On Thursday, October 29, at 20:05 UTC, some Binance wallets started emptying themselves. Twenty minutes later, about $6.36 billion spread across ten blockchains was gone. It’s the biggest cryptocurrency theft in history: four times the size of the Bybit hack of February 2025, which held the record until now.
In this article I go over what we know about the case, how the technical trick used on Ethereum (EIP-7702) works, and the hypotheses about how the attackers got in. Verified facts and hypotheses are kept separate, because Binance hasn’t published an official root-cause analysis yet.
The numbers
- Amount stolen: about $6.36 billion according to TRM Labs, $6.4 billion according to Chainalysis and $6.3 billion according to Binance.
- Duration: most of it in about 20 minutes. The hot wallet known as “Binance 14” alone lost about $2.5 billion in roughly three and a half minutes.
- Scope: ten blockchains (Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon).
- Frozen: about $2.7 billion within four hours, almost all of it in stablecoins. Binance and Chainalysis later reported $2.8 to $3 billion.
- Attribution: TRM and Chainalysis attribute it to TraderTraitor, a North Korean hacking group.
What the blockchain shows
The most interesting part is that there’s no cryptographic flaw and no contract with a security hole. On nine of the ten chains, Binance wallets made ordinary, correctly signed transfers to attacker addresses. Technically, the network had no way to tell them apart from a legitimate withdrawal.
On Ethereum the attacker went further and used a relatively new feature, EIP-7702, to empty a whole wallet, holding more than 60 different tokens, in a single operation.
EIP-7702, explained simply
Ethereum has two kinds of accounts. Regular wallets (EOAs, externally owned accounts) are controlled by a private key and only do what each signed transaction says. Smart contracts are programs that can enforce rules, batch operations and so on.
EIP-7702, which arrived with the Pectra upgrade in May 2025, lets a regular wallet temporarily “wear” a contract’s code. All it takes is for the wallet to sign an authorization that says, roughly: “from now on, when someone calls me, run the code at this address”. Think of it as a power of attorney: you sign a document so that someone can act on your behalf.
Each authorization carries a number: the nonce, the wallet’s transaction counter. It’s only valid if it matches the wallet’s nonce at the exact moment it executes.
The 50-authorization trick
“Binance 14” was a hot wallet processing withdrawals non-stop, so its nonce kept climbing. The attacker couldn’t know which number would be current when their transaction executed. The solution, as reconstructed by Blockaid: pack 50 authorizations signed for 50 consecutive nonces (18,914,775 to 18,914,824) into a single type-4 transaction, sent at 20:20:59 UTC. The other 49 failed, but one hit was enough.
The winning authorization made Binance 14 delegate to a “sweeper” contract the attacker had deployed hours earlier. That contract had a sweep() function only the attacker could call: it transferred all the ETH and every token, leaving 1 ETH in the wallet to pay for gas. The result: 167,464 ETH, 1.615 billion USDT and 63 other tokens.
An important nuance: EIP-7702 isn’t “broken”. As Derek Chiang (Ethlabs) puts it, the feature only made the theft faster and more efficient. Without it, the attacker would have had to move each token in a separate transaction, competing with legitimate withdrawals for the next nonce. But all 50 authorizations were valid: they had to be signed by Binance 14’s key or by the system that signs on its behalf. That’s the big question.
Hypotheses: how did they get the signatures?
This part is speculative. It combines what Binance has said, the analysis from blockchain-tracing firms and my own reasoning.
Binance’s preliminary investigation points to a DevOps engineer’s compromised laptop. From that laptop, the attacker would have reached a container for an internal service capable of submitting withdrawals. Binance says it has found no evidence that private keys were leaked. Its co-CEO, Richard Teng, added that “the attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action”: additional points of breach have been found.
Hypothesis 1: control of the signing system (most likely)
This is TRM Labs’ view: the attacker got the infrastructure that signs hot-wallet transactions to sign whatever they wanted, on every chain. It’s the only explanation that fits everything: “ordinary” transfers on nine chains, EIP-7702 authorizations on Ethereum, and a pace only possible with automation. The authorizations were signed before the attack (hence the 50 ready to go), which suggests the attacker had access for hours without anyone noticing.
Exchanges don’t keep keys in a file. They use signing systems (HSMs, MPC, internal services) that receive requests from other services and sign them if they meet certain rules. If the attacker controlled a service that the signing system trusted, there was no need to steal a key: it was enough to ask for signatures. That fits what Binance says: no leaked keys, but access to a container that could submit withdrawals.
Hypothesis 2: authorizations obtained by deception
Early indicators suggested phished authorizations: an insider signs something they think is harmless. The problem, as TRM points out, is that this would only explain what happened on Ethereum, not on the other nine chains. An early Blockaid post also mentioned a “stolen key”, which Binance denies for now.
Hypothesis 3: an inside job
It always comes up in a case like this, but so far there’s no public evidence of an inside job. The pattern (Tornado Cash funding, tests on small wallets, a dress rehearsal hours before) matches TraderTraitor’s previous attacks.
Comparison with Bybit (February 2025)
The parallel is clear. At Bybit, the same group compromised the computer of a developer at Safe{Wallet}, the multisig wallet provider, and injected malicious JavaScript into its web interface. Bybit’s signers approved what looked like a routine transfer, but it was actually an operation that changed the wallet’s logic and handed control to the attacker. $1.5 billion was lost.
In both cases, the cryptography worked perfectly. The attack targeted everything around the signature: an engineer’s workstation and the software chain that decides what gets signed. At Bybit they fooled people; at Binance, if hypothesis 1 is confirmed, they fooled machines.
What was taken
Ethereum accounts for 60% of the haul, between ETH and stablecoins (1.875 billion USDT, 823 million USDC and 88.5 million RLUSD). The 18,270 BTC were immediately split into chunks of 1,000 and 100 BTC within the same block, a classic technique to make tracing harder.
A race against the freezes
Stablecoins have a feature the attacker knew about: the issuer can freeze them. That’s why the first stage of laundering was a race to swap them for assets nobody can block:
- UniswapX: sold 325 million USDT to market makers for about 122,300 ETH, accepting a loss of more than 10% against the market price in exchange for speed.
- Aave: deposited 60 million USDT as collateral and borrowed about 19,760 ETH, with no intention of paying it back. Aave froze the affected markets.
- Tron: 300 million USDT into JustLend and another 200 million through intermediate wallets.
- RLUSD: sold 48 million in 19 minutes before Ripple froze the rest.
Tether froze 971 million USDT 37 minutes after the main drain, and Circle froze 823 million USDC three minutes later. There’s an irony here worth thinking about: what limited the theft most was precisely the centralised part of the crypto world. Even Arbitrum’s Security Council forced 8,426 ETH and 74.6 million ARB out of the attacker’s wallet, an intervention that will spark debate about how decentralised these networks really are.
According to TRM, the attacker still controls more than 420,000 ETH and the 18,270 BTC, about $2.4 billion. So far they haven’t leaned on cross-chain bridges as heavily as after Bybit, but TRM expects the next stage to involve bridges, swap services and OTC brokers.
Who’s behind it
TRM Labs attributes it “with high confidence” to TraderTraitor, the North Korean unit the FBI named as responsible for the Bybit theft. Chainalysis reaches the same conclusion based on a very specific piece of evidence: funds stolen from Binance have been mixed with funds from last month’s Bitget theft (about $388 million, according to investigator ZachXBT), which had already been attributed to North Korea. North Korea always denies these accusations.
In perspective
To put it in context: the Binance theft is bigger than all the others on the list combined. And it’s not Binance’s first appearance: in 2019 it lost 7,000 BTC (about $40 million at the time) from a hot wallet, and in 2022 about $570 million was lost through a vulnerability in its BNB chain bridge.
What happens now?
- Customers shouldn’t lose anything. Binance says it will cover all losses with its SAFU emergency fund (about $1.2 billion, according to Fundstrat) and its own funds. “Bottom line – your money is safe, and we’re covering every loss,” said Richard Teng.
- Withdrawals: co-founder Yi He said on October 30 that they expect to resume them “in the next 48 hours”.
- Official report: Binance has promised a detailed root-cause analysis and updated proof of reserves, but with no date.
- Markets: bitcoin has dropped below $78,000.
Lessons for anyone who runs systems
You don’t need to manage billions in crypto to learn from this case. Here’s my take:
- A DevOps laptop is critical infrastructure. If production can be reached from a workstation, that workstation needs production-grade protection: dedicated machines for privileged tasks, no email or browsing, and short-lived credentials.
- Whoever signs shouldn’t trust whoever asks. A signing system needs its own independent rules: allowed destinations, amount and velocity limits, and human approval for anything out of the ordinary. If a compromised internal service can get anything signed, that’s a design problem.
- Block what isn’t needed. A withdrawal hot wallet has no reason to ever sign EIP-7702 authorizations. A rule as simple as “this type of operation is never signed” would have prevented the Ethereum part.
- Fast detection is useless if the response is slow. Blockaid detected the theft in under two minutes. With automated attacks lasting 20 minutes, you need an automatic “red button” that halts withdrawals without waiting for a meeting.
- Keep the bare minimum hot. The less balance sits in connected systems, the less you can lose. That applies to wallets, and also to credentials, tokens and permissions.
Sources
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History
- Chainalysis: The $6.4 Billion Binance Hack: Tracing the North Korea Link
- crypto.news: How one wallet trick led to a $6.3 billion breach (with Blockaid’s analysis)
- Gizmodo: How Hackers Stole $6.3 Billion From Binance in Minutes
- CNBC: Binance’s $6.3 billion hack: What we know and what comes next
- TechCrunch: Binance pauses withdrawals as hackers suspected of stealing billions in crypto
Note: this article was prepared with the help of AI (Claude). The data comes from the linked sources, and hypotheses are marked as such. This is a developing story: figures may change once Binance publishes its report.