Record Binance Hack Drains Billions From Hot Wallets

A record Binance hack on October 29, 2026, drained the exchange’s hot wallets, with estimates ranging from about $6.3 billion to $6.43 billion. WIRED reported that hackers began siphoning around $6.3 billion from about 4 p.m. ET, while TRM Labs calculated about $6.36 billion and said most of it left within roughly 20 minutes. Binance says it will cover the losses, and neither the exchange nor any government has confirmed who did it.

How the Binance Hack Drained Hot Wallets

Decrypt put the start at about 4:05 p.m. ET, after U.S. markets had closed. Elliptic’s analysis timed the first transfers at about 20:05 UTC, when five Binance wallets on the XRP Ledger sent 233 million XRP to one attacker address.

Over the next 30 minutes, Elliptic said hot wallets on Solana, NEAR, Base, Optimism, Bitcoin, Tron, Ethereum, Arbitrum and Avalanche were drained. It counted 11 blockchains and a drain over a few hours, including a second wave on Avalanche and Polygon shortly after 23:00 UTC. TRM Labs tracked ten chains and is the firm that said the majority of the stolen crypto left in around 20 minutes.

TRM Labs said preparation began at least 36 hours earlier. Elliptic reported that between 28 and 29 October a new wallet received three 0.1 ETH withdrawals from Tornado Cash, that a sweeper contract was deployed at 15:59 UTC on October 29, and that the attack was rehearsed about four hours before it was used against Binance.

On Ethereum the attacker used EIP-7702, a 2025 feature that lets a wallet delegate to a smart contract. Elliptic said one transaction carried 50 pre-signed authorizations that delegated a Binance hot wallet to an attacker-controlled contract, which three and a half minutes later emptied it of 167,464 ETH and 63 tokens. On other chains, TRM Labs, quoted by SecurityWeek, said the attacker could make Binance’s signing system “sign transactions of its choosing across chains.”

TraderTraitor Claims Binance Has Not Confirmed

SecurityWeek reported that TRM Labs attributed the attack to TraderTraitor with high confidence. Chainalysis CEO Jonathan Levin said he believes TraderTraitor is the likely perpetrator, citing ties to an earlier hack; Chainalysis investigators found proceeds from last month’s Bitget exploit mixed with Binance funds. Elliptic’s article says it is likely that TraderTraitor carried out the theft, but Tom Robinson, the firm’s chief scientist and cofounder, told WIRED that Elliptic has not specifically tied the attack to the group and only sees overlaps.

Robinson told WIRED: “We think North Korea is likely responsible.” He added: “If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.” ZachXBT named the Lazarus Group as the probable attacker, SecurityWeek reported. Binance has not named a suspect.

Its statement to WIRED said: “Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach.” SecurityWeek quoted Binance’s own statement that the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions,” and that “We have found no evidence of any wallet private key leak.”

Decrypt reported that Richard Teng described “a more complex attack process” that “did not simply use one engineer’s permissions.” In a video update reported by Elliptic, Teng said the attack “was not carried out by one person,” and that the EIP-7702 delegation “did not pass through our normal approval controls.” Elliptic also reported that Teng described a self-destruct mechanism that destroyed tooling and traces as it ran. No government has confirmed the attribution, and Decrypt reported that the FBI confirmed it was aware of the incident and coordinating with partners.

Frozen Funds and the Cover Pledge

Elliptic said almost all of the frozen funds are stablecoins that issuers can blacklist, and that stablecoins made up 94% of what it verified as frozen. In an early TRM tally reported by SecurityWeek, Tether had locked roughly 1.77 billion USDT and Circle about 825 million USDC by 00:30 UTC on October 30. Elliptic later verified $2.85 billion frozen or seized, 44% of the theft.

Robinson told WIRED the remaining $3.3 billion “is mostly Bitcoin, Ether, and XRP, which no one can freeze.”

Binance pledged to cover all losses with company funds and its Secure Asset Fund for Users. It set aside more than $6.34 billion, about $5 billion already held in the stolen tokens, including BTC, ETH, BNB, USDC and USDT, and is buying the rest in the market and over the counter. Decrypt reported that Teng stressed customer assets were never touched.

WIRED reported an immediate suspension of deposits and withdrawals. Decrypt later reported that deposits were operating normally and withdrawals stayed paused for a rebuild and retest. Binance aims to restore withdrawals by Sunday and publish a proof of reserves by Monday.

What Signing Failures Mean for IT Teams

The public record describes a compromise of staff access and signing infrastructure, not a break in blockchain cryptography. Elliptic likened the pattern to the Bybit theft, in which North Korean hackers compromised a developer’s machine at wallet provider Safe{Wallet} and manipulated the transaction that Bybit’s signers approved. The points below are analysis for IT teams, not new findings from Binance:

• A privileged engineer laptop can open a withdrawal path even when private keys are not leaked.
• Teng said the EIP-7702 delegation did not pass through normal approval controls.
• Stablecoin issuers can freeze addresses. Bitcoin, Ether and XRP cannot.
• Binance described a withdrawal pause, a reserve of matching tokens and a proof of reserves. It has not yet said what the additional breach points were.