How Hackers Stole $6.3 Billion From Binance in Minutes

Binance is still piecing together how hackers made off with an estimated $6.3 billion in crypto, but investigators have already identified two important parts of the story: the attack has been linked to North Korea’s TraderTraitor hacking group, and an Ethereum upgrade gave the attacker a way to empty one of the exchange’s largest hot wallets in a single transaction. The theft unfolded across 10 blockchains yesterday, with most funds leaving Binance-controlled wallets in roughly 20 minutes, according to a report from TRM Labs. Binance initially pointed to a single compromised DevOps engineer’s laptop, but later said there were additional points of breach in a complex attack process. The specifics of how the attacker gained sufficient authority for the related transactions from Binance’s wallets remain unclear. I want to speak to you directly about what happened. Bottom line – your money is safe, and we're covering every loss. Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a… — Richard Teng (@_RichardTeng) October 30, 2026 Binance now estimates the total impact at approximately $6.3 billion (around $3 billion of which has been frozen by various third parties) and says it will cover all losses using its Secure Asset Fund for Users (SAFU) and other company funds. What Binance Has Said Binance’s first public explanation of what happened pointed to a laptop belonging to a DevOps engineer. Late last night, the exchange said its preliminary investigation suggested that the compromised laptop allowed an attacker to access a service container and submit unauthorized withdrawal transactions. Binance added that it found no evidence private keys had been leaked. Binance co-CEO Richard Teng later clarified that the attack was not simply a matter of one employee’s permissions being abused, posting on X, “The attacker did not simply use one engineer’s permissions, and this was not a single ‘one-click’ action. It involved a more complex attack process.” Teng added that Binance had uncovered additional points of breach but had not attributed responsibility to any specific individual. The exchange has promised a detailed technical postmortem after its investigation is complete. The Binance hack is STILL GOING. Binance evidently still has its deposit wallet sweeps turned on. This refreshes their hot wallet. The hacker is then sweeping the hot wallet pic.twitter.com/fJmARHmMkl — Conor (@jconorgrogan) October 29, 2026 Notably, Coinbase Head of Product Business Operations Conor Grogan warned during the attack that Binance’s deposit-wallet sweeps were still running after the initial attack had already taken place. Those automated sweeps move funds from individual customer deposit addresses into the exchange’s own aggregated hot wallets. In this case, that meant new deposits could replenish the wallet the attacker had already compromised. Blockchain Observers Point to North Korea Several blockchain intelligence firms and analysts have attributed the attack to TraderTraitor, a North Korean state-sponsored hacking group also associated with the broader Lazarus Group. TRM Labs said it attributed the theft to TraderTraitor with “high confidence.” The firm pointed to several features that resemble earlier North Korean-linked crypto heists, including the $1.4 billion Bybit hack in February 2025. Chainalysis co-founder and CEO Jonathan Levin also wrote on X that the Binance hack was “likely done by DPRK group TraderTraitor” because of links to previous hacks. Additionally, The Wall Street Journal reported that investigators were pointing to North Korea, with Elliptic founder Tom Robinson telling the outlet, “This is state-sponsored theft at a scale that no criminal group comes close to, with the proceeds funding North Korea’s weapons programmes.” Update: Stolen funds from the $6.3B Binance exploit and $388M Bitget exploit were commingled at the same address 45 minutes ago, after arriving via THORChain. This indicates the same actor is likely behind both incidents. The Bitget exploit was attributed to DPRK-linked… pic.twitter.com/KH72rXfNkM — ZachXBT (@zachxbt) October 30, 2026 On-chain investigator ZachXBT said funds from the Binance incident and a separate $388 million Bitget exploit, which was also previously linked to North Korea, had been commingled at the same address after passing through cross-chain exchange THORChain. North Korea has repeatedly been accused of using crypto hacks to bring in foreign currency despite international sanctions. Of course, they deny these accusations and claim it is nothing more than propaganda originating from the U.S. government. An April estimate from TRM Labs put North Korea’s crypto theft earnings at more than $6 billion since 2017, but the regime has been connected to billions of dollars worth of additional thefts since then. How an Ethereum Upgrade Helped the Attacker From a technical perspective, what happened on Ethereum is the most interesting part of the story. In terms of how the hack worked on this particular blockchain, TRM said the attacker funded an operator wallet through small withdrawals from Ethereum-based crypto mixer Tornado Cash, prepared the attack well in advance, and prepared 50 Binance-signed EIP-7702 authorizations before executing the theft in a rapid burst. EIP-7702 is an Ethereum upgrade that went live in May 2025, and the feature was designed to make ordinary Ethereum wallets more flexible by allowing them to temporarily run code from a smart contract. An externally owned account, or EOA, is normally controlled by a private key and cannot independently enforce rules or batch operations. EIP-7702 lets it sign an authorization delegating its behavior to a smart contract, making actions such as combining a token approval and transfer possible. In Binance’s case, the attacker used EIP-7702 to turn Binance 14, one of the exchange’s Ethereum hot wallets, into a wallet running an attacker-controlled sweeper contract. The attacker didn't know Binance 14's live nonce. So they sprayed 50 EIP-7702 auths (18914775-18914824) in one type-4 tx. Only 1 of 50 was a hit. A 7702 auth is valid only for the current nonce at inclusion. The hot wallet was still firing. One nonce in that window landed. https://t.co/ZjjayMIIHi pic.twitter.com/XFWqW6ezXw — Blockaid (@blockaid_) October 29, 2026 According to Blockaid’s technical reconstruction of what happened, the attacker submitted a transaction containing 50 EIP-7702 authorizations, each signed by Binance 14 and tied to a different consecutive nonce. A nonce is a counter that increases every time an Ethereum account sends a transaction. Because Binance 14 was actively processing withdrawals, its nonce kept changing. The attacker could not know which nonce would be current when the authorization transaction was processed, so it prepared 50 different possibilities beforehand. One of those turned out to be a match. That authorization pointed Binance 14 to a sweeper contract that only the attacker’s wallet could operate. Minutes later, the attacker used the contract to move approximately 167,464 ETH, about $1.6 billion in USDT, and more than 60 other tokens in a single transaction worth roughly $2.5 billion. To be clear, EIP-7702 did not let a stranger take over an arbitrary wallet. The authorization still had to be signed by the wallet’s key or by infrastructure capable of producing a valid signature. The specifics around the use of EIP-7702 also do not apply to what happened on other blockchains. Quick notes on 7702 to dispel fud and keep your funds safe. First thing first — 7702 itself isn't broken. Don't panic if you are using a wallet that supports 7702 (MetaMask, Uniswap, Ambire, etc.). To recap, 7702 is an account abstraction EIP that allows an EOA to sign a… — Derek Chiang | Ethlabs (@decentrek) October 30, 2026 Ethlabs founding member and researcher Derek Chiang argued that EIP-7702 itself was not broken. Rather, the feature made the theft faster and more efficient once the attacker had the ability to obtain valid authorizations. Without it, the attacker would have needed to submit separate transactions to move each token, competing with Binance’s legitimate withdrawals for the wallet’s next nonce. This Isn’t FTX The theft has drawn comparisons to FTX, but the circumstances around this most recent incident, at least as they are currently understood, appear quite different. Binance says customer funds are safe and that it will cover losses through SAFU and company funds. There is no public evidence that this was an inside job or that Binance is insolvent. Considering that much of the stolen funds have been frozen, the true loss from the hack is likely less than the $4.3 billion in penalties Binance agreed to pay as part of its 2023 settlement with the U.S. Department of Justice over violations involving anti-money-laundering and sanctions laws. Elon, have a lot of respect for you, but bad time to troll. Please stop. Our SPCX shares (from our $500m investment in your Twitter takeover) are worth more than a billion. Would appreciate if you show a little support. Thanks! — CZ 🔶 BNB (@cz_binance) October 30, 2026 On X, Binance co-founder and former CEO Changpeng “CZ” Zhao pushed back after Elon Musk reacted to a post that compared the current Binance situation with the previous FTX collapse. Zhao asked Musk to stop trolling and pointed to Binance’s investment in SpaceX as evidence of the company’s financial resources. The exchange may have the resources to make customers whole, but the specifics of how an attacker obtained enough authority to produce valid signatures across multiple blockchains remain unclear. Binance’s promised postmortem will need to explain not only the compromised laptop, but the additional breach points and the controls that failed to stop withdrawals worth billions of dollars.