Binance Hack Explained: How Hackers Stole $6.3 Billion in 20 Minutes

Updated October 30, 2026. This is a live story. The figures come from Binance, TRM Labs and on-chain data, and they may still change.

Binance was hacked on Thursday, October 29, 2026. At 20:05 UTC, money started leaving Binance's wallets. XRP went first, then Solana, then 18,270 bitcoin in a single block, then a stablecoin wallet on Tron, then Ethereum. About 20 minutes later, most of it was gone.

The tally: ≈$6.36 billion across ten blockchains, according to blockchain analytics firm TRM Labs. Binance's own estimate is "around $6.3B." That's about four times the previous record, the $1.5 billion Bybit hack of February 2025. No crypto theft has ever been bigger.

Below is how it worked, with the technical detail left in and no PR gloss. Along the way you can replay the heist, try the attacker's main trick yourself, follow the money, and test whether you'd have fallen for the bait.

Binance hack: the short version

• The way in: Binance says a DevOps engineer's laptop was compromised. From it, the attacker reached a service container that could submit withdrawals.
• No keys stolen: Binance says no private key leaked. The attacker didn't need one, because Binance's own systems signed for them.
• The trick: On Ethereum, 50 pre-signed EIP-7702 authorizations turned a $2.5B hot wallet into a remote-controlled sweeper.
• The scale: ≈$6.36B from wallets on ten chains, most of it in about 20 minutes.
• The clawback: ≈$2.7–3B frozen, almost all of it stablecoins. About $2.4B in ETH and BTC is out of anyone's reach.
• Who: TRM Labs attributes it with high confidence to TraderTraitor, North Korea's elite crypto-theft unit. Binance hasn't named anyone.
• Customers: Binance says it will cover every loss from its SAFU fund and company money. Withdrawals are paused, and Binance expects them back within 48 hours of its Oct 30 update.

Binance hack timeline: replay it minute by minute

How was Binance hacked?

In four steps: one compromised laptop, two days of rehearsals, a signature trick on Ethereum, and a simultaneous drain on ten chains.

Step 1: The way in was one laptop

Binance's preliminary finding is that the incident "may involve a compromised DevOps engineer's laptop," which "allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions."

Here's what that means:

• DevOps engineers run the machinery that keeps an exchange online: servers, deployments, internal services. Their laptops hold the access to all of it.
• A service container is one small piece of that machinery: a packaged program on Binance's servers that does a single job. This one could submit withdrawals.
• A hot wallet is an exchange's always-online wallet that pays customer withdrawals automatically. It has to stay online and keep signing, or nobody gets paid.

Binance also says it found "no evidence that any wallet private key had leaked." That sounds reassuring, but it's the most alarming line in the story. The attacker didn't steal any keys. They got into the system that requests signatures, and Binance's infrastructure signed what they sent. The 11 bitcoin transfers, for example, all carried valid Binance signatures and looked like ordinary withdrawals on the blockchain.

TRM Labs reads it the same way. Its assessment is that the attacker gained the ability to make Binance's hot-wallet signing system sign transactions across chains, possibly through time-limited access or a request-based signing service. That explains how one attacker hit XRP, Bitcoin, Tron, Solana and Ethereum within minutes. Those chains have nothing in common except that Binance signs on all of them.

Binance hasn't yet said how the laptop was compromised, how the container got the power to request withdrawals that large, or why nothing stopped billions from flowing to fresh addresses in minutes.

Step 2: Two days of rehearsals

This wasn't a smash-and-grab. The on-chain trail shows careful prep:

1. Oct 28, morning: Three small withdrawals from the Tornado Cash mixer fund a new "operator" wallet. That pays for transaction fees with money that can't be traced back.
2. Early Oct 29: The operator deploys the first version of the attack code and tests it on two wallets of its own.
3. About four hours before the theft: A final rehearsal on a third test wallet. The test money is sent back to the operator.

TRM notes the same pattern in Bybit (2025) and KelpDAO (April 2026): small mixer withdrawals, staging well in advance, and signatures obtained ahead of time and fired in one burst.

Step 3: The 50-signature trick (EIP-7702)

The cleverest part of the heist was on Ethereum, and it used a feature that has only existed since May 2025.

EIP-7702, part of Ethereum's "Pectra" upgrade, lets a normal wallet sign an authorization that says, in effect, "from now on, run this smart contract's code when someone talks to me." It was designed to give everyday wallets smart features like batched transactions and sponsored fees. The downside is that one signature can hand control of a wallet's behavior to someone else's code.

There's a catch, though. Each authorization is tied to the wallet's nonce, the running count of transactions it has sent. It only works if that number matches at the moment it executes. Binance's hot wallet, known on-chain as "Binance 14," was busy paying out customer withdrawals, so its nonce kept climbing. Sign one authorization for nonce #N, and by the time it lands the wallet might be at #N+7. The signature is then worthless.

The attacker's fix was to sign 50 of them, one for every nonce from 18,914,775 to 18,914,824. Wherever the counter happened to be when the transaction landed, one of the 50 would fit.

At 20:20:59 UTC, one Ethereum transaction carried all 50. One matched. Binance 14 was now delegated to an unverified contract with a sweep() function that only the attacker's operator address could call. The function moved out ETH and every ERC-20 token and kept 1 ETH back for fees.

About 3 minutes 24 seconds later, the sweep ran: 167,464 ETH and 63 tokens, including 1.615 billion USDT. That's roughly $2.5 billion. Binance 14 was also the executor of a Binance smart account, so the attacker used it to pull out another 823 million USDC.

Try it yourself:

Two details stand out. First, Binance's signing system produced 50 delegation authorizations for a payout wallet. A wallet whose only job is paying withdrawals has no reason to delegate itself to a contract, ever. Second, a delegation like this stays in place until someone removes it, so later deposits to Binance 14 could have gone straight to the attacker. Binance says it has since revoked it.

Step 4: Ten chains in one evening

EIP-7702 only exists on Ethereum-style chains. Everywhere else, the attacker just had Binance sign normal transfers. That's the clearest sign the signing pipeline itself was compromised:

• 20:05–20:09 · XRP Ledger: Five Binance wallets send 233.46 million XRP (≈$296M) to one address. Each is left with the minimum balance the ledger allows.
• ~20:10 · Solana and Optimism: 970,500 SOL (≈$96M), plus the Optimism wallet. Arbitrum and Base were hit too, for ≈$39M across the three.
• 20:20 · Bitcoin: A hot wallet sends 18,270 BTC (≈$1.47B) in 11 transactions, all in block 973,732. In the same block the coins are split into 1,000 BTC pieces, a technique called a "peel chain." They end up in 19 wallets: 17 hold exactly 1,000 BTC, one holds 832.5 and one holds 437.7.
• Within two minutes · Tron: 612.7 million USDT and 46.4 million TRX (≈$628M).
• From 20:20:59 · Ethereum: The 50-signature trick and the $2.5B sweep, then more sweeps at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56. A second Ethereum hot wallet sent 28,006 ETH, 55.7M USDT and 25.9M RLUSD as ordinary signed transfers. Ethereum total: ≈$3.79B.
• 23:05 · Second wave: Avalanche (≈$28M) and Polygon (≈$10M), more than two and a half hours after the first hit.

For scale, the 18,270 BTC alone is about 2.5 times the 7,000 BTC Binance lost in 2019, when bitcoin traded below $5,000.

How much was stolen, and how much was frozen?

About $6.36 billion left Binance's wallets. Within hours, roughly $2.7–3 billion of it was frozen. This is where the haul shrank, and it shows how much crypto has changed since the Mt. Gox days.

Stablecoins aren't like bitcoin. USDT, USDC, RLUSD and USD1 are issued by companies that control the token contracts. Those companies can blacklist an address so the tokens in it can't be spent, and they moved fast:

• 21:01 UTC · Tether froze 971.1M USDT in the main receiving wallet, 37 minutes after the main sweep. More freezes on Ethereum, Tron, Avalanche and Polygon took Tether's total to ≈$1.77B.
• 21:04 · Circle froze 823M USDC, working with law enforcement.
• 22:01 · Ripple froze 40.5M RLUSD, after the attacker had already sold 48M on decentralized exchanges.
• 22:10 · World Liberty Financial froze 27.8M USD1.
• 00:08 Oct 30 · Arbitrum's Security Council force-moved 8,426 ETH and 74.6M ARB (≈$30M) out of the attacker's wallet.
• Aave froze the affected markets, and First Digital froze the stolen FDUSD.

By 00:30 UTC, TRM counted ≈$2.7B frozen. Binance's later figure is ≈$3B.

Now look at what didn't get frozen. ETH and BTC have no issuer, so no company can blacklist them. They can only be stopped when they pass through an exchange, OTC desk or swap service that cooperates. That's why the attacker rushed to turn stablecoins into ETH, and why about $2.4B in ETH and BTC is currently beyond everyone's reach.

Where is the stolen crypto now?

Within hours, the attacker was turning freezable money into unfreezable money and paying a steep price for speed:

• ≈325M USDT was sold to market makers through UniswapX and similar intent-based systems for ≈122,300 ETH. That's about $2,650 per ETH while the market price was $2,300–2,350, a haircut of more than 10%. The other 175M USDT from that batch was frozen before it could move.
• 60M USDT was deposited on Aave as collateral to borrow ≈19,760 ETH. The attacker left with the ETH and left the freezable stablecoins behind.
• 300M USDT went into JustLend on Tron. Another 200M went through hop wallets and was swapped on Uniswap, and 30M of that got frozen.
• 48M RLUSD was sold on DEXs in the 20 minutes before Ripple froze the rest.

At TRM's cut-off, the attacker held more than 420,000 ETH and 18,270 BTC. As of early Friday, CoinDesk reported that none of the 19 bitcoin wallets had sent a single coin. The only activity was strangers sending them dust worth a dollar or two.

The next stage is predictable: cross-chain bridges, swap services and OTC brokers. After Bybit, the same unit took about 10 days to turn its stolen ETH into bitcoin.

Who hacked Binance? North Korea's TraderTraitor

TRM Labs attributes the heist with high confidence to TraderTraitor, a North Korean state hacking unit usually counted as part of the Lazarus Group. It bases that on both on-chain and off-chain intelligence. Binance hasn't named anyone and says it's working with law enforcement to "confirm the identity of these criminals." Pyongyang has denied similar accusations before.

If the attribution holds, it fits a long pattern:

• Bybit, Feb 2025: $1.5B. A developer machine at Bybit's wallet provider, Safe{Wallet}, was hacked. The signing screen was tampered with, and Bybit's signers approved what looked like a routine transaction. The FBI attributed it to TraderTraitor.
• DMM Bitcoin, May 2024: ≈$308M. It started with a fake LinkedIn recruiter who sent an employee at DMM's wallet vendor a "pre-employment coding test." The FBI and Japanese police attributed it to TraderTraitor.
• Ronin, Mar 2022: $625M. An engineer opened a fake job offer, and the attackers got validator keys from there. The FBI attributed it to Lazarus.
• KelpDAO, Apr 2026: ≈$292M. The bridge's verifier infrastructure was poisoned. LayerZero tied it to TraderTraitor with "preliminary confidence."

The playbook barely changes: get one person with access to run your code. Then wait, rehearse, and sign everything in one burst, faster than humans can react. Binance hasn't said how its engineer's laptop was compromised, but fake recruiters, booby-trapped coding tests and malicious software packages are this unit's documented favorites.

The biggest crypto hacks in history

#	Hack	Date	Stolen (value at the time)	North Korea?
1	Binance	Oct 2026	$6.36B	Yes (TRM Labs)
2	Bybit	Feb 2025	$1.5B	Yes (FBI)
3	Ronin Network	Mar 2022	$625M	Yes (FBI)
4	Poly Network	Aug 2021	$611M	No (mostly returned)
5	BNB Chain bridge (Binance)	Oct 2022	$570M	Unconfirmed
6	Coincheck	Jan 2018	$530M	Unconfirmed
7	Mt. Gox	2011–2014	~$450M	No
8	DMM Bitcoin	May 2024	$308M	Yes (FBI)
9	KelpDAO	Apr 2026	$292M	Yes (preliminary)

Tap through the interactive version, and flip on the North Korea filter:

Has Binance been hacked before? (2018, 2019, 2022)

• 2018, an attempt that failed: Attackers used API keys phished from Binance users to pump Viacoin from those users' accounts. Binance's risk system tripped, withdrawals froze and the trades were reversed. Nothing was lost.
• May 2019, 7,074 BTC (≈$40M): Hackers collected user API keys and 2FA codes through phishing and malware, then took 7,074 BTC from the hot wallet in one transaction. The SAFU fund, Binance's emergency reserve set up in 2018, covered it. Then-CEO Changpeng "CZ" Zhao floated asking miners to roll back the Bitcoin blockchain, then dropped the idea.
• Oct 2022, 2M BNB (≈$570M) minted: A bug in how the BNB Chain bridge checked proofs let an attacker forge one and mint 2 million BNB from nothing. Validators halted the whole chain. Binance put the amount that got away at $100–110M.
• Oct 2026, ≈$6.36B: Binance's own signing pipeline.

Each attack hit a layer closer to the core: first user accounts, then user credentials, then bridge code, and now the machinery the exchange uses to move its own money.

Binance withdrawals suspended: what happens now

Binance says customers won't lose money. It will cover losses from the SAFU fund and company funds. CZ, who stepped down as CEO in 2023 but is still a major shareholder, posted "User funds are SAFU!" Binance.US says it wasn't affected.

Withdrawals: Binance paused withdrawals after the hack. On Oct 30, co-CEO Yi He said deposits are working normally and that Binance expects to restore withdrawals within 48 hours while it works on "the withdrawal service and related address controls."

Markets: Bitcoin fell more than 3% to around $77,400, and ETH, BNB, XRP and SOL fell slightly more. Liquidations hit $1.5 billion. Standard Chartered's Geoffrey Kendrick wrote that he suspects "the negative price action still has some way to go."

The questions Binance still has to answer:

1. How was the DevOps laptop compromised?
2. Why could one service container request withdrawals on ten chains?
3. Why did the signing system produce 50 EIP-7702 delegations for a payout wallet?
4. Why didn't a rate limit or anomaly alarm stop billions moving to brand-new addresses in 20 minutes? Binance's risk system did catch the 2018 attempt.
5. Can anyone launder 18,270 BTC with the whole industry watching?

Could you spot the bait? (quiz)

We don't know what got the engineer. We do know what this crew usually sends. Try it:

Is Binance safe now? What to do if you have money there

• Don't claim anything. Binance says it will cover losses itself. Any email, DM or website offering "SAFU compensation," "refund verification" or "wallet sync" is a scam, and a wave of them is coming.
• Trust only binance.com and the official app. Binance itself has warned users about unofficial links, messages and requests for account details.
• Don't rush when withdrawals reopen. Double-check every address, and turn on the withdrawal address whitelist.
• Use an authenticator app or a passkey for 2FA, not SMS.
• Remember the lesson of every exchange hack: a balance on an exchange is an IOU. It isn't insured like a bank deposit, and refunds are up to the exchange. For long-term holdings, a hardware wallet you control (and whose screen you actually read before signing) takes you out of the biggest target in crypto.

Binance hack FAQ

Was Binance hacked?

Yes. On October 29, 2026, attackers drained Binance hot wallets on ten blockchains. Binance confirmed a security incident with an estimated impact of about $6.3 billion and paused withdrawals.

How much was stolen in the Binance hack?

About $6.3 billion by Binance's estimate, or $6.36 billion by TRM Labs' on-chain count. That includes ≈$3.79B on Ethereum, 18,270 BTC (≈$1.47B), ≈$628M on Tron and ≈$296M in XRP. Roughly $2.7–3 billion has been frozen.

How was Binance hacked?

Binance says a DevOps engineer's laptop was compromised. That gave the attacker access to a service container that could submit withdrawals, which Binance's own systems then signed. On Ethereum, the attacker also used 50 pre-signed EIP-7702 authorizations to take over a $2.5 billion hot wallet.

Who hacked Binance?

TRM Labs attributes the hack with high confidence to TraderTraitor, the North Korean state hacking unit the FBI blamed for the 2025 Bybit hack. Binance hasn't publicly named the attackers.

Will Binance users get their money back?

Binance says it will cover all losses from its SAFU fund and company funds, so customers shouldn't need to do anything. Ignore any message asking you to "claim" compensation. It's a scam.

Are Binance withdrawals suspended?

Binance paused withdrawals after the hack. On October 30 it said deposits were working normally and that it expected to restore withdrawals within 48 hours. Check the official Binance app or website for the current status.

Is Binance safe to use now?

Binance says customer losses will be covered and that it is working on its withdrawal and address controls. The bigger lesson is that any exchange balance is an IOU. Keep only what you actively trade on an exchange, and hold the rest in a wallet you control.

Is this the biggest crypto hack ever?

Yes. At about $6.3 billion, it's roughly four times the previous record, the $1.5 billion Bybit hack of February 2025.

Cleus is an uncensored AI agent that searches the web live, so it can tell you what's changed since this was written.

Sources

• TRM Labs: North Korea steals $6.36 billion from Binance in the largest hack in history
• CoinDesk: Binance hacker splits $1.4 billion of bitcoin into 19 wallets that no one can freeze
• CoinDesk: $6 billion Binance hack sends bitcoin, ether tumbling
• crypto.news: How one wallet trick led to a $6.3 billion breach
• NBC News: Binance targeted in $6.3 billion crypto heist, the largest ever
• TechCrunch: Binance pauses withdrawals as hackers suspected of stealing billions
• U.Today: Binance reveals when it will resume withdrawals
• Immunefi: Binance Bridge hack analysis, October 2022