Last updated: October 30, 2026, with Binance’s Friday-morning statements. The investigation is still open, and figures may change.
On Thursday, October 29, 2026, Binance, the world’s largest crypto exchange by trading volume, said a security incident had affected roughly $6.3 billion in assets. About $3 billion of that has been frozen. If the totals hold, it is the largest crypto theft on record, about four times the $1.5 billion taken from Bybit in February 2025.
The first technical explanations spread fast, and some were shared as settled fact. They are not. Binance first pointed to a compromised engineer’s laptop, then said on Friday that its investigators had found additional points of breach. A security firm describes a clever Ethereum trick. Others disagree on whether private keys were stolen. This article separates what is documented, what companies are claiming, and what remains open.
Quick summary
- Size: Binance estimates about $6.3 billion affected and about $3 billion verified as frozen. Independent trackers give different totals (see the table below).
- Entry point (Binance): preliminary findings pointed to a compromised DevOps engineer’s laptop. On Friday, Binance said the attack was more complex than that and that investigators had found additional points of breach.
- On-chain mechanism (Blockaid): a wallet delegation using Ethereum’s EIP-7702, followed by a single sweep of the Binance 14 hot wallet worth about $2.5 billion.
- Open question: Binance says it found no evidence of a wallet private key leak. Blockaid’s later report describes a compromised key. These accounts are not yet reconciled.
- Attribution: TRM Labs and Chainalysis point to North Korea’s TraderTraitor. No government has formally attributed it, and Binance says it has not attributed responsibility to anyone.
- Customers: Binance says it will cover all losses from its SAFU fund and company funds. Deposits are working; withdrawals were expected back in about 45 hours as of Friday morning.
Latest updates, October 30, 2026
- More than a laptop. Binance said its investigation “uncovered additional points of breach,” per AFP’s report. Co-CEO Richard Teng wrote on X that the incident involved “a more complex attack process” and was not a single action by one engineer. He repeated that preliminary findings still pointed to a compromised DevOps laptop and that there was no evidence of a wallet private key leak.
- Services. Binance temporarily suspended deposits and withdrawals, then said deposits were operating normally. It said withdrawals would resume once a security revamp of its withdrawal service and related addresses is finished, and by Friday morning it said it was on track to resume in about 45 hours. Bloomberg earlier reported co-founder Yi He as saying by Sunday. Binance Alpha trading was also suspended. AFP reported that customer account balances had not been touched.
- Frozen funds rose. Binance’s verified frozen total went from $2.54 billion on Thursday night to $3 billion early Friday. The assets include USDT, USDC, RLUSD, USD1, XUSD, USDT0, WBETH, XAUT, PAXG, USDP, and ARB, according to Cointelegraph’s live coverage.
- Attribution firmed up, but is not official. Chainalysis CEO Jonathan Levin said TraderTraitor was likely responsible and put the theft at $6.4 billion. On-chain investigator ZachXBT said funds from Binance and from an earlier Bitget exploit were commingled in the same address after passing through THORChain, which he said suggests the same actor.
- Markets. Bitcoin traded below $77,000 and BNB fell about 8%, while AAVE and UNI each fell more than 10%, according to Cointelegraph. CoinDesk reported about $1.5 billion in liquidations.
What happened, hour by hour
All times are UTC unless noted. On-chain times come from Blockaid’s analysis, which was still being updated when I read it. Statement times come from Cointelegraph’s live coverage and Euronews. Eastern Time is four hours behind UTC.
| Time (UTC) | Event | Source |
|---|---|---|
| Oct 28 | The attacker’s operator address is funded through three Tornado Cash withdrawals. | Blockaid |
| Oct 29, before 15:59 | The operator rehearses the full delegate-and-sweep sequence on three wallets it controls, moving a few dollars each time. | Blockaid |
| 15:59 | The attacker deploys an unverified “sweeper” contract. | Blockaid |
| 20:20:59 | One transaction carries 50 EIP-7702 authorizations aimed at Binance 14, one for each of 50 possible nonces. Only one is valid and the wallet is delegated to the sweeper. | Blockaid |
| 20:24:23 | The sweep takes 167,464 ETH, about 1.6 billion USDT, and about 60 other tokens, worth about $2.5 billion, in one transaction. | Blockaid |
| 20:24–20:36 | Ten more Binance hot wallets on four chains send funds to the same collection address. | Blockaid |
| 20:41 | Through the still-delegated wallet, the attacker moves 780 million USDC out of a Binance-owned smart account, then another 43 million. | Blockaid |
| 20:58–21:01 | The exploiter deposits 60 million USDT on Aave and borrows 19,762 WETH, about $44.6 million. It is the only Aave position the exploiter opened. | LlamaRisk, via Cointelegraph |
| About 21:29 | Binance says it is investigating a potential security issue, calls customer funds safe, and warns of scams. | Euronews |
| 21:44 | The attacker sweeps Binance 14 again for more than $200 million in new deposits. | Blockaid |
| 22:32 | Binance says it is running security checks and will resume withdrawals once the issue is resolved. | Cointelegraph |
| 23:35 | Binance says the verified frozen total is $2.54 billion. | Cointelegraph |
| Oct 30, 00:07 | Binance says it has temporarily suspended deposits as well, and promises a full post-mortem. | Cointelegraph |
| 00:52 | Binance says the verified frozen total is now $3 billion. | Cointelegraph |
| 02:25 | Binance says preliminary findings point to a compromised DevOps engineer’s laptop and no wallet private key leak. | Cointelegraph |
| 04:17 | Binance says deposits are normal and withdrawals should resume within 48 hours after a security revamp. | Cointelegraph |
| 08:37 | Binance says it has found additional points of breach and is on track to resume withdrawals in about 45 hours. | Cointelegraph, AFP |
Reports that the theft happened “in about twenty minutes” are close for the main drain: TRM Labs said most funds moved in about 20 minutes across ten blockchains. But Blockaid’s timeline shows later sweeps more than an hour afterward, so the incident was not over after 20 minutes.
How the on-chain part worked
A short primer on EIP-7702
EIP-7702 arrived with Ethereum’s Pectra upgrade in May 2025. It lets an ordinary wallet (an externally owned account, or EOA) sign an authorization that points it at smart-contract code. Once a special transaction carrying that authorization is included in a block, the wallet runs that contract’s logic. The authorization is tied to the wallet’s current nonce (its transaction counter), and it stays in place until the wallet signs a new one.
The nonce spray
Binance 14 was still sending withdrawals, so its nonce kept changing. According to Blockaid, the attacker could not know the live value and signed a block of 50 consecutive nonces. Forty-nine failed. One matched. That is why the attack is sometimes described as “50 signatures at once,” but the phrase is misleading. Fifty authorizations were bundled to improve the odds of one landing. They were not 50 parallel approvals.
The delegated wallet then belonged, in practice, to a contract whose only authorized caller was the attacker’s operator address. Blockaid says the contract’s sweep function could pull out every token and the wallet’s Ether, leaving 1 ETH for gas. Because the delegation persisted, deposits that arrived later could be taken as well, which Blockaid says happened more than an hour later.
The unresolved question: who produced the signatures?
An EIP-7702 authorization must be signed by the wallet’s own key. So the on-chain evidence raises the question of where a valid signature came from. A reader replying to Blockaid’s X thread asked exactly that. Two accounts exist:
- Signing infrastructure compromised, key not stolen. Blockaid CEO Ido Ben-Natan told Cointelegraph he thought it was “key misuse” and said, “We don’t think a key was leaked.” Binance says it has found no evidence of a wallet private key leak.
- A compromised key. Blockaid’s later written report says the attacker used a compromised hot wallet key, and that eleven Binance hot-wallet keys signed transfers to the collection address. The same report also says Binance’s signing infrastructure signed the delegation while under the attacker’s control.
These descriptions overlap, since a compromised signing service can produce valid signatures without anyone copying a key. But the wording differs, and Binance’s own post-mortem has not been published. I would treat “no key was stolen” as unproven. Note also that Blockaid sells signing-policy and monitoring products, which its report promotes, so its analysis is not independent of that interest.
In my own reading, neither Binance nor Blockaid has described a flaw in EIP-7702 itself. The feature worked as designed once someone produced a valid signature. That is my analysis, not a finding from either company.
The entry point: a laptop, and then more
Binance’s preliminary statement, relayed by NBC News, CoinDesk, and Cointelegraph, says the incident may involve a compromised DevOps engineer’s laptop, through which an attacker reached an internal service container and submitted unauthorized withdrawal transactions. On Friday, Binance added that the incident involved multiple factors and that its team was tracing the full attack path. AFP’s report says investigators had uncovered additional points of breach, contrary to the initial picture of a single compromised laptop. Binance has not said what those points are.
Two days earlier, on October 27, Binance had publicly said it blocked several North Korea-linked attacks over the previous week. That campaign, called “Contagious Interview,” uses fake job interviews as a social-engineering lure. Binance said then that no systems or assets were affected. No source I found links that earlier campaign to the October 29 theft, so treat any such link as speculation.
The money: numbers by source
The totals differ because firms count different chains, assets, and time windows. Each figure belongs to whoever published it.
| Source | Claim |
|---|---|
| Binance | About $6.3 billion total impact; $3 billion verified frozen as of early Friday (up from $2.54 billion on Thursday night). |
| TRM Labs | About $6.36 billion left Binance-controlled wallets across ten blockchains; about $2.7 billion frozen; about $2.4 billion in ETH and BTC still controlled by the attacker. |
| Chainalysis | An estimate of $5.912 billion at the time of theft; its CEO later put the total at $6.4 billion. |
| Arkham Intelligence | Wallets it labeled “binance-hacker-1029” held about $5.84 billion. Cointelegraph notes this is reported holdings, not a confirmed theft estimate. |
| Blockaid | At least $5.5 billion by 22:00 UTC across six networks, by public tallies; the exploit was still ongoing at that point. |
| Tether (CEO Paolo Ardoino) | More than $1.567 billion in USDT frozen. |
| Circle (CEO Jeremy Allaire) | More than $800 million in USDC frozen. |
| World Liberty Financial and BitGo | $27 million in USD1 and $2 million in WLFI frozen. |
| Arbitrum Security Council | About $30.5 million frozen (74.6 million ARB and 8,425 ETH), moved to an intermediary wallet. |
| Ripple and First Digital | Both said they were freezing related tokens (RLUSD and FDUSD). Neither disclosed an amount in the coverage I read; an earlier wire report quoted Binance’s Yi He at about $200 million for Ripple. |
For scale, DefiLlama data cited by Trending Topics put Binance’s assets at about $144 billion before the hack, so the loss is roughly 4%. That is context from an outside tracker, not a Binance statement.
On Aave, the lending protocol froze markets across its V3 and V4 deployments after the exploiter’s borrowing. LlamaRisk said the position was backed by $59.9 million in USDT against $43.8 million in debt, did not put Aave suppliers at risk, and that users can still withdraw and repay while new deposits and borrowing are blocked.
North Korea: what is claimed, and by whom
TRM Labs attributed the attack to TraderTraitor, a North Korean unit linked to Lazarus, with “high confidence,” citing on-chain and off-chain intelligence it did not fully disclose. Chainalysis CEO Jonathan Levin said the group was likely responsible, citing links to a previous hack. Blockaid’s Ben-Natan said the on-chain preparation, custom sweeper contract, and multiple authorizations resembled North Korean work, while stressing this was not definitive.
ZachXBT’s commingling observation points the same way. He said the stolen funds from Binance and an earlier Bitget exploit landed in one address via THORChain, and that the Bitget exploit had been attributed to TraderTraitor.
The FBI named TraderTraitor as responsible for the Bybit theft in February 2025. For context, TRM reported in May that North Korea-linked actors had taken about $577 million in the first four months of 2026, or 76% of all hack losses in that period, before the Binance incident.
Attribution by analytics firms is a probabilistic judgment. It may well be right, but it is not yet an official finding. No government agency has formally attributed the Binance attack, and Binance has not named a culprit.
Ecosystem and market impact
- Prices: Bitcoin dropped below $77,000. BNB fell about 8% to near $693, Ether fell about 5.7%, and the Bitcoin Fear and Greed Index dropped to 30, a “fear” reading not seen since August (Cointelegraph).
- Market makers: Wintermute said its Binance exposure was under 20% of net equity and GSR said under 5%. Both said they did not expect major disruption, and neither disclosed dollar amounts.
- DeFi: Aave froze markets as a precaution, as described above. Standard Chartered’s Geoffrey Kendrick argued the hack could push more trading to decentralized exchanges. That is an analyst’s opinion, not a measured trend.
- A separate incident: Polymarket briefly halted trading earlier on Thursday after a compromise at a third-party provider and says systems were restored. I found no report linking it to Binance.
Fact check: claims circulating in early coverage
| Claim | Status | Note |
|---|---|---|
| About $6.3 billion affected, about $3 billion frozen | Binance’s figure | Other trackers differ, and Binance itself says the numbers may change. |
| The attacker took 50 signatures at once and drained $2.7 billion in seconds | Misleading | Fifty authorizations were sprayed across nonces; one worked. The first sweep was about $2.5 billion in one transaction, minutes later. |
| The attacker held 197,460 ETH after the theft | Not verified | I found it only in a single unconfirmed analysis; Blockaid reports 167,464 ETH in the first sweep alone. I left it out. |
| The attacker did not need to steal a private key | Unproven | The authorizations were signed with the wallet’s key. Whether the key leaked or the signer was abused is unresolved. |
| The breach was one compromised DevOps laptop | Superseded | Binance still says the laptop may be the entry point, but now reports additional breach points and a more complex attack. No independent confirmation yet. |
| Binance had disclosed days earlier that it repelled North Korea-linked attacks | Confirmed | Announced October 27; no link to the theft has been shown. |
| TRM said North Korea was “almost certainly” responsible | Reworded | TRM’s published wording is “high confidence.” |
| The FBI linked the same group to the Bybit theft | Confirmed | An FBI public service announcement in February 2025 named TraderTraitor. |
| The loot is worth more than many national economies | Unsupported | I found no source and removed the comparison. |
| Binance will publish an updated Proof of Reserves | Not found | I found promises of a full post-mortem, but not this commitment. |
| The attacker posted stolen funds as collateral on Aave | Confirmed, small scale | LlamaRisk reports 60 million USDT deposited and about $44.6 million of WETH borrowed. It was the exploiter’s only Aave position. |
| User funds were affected | Not reported | AFP says customer account balances were not touched; the assets taken came from exchange hot wallets. Binance’s own full accounting is pending. |
What people are asking
Public discussion is very new, and I found little beyond news coverage. One reader replying to Blockaid’s thread on X put the key question plainly: guessing the right nonce does not remove the need for the wallet’s own signature. That is the gap the investigation has to close. Blockaid’s thread on X
My opinion
I haven’t investigated this incident or touched any of the systems involved. These points come from reading the sources above.
- Be cautious with the “key misuse, not key theft” framing. It spread quickly, but the same firm’s later report speaks of a compromised key, and Binance’s own account has already shifted from one laptop to several breach points. For a defender the practical difference is small: whoever controls the signing path controls the funds.
- Binance’s communication has been uneven. AFP described a series of sometimes contradictory messages, including “funds are safe” alongside a pledge to cover all losses, and the cause has been restated twice in a day. Fast updates are good. Clear ones are better, and the promised post-mortem will matter more than any early post.
- Some of the loudest analysis comes from vendors. Blockaid’s timeline is detailed and useful, and I rely on it here. But it also sells products aimed at exactly this scenario. That does not make it wrong. It means its recommendations should be read as part of a sales pitch.
- The freeze worked partly because the money was in stablecoins. That limits the damage, but it is also a reminder that recovery depended on a few issuers acting fast. About $2.4 billion in ETH and BTC, by TRM’s count, was beyond their reach.
What this means for you
If you hold funds on Binance
- Binance says user funds are safe and that it will cover all losses. That is a company pledge, so watch for its post-mortem and for withdrawals reopening, which it expected within about 45 hours as of Friday morning.
- Expect scams. Fake “compensation,” “claim your funds,” and “verify your wallet” messages typically follow big incidents, and Binance itself warned of scams. Use only Binance’s official app and domain, and do not share codes or seed phrases. The scam advice is mine, not from a source.
- If you borrow on Aave, new deposits and borrowing were frozen while repay, withdraw, and liquidations continued. Check Aave’s official channels for the staged reopening.
- This article is not financial advice. Decisions about where to hold assets are yours to make.
If you run security for a custody or exchange environment
- Treat EIP-7702 authorizations as privileged operations, screened by the same policy controls as a large transfer. Blockaid recommends this.
- Monitor hot-wallet addresses for code changes. A wallet that gains delegation code should raise an alert. In this incident the delegation was visible for about three minutes and 24 seconds before the sweep.
- Prepare a revocation transaction in advance, and clear any delegation before rotating keys. Blockaid notes that a delegation belongs to the address, so a new key alone does not remove it.
- Limit per-transaction and per-window value, and restrict destinations to allowlisted addresses, so one signature cannot move a nine-figure sum to an unknown address.
- Harden engineer endpoints, and do not stop there. Binance’s account started at a laptop but now involves more breach points. Isolate DevOps machines that can reach withdrawal-capable services, and give service containers the least privilege they need.
- Defend against fake-recruiter lures, the style Binance said it saw from North Korea-linked actors two days earlier.
Frequently asked questions
Was Binance’s cold storage affected?
The reports I found describe hot wallets, which are online wallets used for payouts. I did not find a statement that cold storage was touched, and Binance’s full account is pending.
Is EIP-7702 broken?
Neither Binance nor Blockaid has described a protocol flaw. The feature let a signed authorization turn a wallet into a contract-controlled account, which is what it is meant to do. The open question is how valid signatures were obtained.
Will users lose money?
Binance says no and has pledged to cover all losses from its SAFU fund and company funds. That promise depends on the company’s own resources, and it has not yet published a full post-mortem.
When will Binance withdrawals reopen?
As of Friday morning, Binance said it was on track to resume withdrawals in about 45 hours, after finishing a security revamp of its withdrawal service. Check Binance’s official channels for the actual reopening, since the timing may change.
Sources
- Cointelegraph: live updates on the Binance hack (October 29–30, 2026)
- AFP via Yahoo Finance: Binance confirms “complex” hack and additional breach points
- Euronews: how the Binance hack happened and who was behind it
- Blockaid: on-chain report on the Binance incident (October 29, 2026)
- Blockaid on X: the nonce spray and sweeper contract
- Cointelegraph: Blockaid CEO on “key misuse”
- crypto.news: how the EIP-7702 wallet trick worked
- NBC News: Binance targeted in $6.3 billion heist
- CoinDesk: Binance loses over $6 billion
- CoinDesk: market impact and liquidations
- Bloomberg: Binance estimates $6.3 billion hacked
- AMBCrypto: Binance to resume withdrawals within 48 hours
- FinanceFeeds: TRM and Chainalysis attribution to TraderTraitor
- Forbes: Chainalysis estimate of $5.9 billion
- Trending Topics: TRM’s breakdown and Binance asset context
- TRM Labs: North Korea and 76% of 2026 hack value (before the Binance incident)
- Odaily: Binance’s October 27 note on blocked North Korea-linked attacks
Do you have an account on a centralized exchange? Tell us in the comments what you check before trusting one with your funds.