraitor, the North Korean unit the FBI blamed for the Bybit heist in its February 2025 public service announcement. Elliptic also points to North Korea, though more cautiously. Researchers say North Korea steals crypto mainly to fund weapons programmes that sanctions are meant to starve.

Finally, the response showed how much power stablecoin issuers now hold. Within about 40 minutes of the main sweep, Tether froze 971.1 million USDT in the attacker's main wallet, and Circle froze 823 million USDC a few minutes later. Elliptic verified $2.84 billion frozen, about 44% of the theft, with 94% of it in stablecoins. Bitcoin, XRP and Solana have no issuer that can freeze them, so none of those funds were stopped.

How It Works

To understand the attack, it helps to know how a large exchange pays out a withdrawal. A customer asks to withdraw. An internal service checks the request, builds a blockchain transaction, and sends it to a signing system that holds or controls the hot wallet keys. The signer approves it, the transaction is broadcast, and the coins leave. But whoever can feed requests into the signer can spend the money.

That is the layer Binance's own account points to. The compromised engineer laptop reportedly reached a service container, a packaged piece of the exchange's internal software, that could submit withdrawal transactions. The keys did not need to leak. The attacker only needed the system that uses them to say yes.

The preparation

The on-chain record shows careful staging. On 28 October, an operator wallet received three small withdrawals from Tornado Cash, the Ethereum mixing service, to pay for transaction fees without an obvious trail. On 29 October the operator deployed attack code, tested it on two wallets, and ran a final rehearsal on a third, sending the test funds back to itself. About four hours later, the same code was pointed at Binance.

The Ethereum trick: EIP-7702

On Ethereum, the attacker used a feature added in the May 2025 Pectra upgrade, described in EIP-7702. It lets an ordinary wallet sign an authorisation that hands its behaviour to a smart contract, so the wallet temporarily acts like a programmable account.

Each authorisation is only valid at the wallet's current transaction counter, called the nonce. Because the attacker could not know exactly which nonce the busy hot wallet would be on, they had Binance's signer sign 50 authorisations covering 50 consecutive nonces, then submitted them all in one transaction at 20:20 UTC. One matched. The hot wallet was now delegated to a "sweeper" contract that only the attacker controlled. About three and a half minutes later, the attacker drained its full balance, including 167,464 ETH and 1.615 billion USDT.

The delegation stayed in place after the drain. Every time a Binance customer deposited funds that landed in that wallet, the sweeper could pull them out. On the other nine chains there was no such trick: Binance's wallets simply sent ordinary signed transfers to the attacker.

The laundering race

Stolen stablecoins are dangerous for a thief, because the issuer can freeze them. The attacker raced to swap them for ETH and TRX, which nobody can freeze. Elliptic counted about $786 million converted before the freezes landed, including 434 million USDT swapped for about 160,451 ETH through Uniswap, 1inch and market makers at a loss of 12% to 26% against market price. Another wallet posted 59.9 million USDT as collateral on the lending protocol Aave and borrowed 19,762 ETH against it. On Bitcoin, the 18,270 BTC was split in a "peel chain" into 19 addresses, most holding 1,000 BTC each, and as of Friday morning none had reached an exchange.

Elliptic estimates the attacker still controls about $3.33 billion that cannot be frozen, spread across about 43 addresses, including 18,270 BTC and more than 500,000 ETH. The 233 million XRP has not moved at all.

What's Still Unknown

The most important missing fact is how the engineer's laptop was compromised in the first place. Elliptic calls it the most diagnostic piece of the puzzle. North Korean groups have used fake job offers, poisoned software packages and malware-laced trading apps to reach employees before, but nobody has said which, if any, applied here. Binance has promised a detailed technical post-mortem but has not published it.

It is also unclear how one foothold reached signing systems on ten chains, and whether the attacker still has any access. Teng's statement that this was not a single one-click action, and Binance's mention of additional breach points, suggest a longer intrusion than a single stolen session.

Attribution is not settled. No government agency has yet named North Korea, whereas the FBI attributed Bybit within five days. Elliptic notes that the Binance thief held stolen USDT for 37 minutes on Ethereum and 46 minutes on Tron, which is slow for North Korean operators who usually dump stablecoins within minutes, and that the money went through market makers and lending protocols instead of the bridge-heavy pattern seen after Bybit. The on-chain overlap with the September Bitget theft is small, about $39,000 reaching a shared address, and could point to a shared launderer rather than the same hackers.

Finally, customers do not yet have proof that Binance is whole. The company says user funds are safe and has promised an updated proof of reserves once remediation ends. Until that report appears and withdrawals reopen, the promise rests on Binance's word.

Frequently Asked Questions

Is my money on Binance safe after the hack?

Binance says user funds are safe and that it will cover all losses from its SAFU fund and company money; one Binance post said it had set aside more than $6.34 billion. The stolen coins came from Binance's hot wallets, not individual customer balances. You still cannot verify this until withdrawals resume and Binance publishes its promised updated proof of reserves.

When will Binance withdrawals reopen?

Binance said it expected to resume withdrawals within about 48 hours of the incident, once it finished a security overhaul of its withdrawal service and the related wallet addresses. Later posts said it was still on track for that window. No exact date had been confirmed at the time of writing, so check Binance's announcement page before trying to move funds.

How did hackers steal $6.3 billion from Binance?

Binance's early findings point to a compromised DevOps engineer's laptop that reached a service container able to submit withdrawals. Analysts at TRM Labs and Elliptic believe the attacker could then make Binance's hot wallet signing system approve transactions of their choosing. On Ethereum they used EIP-7702 delegation to hand a hot wallet to their own sweeper contract.

What is EIP-7702 and is it a security flaw?

EIP-7702 is an Ethereum feature from the May 2025 Pectra upgrade that lets a normal wallet delegate its behaviour to a smart contract through a signed authorisation. It is not a bug in itself. The danger is that one valid signature can hand lasting control of a wallet to a contract, so anyone who can make a signer approve that authorisation can drain the wallet repeatedly.

Who is behind the Binance hack?

TRM Labs attributes it with high confidence to TraderTraitor, a North Korean state hacking unit the FBI blamed for the 2025 Bybit theft. Elliptic and Chainalysis also point to North Korea. However, no government has confirmed the attribution yet, and Elliptic notes the laundering pattern differs from earlier North Korean thefts, so the conclusion could still change.

Why could some stolen crypto be frozen but not bitcoin?

Stablecoins such as USDT and USDC are issued by companies, Tether and Circle, whose contracts let them block specific addresses. They froze billions within an hour. Bitcoin, XRP, Solana and ether have no central issuer that can stop a transfer, so once those coins reach an attacker's wallet, only exchanges refusing deposits can slow their use.

What is Binance's SAFU fund?

SAFU, short for Secure Asset Fund for Users, is an emergency reserve Binance created in 2018 to repay customers after hacks. Reports put it at roughly $1 billion, held largely in bitcoin. That is far less than this loss, which is why Binance says it will use company funds as well as SAFU to cover the full amount.