Binance loses $6.36 billion in largest crypto theft as attackers hijack hot wallet signing

Binance is the largest cryptocurrency exchange in the world, controlling roughly 35% of total crypto market share according to the company, and it holds customer coins in wallets it operates itself, processing withdrawals from a small subset that stay connected to the internet. That design is what makes an exchange fast, and it is also what makes it a single, enormous target.

On Thursday 29 October 2026, that machinery was turned against its owner. Funds began leaving Binance wallets at 20:05 UTC, and within roughly 20 minutes an attacker had moved about $6.36 billion across ten blockchains, according to TRM Labs. Elliptic's on-chain analysis puts the loss at $6.43 billion and describes it as almost certainly the largest theft of any kind in history.

The scale is hard to place. It is more than four times the $1.46 billion stolen from Bybit in 2025, the previous record for a crypto heist, and it sits far above older incidents such as the $610 million Poly Network exploit and the $540 million Ronin Network breach. Binance itself estimated the impact at around $6.3 billion, a figure that shifted as the exchange counted frozen balances.

Attribution arrived quickly and pointed in one direction. TRM Labs said it attributes the attack to TraderTraitor, North Korea's elite hacking unit, with high confidence. Elliptic said North Korea-linked actors likely perpetrated the theft. No government has confirmed the attribution, and Binance has not named a culprit.

Key Facts

The mechanics matter more than the headline number. TRM Labs said in a report published on October 29 that preparation began at least 36 hours earlier: an operator wallet received three small withdrawals from Tornado Cash starting the morning of 28 October, attack code was deployed early on 29 October, tested on two wallets, rehearsed on a third, and then installed on a Binance hot wallet four hours after the rehearsal.

The first theft came on the XRP Ledger between 20:05 and 20:09 UTC, when five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each at its minimum balance. At 20:20 UTC a Binance Bitcoin hot wallet sent 18,270 BTC, worth about $1.47 billion, and began splitting it into round 1,000 BTC and 100 BTC pieces in the same block, a pattern known as a peel chain. Ethereum accounted for the largest single pool: about $3.79 billion, including 200,630 ETH and 185 other tokens, among them 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.

On Ethereum the attacker did not phish a signature. It abused EIP-7702, a feature introduced in the May 2025 Pectra upgrade. At 20:20 UTC a single transaction carried 50 authorisations, each signed by the Binance 14 hot wallet and each valid at a different nonce, which guaranteed that one would match the wallet's moving transaction count and delegate control to a sweeper contract accepting instructions only from the operator. Three minutes 24 seconds later the operator sent the entire balance to an attacker address: 167,464 ETH and 63 tokens including 1.615 billion USDT. The delegation stayed in place and was swept again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC, and it let the attacker pull 823 million USDC from a separate Binance smart account.

On the other chains, funds moved through ordinary signed transfers in the same half hour. In TRM's assessment that points to compromise of Binance's hot wallet signing infrastructure rather than a single phished approval. Elliptic compares the case to Bybit, where the infrastructure and the people around the wallets were compromised, not the cryptography.

The response was fast by historical standards. Tether froze 1.18 billion USDT 37 minutes after funds arrived and four more addresses within 17 minutes, Circle froze 823 million USDC three minutes later, and Ripple, World Liberty Financial, Paxos and First Digital froze further stablecoins while Arbitrum's Security Council took emergency action. Elliptic has verified $2.84 billion of frozen funds, 44% of the theft, almost all of it USDT and USDC. TRM counted about $2.7 billion frozen by 00:30 UTC on Friday, and Binance has put its own figure at about $3 billion. Stablecoins were 94% of frozen funds, and nothing taken on Bitcoin, the XRP Ledger, Solana or NEAR could be frozen at all.

Analysis

Before the freezes landed, the attacker converted stablecoins at a loss. Elliptic says about $786 million of stablecoins were swapped into ETH and TRX, with the attacker accepting 12% to 26% losses versus market price to prioritise speed, and 59.9 million USDT was deposited into Aave to borrow 19,762 ETH. The Next Web reported on October 30 that the attacker sold about 325 million USDT for ETH at a discount of more than 10%, and that Aave later froze the affected markets. The willingness to pay that spread is the clearest signal that the operator expected to be chased.

The bigger picture here is that the weakest link in crypto security is no longer the private key. It is the signing pipeline, the software that decides what a key signs, on which chain, and at what nonce. Binance's first account, published on Thursday night, said a compromised DevOps engineer's laptop may have let an attacker into a service container to submit unauthorised withdrawals. By Friday the company had retreated from that single explanation. The Next Web reported on October 30 that Binance's investigation uncovered additional points of breach, that it found no evidence of any wallet private key leak, and that a root-cause report will follow. Co-CEO Richard Teng said the attacker did not simply use one engineer's permissions and it was not a single one-click action.

The attribution carries its own weight. Euronews reported on October 30 that investigators see signs pointing to a North Korean group, and that TRM Labs judged with high confidence that TraderTraitor was responsible, noting the FBI named the same group behind the $1.5 billion Bybit hack in February 2025. Elliptic confirmed that some stolen funds reached the same address as proceeds of the suspected DPRK exploit of Bitget. That is circumstantial but consistent. Chainalysis also tied the attack to the group and estimated $5.912 billion stolen at the time, a reminder that even the loss figure depends on which prices and which snapshot you use.

The numbers also expose how thin the recovery layer is. Roughly $2.7 billion to $3 billion was frozen, which sounds decisive until you notice that the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion that no issuer can touch. Freezing works on tokens with an admin key. It does not work on Bitcoin, and it does not work on ether once it has been moved. The attacker's edge is not cryptographic sophistication at this stage, it is the simple fact that bearer assets settle.

Why It Matters

Binance's promise to cover all losses from its Secure Asset Fund for Users and company funds is the difference between an exchange incident and a market-wide bank run. Euronews reported on October 30 that Binance reserved $6.34 billion to cover the incident and suspended all deposits and withdrawals, with a stated plan to resume withdrawals in 45 hours. The exchange also said it would publish a detailed technical post-mortem and an updated Proof of Reserves after remediation.

Markets moved immediately. The Next Web reported on October 30 that Bitcoin fell below $77,000 for the first time in more than a month on the news, citing Bloomberg. That reaction is about confidence, not about the stolen coins: the coins were Binance's, and the exchange says customers will be made whole.

Regulators now have a concrete case study in why hot wallet concentration and signing infrastructure are systemic risks rather than operational details. A single delegated approval on Ethereum moved $2.53 billion in one transaction, and wallets on nine other chains acted in the same half hour. If one company can be induced to sign its own funds away across ten networks in 20 minutes, then custody rules, key management audits and the EIP-7702 delegation model itself are all back on the table.

Next Up

Binance has promised a root-cause report and an updated Proof of Reserves, and it has engaged law enforcement. The unresolved questions are narrow and technical: how the signing system was reachable, whether the DevOps laptop was an entry point or a distraction, and why EIP-7702 delegations were live on a production hot wallet at all.

The recovery picture will be settled by the assets that cannot be frozen. More than 420,000 ETH and 18,270 BTC remain with the attacker, and the frozen $2.84 billion will only return through issuers and courts. For the industry, the record that matters is not the $6.36 billion headline but the 20 minutes it took to move it.