Binance Hack: How Hackers Drained $6.3 Billion From the Crypto Exchange

The Binance hack has emerged as the largest cryptocurrency theft on record, after attackers moved approximately $6.3 billion in digital assets from wallets belonging to the world's largest crypto exchange. The incident, which occurred on October 29, 2026, involved unauthorized withdrawals across 10 blockchain networks and may have started with a compromised laptop belonging to a Binance DevOps engineer.

Binance's preliminary investigation suggests the attacker used the compromised device to access an internal service container and submit unauthorized withdrawal transactions. The exchange said it found no evidence that wallet private keys had been leaked.

Blockchain intelligence firm TRM Labs traced approximately $6.36 billion in outflows and attributed the attack with high confidence to TraderTraitor, a North Korean-linked hacking group. The investigation also revealed that attackers used Ethereum's EIP-7702 functionality to gain control over a hot wallet's transaction execution.

Binance said it had worked with industry partners to freeze approximately $3 billion in assets and pledged to cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.

Related: Binance Reports $6.3 Billion Security Breach, Tether and Circle Freeze Assets

How did the Binance hack happen?

Binance's initial investigation points to a compromised DevOps engineer's laptop as the possible entry point for the attack.

According to the exchange, the attacker used access from the compromised device to reach an internal service container. This container reportedly provided a route to systems involved in processing withdrawal transactions.

Instead of directly stealing wallet private keys, the attackers allegedly exploited the infrastructure responsible for authorizing transactions.

This distinction is important. Cryptocurrency exchanges use hot wallets to process withdrawals, and these wallets must interact with internal applications and transaction-signing systems. If an attacker gains control over an application or service authorized to request transactions, they may be able to move funds without extracting the underlying private keys.

Binance said its investigation found no evidence of a private-key leak. However, the exchange has not yet published a complete technical post-mortem explaining exactly how the laptop was compromised or how the attacker gained access to the internal signing infrastructure.

How hackers used EIP-7702 to drain Binance's Ethereum wallet

One of the most significant findings from the blockchain investigation concerns Ethereum's EIP-7702 functionality.

Introduced through Ethereum's Pectra upgrade, EIP-7702 allows externally owned accounts to temporarily delegate transaction execution to smart-contract code through signed authorizations.

TRM Labs reported that the attacker used this mechanism to turn a Binance hot wallet into a sweeper account controlled by the attacker.

The process involved 50 pre-signed authorizations prepared in advance. Each authorization corresponded to a different transaction nonce, which determines the sequence of transactions from an Ethereum account.

The attacker submitted these authorizations in a single transaction. One matched the wallet's required nonce and allowed the malicious delegation to take effect.

The attacker then instructed the wallet to transfer its assets to an address under their control.

More importantly, the delegation remained active. As additional funds arrived in the Binance hot wallet, the attacker could execute further transfers instead of relying on a single withdrawal.

TRM Labs reported that the wallet was swept multiple times. The attacker also used the compromised wallet's execution capabilities to access funds associated with a separate Binance smart account.

Read more: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History

This method allowed the attackers to exploit transaction authorization rather than directly extracting the wallet's private key.

Binance wallets were drained across 10 blockchains

The attack was not limited to Ethereum. TRM Labs traced approximately $6.36 billion in transfers from Binance-attributed wallets across 10 blockchain networks.

The affected networks included:

• Ethereum
• Bitcoin
• Tron
• XRP Ledger
• Solana
• Arbitrum
• Optimism
• Base
• Avalanche
• Polygon

According to TRM Labs, most of the initial outflows happened within approximately 20 minutes, beginning at 20:05 UTC on October 29. A later wave of transactions involved wallets on Avalanche and Polygon.

Ethereum accounted for the largest share of the reported outflows, with approximately $3.79 billion in assets transferred. Bitcoin outflows reached approximately 18,270 BTC, worth around $1.47 billion at the time of the transfers.

The attackers also moved substantial quantities of stablecoins, including USDT and USDC, alongside other digital assets.

The activity across multiple networks suggests that the incident involved more than an isolated Ethereum wallet exploit. TRM Labs believes the attackers gained access to Binance's broader hot-wallet signing infrastructure, although the exchange has yet to confirm the complete technical explanation.

How the attackers attempted to launder the stolen cryptocurrency

After draining the wallets, the attackers began moving and converting the stolen assets to make recovery more difficult.

One technique involved splitting Bitcoin into smaller transactions through a process known as a peel chain. This method moves portions of a balance through multiple addresses while making the remaining funds harder to track.

The attackers also attempted to convert stablecoins into other cryptocurrencies.

This was particularly important because centralized stablecoin issuers can freeze tokens linked to suspicious transactions. By exchanging stablecoins for assets such as ETH, attackers can reduce their exposure to issuer-level freezes.

TRM Labs reported that the attacker sold USDT through market makers and borrowed ETH against USDT through Aave.

Using decentralized finance lending infrastructure provided another route for changing the composition of the stolen assets.

However, these activities also gave blockchain investigators additional transactions to monitor. Security firms and centralized issuers coordinated to identify suspicious addresses and restrict assets wherever possible.

Binance freezes $3 billion as attackers face recovery efforts

Binance worked with blockchain intelligence firms, stablecoin issuers, and other industry participants to limit the movement of stolen funds.

The exchange initially reported that approximately $3 billion had been frozen on-chain. TRM Labs separately estimated that around $2.7 billion in assets had been frozen through stablecoin issuers and blockchain-level interventions at the time of its analysis.

Tether, Circle, Ripple, and World Liberty Financial participated in freezing affected stablecoins. Arbitrum's Security Council also froze assets on its network.

Despite these interventions, TRM Labs estimated that the attacker still controlled more than 420,000 ETH and 18,270 BTC, worth approximately $2.4 billion at the time of its analysis.

Binance temporarily suspended withdrawals across several networks while conducting security checks and coordinating with its partners.

The exchange also pledged to cover all losses through its SAFU fund and company funds, stating that user funds remained safe.

The response highlights the importance of emergency reserves in centralized exchange security.

North Korea's TraderTraitor group linked to the Binance hack

TRM Labs attributed the Binance hack with high confidence to TraderTraitor, a North Korean-linked hacking unit.

The firm's assessment was based on on-chain and off-chain intelligence, as well as similarities between this incident and previous attacks associated with the group.

Chainalysis also reportedly linked the attack to North Korean hackers. However, Binance has not officially identified the attackers, and the attribution remains an assessment by blockchain intelligence firms rather than a publicly confirmed government finding.

TraderTraitor has previously been associated with major cryptocurrency thefts, including the $1.5 billion Bybit hack in February 2025.

The Binance incident highlights the continued threat posed by sophisticated attackers targeting centralized exchanges and their internal infrastructure.

For additional context, readers can also explore our coverage of the Bitget hot wallet security incident.

What the Binance hack reveals about cryptocurrency exchange security

The Binance hack demonstrates that securing cryptocurrency wallets requires more than protecting private keys.

Exchanges depend on multiple connected systems to process withdrawals, manage permissions, and authorize blockchain transactions. A compromise in one of these systems can potentially expose funds even when the underlying private keys have not been directly stolen.

The incident raises several important security concerns:

• Employee device security: A compromised developer or DevOps laptop can become an entry point into critical company infrastructure.
• Restricted service permissions: Internal applications should only have the permissions necessary to perform their specific tasks.
• Transaction authorization: Exchanges need additional verification to prevent compromised services from initiating unauthorized withdrawals.
• Cross-chain monitoring: Unusual transfers across multiple blockchain networks should trigger immediate security responses.
• Industry coordination: Cooperation between exchanges, blockchain analytics firms, and stablecoin issuers can help freeze suspicious assets before they are moved further.

Binance's complete technical post-mortem will be important in determining how the attackers gained access and which safeguards failed.

For now, the incident shows how a compromise involving internal infrastructure can potentially result in billions of dollars in cryptocurrency leaving exchange-controlled wallets.