 |
| Binance CEO — Changpeng Zhao |
On the evening of October 29, 2026, the world’s largest cryptocurrency exchange by trading volume suffered what blockchain analytics firms and the company itself now describe as the biggest crypto heist on record. Hackers drained roughly $6.3 billion in assets from Binance hot wallets across multiple blockchains in a matter of minutes to hours. The figure dwarfs the previous record—the approximately $1.5 billion Bybit theft in 2025—and ranks among the largest thefts of any kind in modern financial history.
Early tallies from independent analysts ranged from about $5.5 billion to $5.8 billion as transactions unfolded; Binance later confirmed an impact of around $6.3 billion (with some trackers such as Elliptic and Chainalysis placing it near $6.4 billion at peak valuation). The attack unfolded primarily in a roughly 20-minute window starting around 4 p.m. ET, though related activity stretched longer on certain chains. Crypto markets reacted with declines, including Bitcoin retreating toward the $77,000 level in the immediate aftermath.
Binance suspended withdrawals while leaving deposits operational and pledged to cover all customer losses using its Secure Asset Fund for Users (SAFU) emergency reserve plus company funds. Co-CEO Richard Teng and co-founder Yi He publicly affirmed that user funds remain safe.
Founder Changpeng Zhao (CZ), no longer in day-to-day management, observed that the activity “does look like a hack on Binance” and expressed confidence that customers would be fully covered.
How the Attack Unfolded: From Compromised Access to EIP-7702 Delegation
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop as a key entry point. This allegedly allowed the attacker access to a service container used to submit withdrawal transactions. The exchange has stated it found no evidence of a direct private-key leak from the wallets themselves, though investigators continue examining how authorization was obtained. Later updates noted “additional points of breach.”
On Ethereum, the technical mechanism that enabled a major portion of the drain involved EIP-7702, an Ethereum Improvement Proposal that lets ordinary externally owned accounts (EOAs) temporarily execute smart-contract code. This feature, intended to enhance wallet flexibility and account abstraction, became a vector once the attacker obtained valid signatures from the target wallet.
The primary target was the wallet labeled “Binance 14,” a high-volume Ethereum hot wallet that routinely processes customer withdrawals and appears in Binance’s proof-of-reserves reports. At approximately 20:20:59 UTC, an attacker-controlled address submitted a type-4 transaction containing 50 EIP-7702 authorizations signed by Binance 14’s key. These covered a range of consecutive nonces (roughly 18,914,775 to 18,914,824). Because the wallet’s nonce was advancing with legitimate traffic, spraying multiple authorizations increased the odds that one would match the live nonce. One did.
This delegated control of Binance 14 to an attacker-deployed “sweeper” contract. Minutes later, at 20:24:23 UTC, a single transaction swept approximately 167,464 ETH plus dozens of tokens (including around 1.615 billion USDT) valued at roughly $2.5 billion at the time. The same access facilitated further drains from related wallets, including significant USDC amounts.
Additional sweeps continued as customer deposits flowed into the compromised wallet until Binance regained control hours later via a revocation. The attacker’s funding for related addresses was traced in part to Tornado Cash, a mixer that obscures transaction origins.
The heist was not limited to Ethereum. Hot wallets on Bitcoin, Tron, Solana, Avalanche, Polygon, and other networks were also drained, contributing to the multi-billion-dollar total across at least nine or ten blockchains. Analytics firms including TRM Labs, Chainalysis, Elliptic, and Arkham mapped the flows in near real time.
Rapid Response: Billions Frozen, but Not Everything Recoverable
Stablecoin issuers acted quickly. Tether froze approximately $1.57 billion in USDT, while Circle froze more than $800 million in USDC. Combined freezes of linked stablecoins exceeded $2.3–2.8 billion in various reports, with additional amounts (including RLUSD and others) bringing total frozen assets toward or above $3 billion according to Binance and trackers. These freezes prevent further movement of the issuer-controlled tokens but do not automatically return them.
Native cryptocurrencies such as Bitcoin and Ether lack equivalent central blacklisting mechanisms. Roughly $3.3 billion in such assets remains harder to recover and is being tracked as the attacker consolidates or swaps holdings. Binance has cooperated with partners to freeze what it can and has committed company resources alongside SAFU to make users whole. Withdrawals were expected to resume within roughly 45 hours of the initial suspension pending remediation.
 |
| Binance co-founder — Yi He |
Attribution and Broader Context
Multiple blockchain intelligence firms—including TRM Labs, Chainalysis, and Elliptic—have assessed with high confidence that the operation bears the hallmarks of TraderTraitor, a North Korean-linked group associated with the Lazarus Group. These actors have a documented history of targeting crypto exchanges and services to generate revenue for the regime. If confirmed, this single theft would substantially increase the cumulative value of crypto stolen by North Korean actors. Binance itself has not publicly attributed responsibility to any specific party.
This incident is not Binance’s first major security event—the exchange suffered a roughly $40 million breach in 2019—but its scale is unprecedented. It arrives amid ongoing industry efforts to harden hot-wallet infrastructure, improve multi-party computation and hardware security modules, and refine features such as EIP-7702.
While the proposal itself contains no inherent “bug,” the episode illustrates how powerful authorization mechanisms become dangerous when signing infrastructure or operational security is compromised. Experts note that the core failure was the ability to obtain and use valid signatures rather than a flaw in the EIP itself.
The attack also highlights the dual nature of stablecoins: their freeze capabilities provided an unusually effective circuit breaker for a large share of the stolen value, something unavailable for pure cryptocurrencies. At the same time, the speed and multi-chain nature of the drain underscore persistent risks in centralized exchange custody models, even for the largest platforms that publish proof-of-reserves data.
Implications and Ongoing Investigation
For users, Binance’s commitment to full coverage and the partial freezes offer reassurance that customer balances should not be directly impaired.
Markets absorbed the news with volatility but without systemic collapse. Longer-term questions remain about operational security at scale, the trade-offs of advanced wallet features, and the effectiveness of sanctions and law-enforcement cooperation against sophisticated state-linked actors.
Investigators and analytics firms continue tracing residual funds. Binance has indicated it will provide further updates, including an updated proof-of-reserves after remediation. The episode reinforces a recurring lesson in crypto: innovation that expands functionality can also expand the attack surface, and the largest targets attract the most capable adversaries. As the industry digests the largest heist in its history, the focus shifts from the immediate response to whether lasting improvements in security architecture follow.
Samuel O. Sulaimon is the founder and Editor-in-Chief of Naijapiz. He covers Global, News, Sports, Finance, Faiths, Education, Politics and Technology.
Post a Comment