Imagine waking up to discover that approximately $6.3 billion in cryptocurrency has disappeared from the operational wallets of the world's largest cryptocurrency exchange. Even more surprising, the exchange says there is no evidence that its wallet private keys were leaked.
That is the extraordinary situation Binance is facing following a major security incident on October 29, 2026. The attack resulted in unauthorized withdrawals from the exchange's hot wallets across multiple blockchain networks. Binance has promised to cover the financial losses, while blockchain investigators have uncovered evidence of a sophisticated operation involving compromised signing authority and an unusual use of Ethereum's EIP-7702 feature.
But there is a much bigger question behind the headline: how can hackers authorize billions of dollars in cryptocurrency transfers without necessarily extracting the private keys themselves?
This investigation examines the available evidence, explains the technology behind the Ethereum transactions, and explores what the incident reveals about the security of centralized cryptocurrency exchanges.
- What Happened to Binance?
- The Timeline of the Attack
- Why Hot Wallets Are Vulnerable
- The Suspected Entry Point
- How EIP-7702 Became Part of the Attack
- How Hackers Could Act Without Leaking Private Keys
- Why Multiple Blockchains Were Affected
- Who Is Behind the Binance Hack?
- How Much Money Was Frozen or Recovered?
- Are Binance Customer Funds Safe?
- What the Incident Reveals About Crypto Security
- What Binance Users Should Do
- Conclusion
- Frequently Asked Questions
1. What Happened to Binance on October 29, 2026?
On October 29, Binance experienced a major security incident involving unauthorized cryptocurrency withdrawals from its operational hot wallets.
In its official security update published on October 30, Binance confirmed that the incident began at approximately 20:05 UTC on October 29. The company estimated the total financial impact at approximately $6.3 billion worth of digital assets.
Independent blockchain investigations subsequently identified suspicious transfers involving ten blockchain networks. These included Ethereum, Bitcoin, Solana, Tron, XRP Ledger and several Ethereum-compatible networks.
The scale and speed of the transfers made this one of the most significant cryptocurrency thefts ever reported.
| Incident detail | Available information |
|---|---|
| Incident date | October 29, 2026 |
| Estimated financial impact | Approximately $6.3 billion |
| Target | Binance operational hot wallets |
| Blockchain coverage | Ten networks |
| Frozen assets | Approximately $3 billion, according to Binance |
| Customer compensation | Binance says it will cover the losses |
| Investigation status | Ongoing as of October 30 |
Sources: Binance Security Incident Update #2 and TRM Labs' blockchain investigation.
2. The Timeline: How Quickly Did the Attack Unfold?
One of the most disturbing aspects of the incident is how quickly the attackers moved funds across multiple networks.
According to TRM Labs, approximately $6.36 billion left Binance-associated wallets, with most of the transfers occurring within roughly 20 minutes.
Hypernative's blockchain investigation provides additional details about the preparation and execution of the attack.
- October 28: The attacker's operational wallet received funding through Tornado Cash, according to Hypernative's analysis.
- October 29, earlier hours: The attacker prepared and tested a malicious sweeper smart contract.
- Approximately 20:05 UTC: Suspicious outflows began across Binance-associated wallets.
- Approximately 20:20 UTC: An Ethereum hot wallet was delegated to attacker-controlled code through an EIP-7702 authorization.
- Approximately 20:24 UTC: The delegated wallet executed a major transfer involving ETH and numerous tokens.
- October 30: Binance confirmed the scale of the incident and announced emergency security measures.
These timestamps are based on independent blockchain analysis rather than a completed Binance forensic report. They help reconstruct the visible transactions, but do not establish every step of the attacker's access to Binance's internal systems.
3. Why Are Cryptocurrency Exchange Hot Wallets Vulnerable?
To understand the Binance incident, it helps to understand how a major cryptocurrency exchange stores and moves digital assets.
Exchanges generally use different wallet environments to balance security and operational efficiency.
Hot wallets: The operational accounts
Hot wallets are connected to online infrastructure. They allow exchanges to process withdrawals and other transactions without waiting for manual access to offline storage.
They are essential for an exchange that handles thousands of transactions, but their connectivity creates a larger potential attack surface.
Cold wallets: The isolated storage
Cold wallets are kept offline or isolated from ordinary internet-connected systems. They are designed to reduce exposure to remote attacks.
Think of an exchange as a financial institution with two storage environments. A secure vault holds assets in a more isolated environment, while operational accounts handle everyday transfers.
The operational accounts must communicate with software, internal services and signing infrastructure. Those connections create security dependencies that attackers may attempt to exploit.
The Binance incident illustrates why protecting the wallet itself is not enough. The infrastructure surrounding the wallet also needs strong security controls.
4. The Suspected Entry Point: Compromised Internal Infrastructure
Binance's first public investigation update suggested that an attacker may have compromised a laptop belonging to a DevOps engineer.
DevOps engineers work with the systems that connect software development, deployment and production environments. Their responsibilities can involve access to sensitive infrastructure.
According to Binance's initial explanation, the compromised environment may have allowed the attacker to access an internal service container and submit unauthorized withdrawal transactions.
However, the second Binance update published on October 30 introduced an important qualification: the subsequent investigation had uncovered additional breach points.
This means the employee laptop should be treated as an initial suspected entry point, not as a complete or definitively proven explanation of the attack.
Why would an employee's computer matter?
Consider a simplified example.
- An employee's computer becomes compromised through an unknown attack method.
- The attacker gains access to credentials, sessions or internal connectivity available from that environment.
- The attacker reaches an internal service responsible for processing operational requests.
- The attacker abuses the available permissions to submit unauthorized transaction requests.
- The wallet signing infrastructure produces valid blockchain signatures for transactions that should never have been approved.
This is an illustrative attack chain, not a confirmed reconstruction of Binance's internal systems.
The important concept is that an attacker does not always need direct access to a cryptocurrency wallet interface. Compromising a trusted system that communicates with the wallet may provide another route to unauthorized transactions.
5. How Did Ethereum's EIP-7702 Become Part of the Binance Attack?
This is where the incident becomes particularly interesting from a blockchain security perspective.
Independent researchers identified the use of EIP-7702 in the Ethereum portion of the attack.
EIP-7702 is an Ethereum improvement proposal introduced with the Pectra upgrade. It allows a traditional externally owned account, or EOA, to delegate execution to code deployed at another address.
In simpler language, an ordinary Ethereum wallet can be authorized to execute smart-contract code while retaining its underlying account identity.
Why was EIP-7702 created?
The feature was designed to make Ethereum accounts more flexible and support more advanced wallet functionality.
It can help enable features such as improved transaction experiences and account functionality that would otherwise require more complicated wallet architectures.
However, delegation is security-sensitive. The Ethereum documentation warns that delegated code can have extensive access to the account's assets and operations.
How was the feature reportedly abused?
Hypernative's investigation identified an attacker-controlled smart contract known as a sweeper. The attackers reportedly used EIP-7702 to delegate a Binance Ethereum hot wallet to this contract.
The sweeper was designed to move assets out of the wallet under the attacker's control.
Hypernative reported that the attacker submitted 50 authorization entries covering consecutive wallet nonces. One authorization matched the wallet's actual nonce and took effect.
Why prepare 50 authorizations?
Ethereum accounts use a transaction counter called a nonce. An authorization must satisfy the relevant nonce conditions to be accepted. Preparing multiple consecutive possibilities can account for changes in the account's transaction activity.
Once the delegation was established, the attacker could execute the malicious contract's code in the context of the affected wallet.
Hypernative reported that a subsequent transaction transferred approximately 167,464 ETH and 63 different tokens, including around $1.61 billion in USDT.
For technical details, see the official EIP-7702 specification and Hypernative's incident analysis.
6. How Could Hackers Steal Funds Without Leaking Private Keys?
This is arguably the most important lesson from the entire incident.
When people hear about a cryptocurrency wallet hack, they often imagine that an attacker stole its private key or seed phrase.
That is one possible attack method, but it is not the only way to compromise a wallet's security.
Understanding the difference
A private key is a cryptographic secret that allows its holder to authorize transactions. In many exchange environments, however, employees and applications do not directly handle raw private keys whenever a transaction needs to be processed.
Instead, dedicated signing infrastructure performs cryptographic operations according to permissions and internal procedures.
This creates an important distinction:
- Private-key theft: The attacker obtains the underlying cryptographic secret.
- Signing-system compromise: The attacker gains unauthorized access to the infrastructure or process that can request or produce valid signatures.
- Authorization abuse: The attacker obtains a valid authorization for an operation that the wallet owner never intended to approve.
Imagine a secure building where a special electronic badge is required to open the vault.
An attacker might steal the badge. But another possibility is compromising the access-control system that approves entry. The badge itself may remain secure while the security process is being abused.
The same general principle applies to cryptocurrency custody.
Hypernative's blockchain analysis found that the transactions were authorized using Binance-controlled wallet keys. EIP-7702 authorization itself requires a valid signature from the account's authority.
Therefore, the available evidence points to a compromise of signing access or authorization, rather than an ordinary smart-contract vulnerability.
Binance says it has found no evidence that wallet private keys were leaked. That statement should not be interpreted as proof that the signing process was never compromised.
The precise method by which the attackers obtained the ability to generate or use the required signatures remains subject to Binance's full forensic investigation.
7. Why Were Multiple Blockchain Networks Affected?
The attack was not limited to Ethereum.
TRM Labs identified suspicious movements involving ten blockchain networks. Hypernative also reported that wallets on several networks transferred assets through ordinary signed transactions.
This distinction is extremely important.
EIP-7702 is an Ethereum-specific mechanism. It cannot independently explain withdrawals involving Bitcoin, Solana or Tron.
The wider pattern suggests that the attackers gained access to a broader operational signing environment capable of authorizing transactions across different networks.
In other words, the incident appears to involve more than one smart-contract mechanism. It raises questions about the security of the exchange's wider transaction authorization infrastructure.
That is why the forthcoming Binance technical post-mortem will be so important.
8. Who Is Behind the Binance Hack?
Another major question concerns the identity of the attackers.
On October 30, Reuters reported that blockchain intelligence company TRM Labs attributed the operation to TraderTraitor, a North Korean state-sponsored hacking group.
TRM said its assessment was based on on-chain and off-chain intelligence and expressed high confidence in the attribution.
TraderTraitor has been associated with sophisticated cryptocurrency theft operations.
However, cybersecurity attribution must be treated carefully. Investigators can examine wallet movements, infrastructure, transaction patterns and similarities with earlier attacks, but these findings do not automatically establish criminal responsibility in a court of law.
It is therefore more accurate to say that TRM Labs attributes the attack to TraderTraitor than to present the group's involvement as an officially proven fact.
Source: Reuters, October 30, 2026.
9. How Much Money Was Frozen or Recovered?
Binance announced that approximately $3 billion in affected assets had been frozen through cooperation with blockchain partners, asset issuers and other industry participants.
This is a significant development, but frozen funds should not automatically be described as recovered funds.
There is an important difference between restricting an asset from moving and successfully returning it to its original owner.
Why can some cryptocurrencies be frozen?
Some stablecoins are issued by centralized companies that can restrict tokens associated with identified addresses under certain circumstances.
For example, issuers of certain stablecoins maintain controls that can freeze specific token balances.
However, Bitcoin and native ETH do not have a central token issuer that can simply freeze any wallet address in the same way.
This makes recovery more complicated when stolen assets are moved into cryptocurrencies without a centralized issuer.
Binance's financial commitment
In its October 30 update, Binance said it had set aside more than $6.34 billion in company funds to cover the incident.
The exchange also stated that approximately $5 billion was already held in the affected token assets, with the remaining assets being acquired through market and over-the-counter channels.
Binance said it would cover the financial impact through corporate funds and its Secure Asset Fund for Users, commonly known as SAFU.
These are important company commitments, but the final financial position should be assessed against subsequent official disclosures and independent verification.
10. Are Binance Customer Funds Safe?
Binance has publicly stated that users will not bear the financial losses associated with this incident.
The company has committed to covering the stolen assets using its corporate treasury and SAFU.
However, users should distinguish between three different issues:
- Company compensation: Binance has promised to cover the financial impact.
- Technical containment: The company has revoked affected authorizations and strengthened security controls.
- Independent verification: The forthcoming Proof of Reserves and technical post-mortem will provide additional information about the company's response.
Binance has also said that withdrawals were temporarily suspended while the company conducted additional security reviews and remediation work. Deposits and other unaffected platform services were reported to remain operational in its October 30 update.
A temporary withdrawal suspension can be an important containment measure during a serious security incident. Nevertheless, customers should follow the exchange's official announcements for the latest service status.
11. What Does the Binance Hack Reveal About Cryptocurrency Security?
The incident highlights a fundamental weakness in how people sometimes think about blockchain security.
Blockchains use cryptography to verify transactions, but the infrastructure responsible for creating and approving those transactions can still be compromised.
There are several important lessons for cryptocurrency exchanges and wallet operators.
1. Protecting private keys is not enough
Keeping private keys inside secure hardware or signing systems is essential, but organizations must also protect every application, credential and process that can request a signature.
2. Employee devices are part of the security perimeter
A compromised workstation can become a gateway into sensitive infrastructure when internal permissions and isolation controls are insufficient.
Companies need strong endpoint security, restricted access, device monitoring and carefully controlled administrative privileges.
3. Signing systems need independent transaction checks
A valid cryptographic signature does not automatically mean that a transaction is legitimate.
Exchanges should evaluate transaction destinations, amounts, unusual behavior and authorization context before releasing assets.
High-value transfers should also be protected by independent approval mechanisms and limits that cannot be bypassed by one compromised internal service.
4. Hot-wallet exposure must be limited
Operational wallets should contain only the funds necessary for normal activity, with additional restrictions for unusual withdrawals.
Automated monitoring and emergency transaction controls can help reduce the impact of compromised infrastructure.
5. New blockchain features require security reviews
EIP-7702 offers useful functionality, but exchanges must carefully evaluate the permissions and risks associated with account delegation.
Wallet operators should prevent unauthorized delegations and monitor changes to account execution behavior.
6. Transparency is essential after a major incident
Users need more than assurances. They need a clear explanation of the incident, evidence of the remediation work and meaningful information about the security improvements introduced afterward.
12. What Should Binance Users Do Now?
Even though Binance has promised to cover the financial impact, customers should remain alert. Major cryptocurrency security incidents frequently create opportunities for phishing and impersonation scams.
Here are practical precautions:
- Visit Binance by entering its official website address directly into your browser.
- Never share your password, two-factor authentication codes or wallet seed phrase.
- Enable an anti-phishing code in your Binance account.
- Review your account activity and withdrawal history.
- Ignore messages promising special compensation or recovery services in exchange for account access.
- Never install software or open attachments from unofficial support messages.
- Follow verified Binance announcements for withdrawal-service updates.
13. Conclusion: The Real Weakness Was Not Necessarily the Blockchain
The October 2026 Binance security incident is a major reminder that cryptocurrency security involves much more than protecting private keys.
The estimated $6.3 billion loss is extraordinary, but the technical details are even more important. Independent blockchain investigators identified an EIP-7702 delegation in the Ethereum portion of the attack, while Binance's preliminary investigation pointed to compromised internal infrastructure and subsequently acknowledged additional breach points.
The available evidence suggests that the attackers abused the systems responsible for authorizing transactions. However, the exact sequence of events and the full root cause remain under investigation.
Binance has promised to cover the losses, reported that approximately $3 billion had been frozen, and committed to publishing a detailed technical post-mortem and updated Proof of Reserves.
For the wider cryptocurrency industry, the message is clear: protecting a private key is only one part of protecting a wallet. Every employee device, internal service, transaction approval mechanism and signing process must also be secured.
The real test for Binance will be demonstrating exactly how the incident happened, showing that the weaknesses have been addressed and providing evidence that its improved security controls can prevent a similar attack.
Ultimately, blockchain transactions can be cryptographically valid while still representing actions that the wallet owner never intended to authorize. That is the security challenge this incident brings into focus.
Frequently Asked Questions
Was Binance hacked in October 2026?
Yes. Binance confirmed a security incident involving unauthorized withdrawals from its hot wallets on October 29, 2026. The exchange estimated the financial impact at approximately $6.3 billion.
How much cryptocurrency was stolen from Binance?
Binance estimated approximately $6.3 billion in stolen digital assets. TRM Labs independently reported approximately $6.36 billion in transfers from Binance-associated wallets.
Did hackers steal Binance's private keys?
Binance said it had found no evidence of a wallet private-key leak. However, blockchain analysis indicated that valid authorizations were used to execute transactions. Compromising signing access is different from extracting the raw private key.
What is EIP-7702 and why is it important?
EIP-7702 is an Ethereum feature that allows an externally owned account to delegate execution to smart-contract code. Hypernative identified its use in the Ethereum portion of the Binance incident. The feature itself is legitimate; the security concern involved malicious delegation and compromised signing authorization.
Who hacked Binance?
TRM Labs attributed the attack to North Korea's TraderTraitor group with high confidence. Reuters reported this assessment on October 30, 2026. The attribution should be treated as an intelligence assessment rather than a final legal determination.
How much of the stolen Binance cryptocurrency was frozen?
Binance reported that approximately $3 billion in affected assets had been frozen through cooperation with blockchain partners and asset issuers. Frozen assets are not necessarily the same as funds already recovered and returned.
Will Binance customers lose their money?
Binance has promised to cover all losses associated with the incident through corporate funds and SAFU. The company also committed to publishing updated Proof of Reserves after remediation.
Is EIP-7702 dangerous for Ethereum wallets?
EIP-7702 is a legitimate Ethereum improvement, not inherently a vulnerability. However, account delegation is security-sensitive because delegated code can access the account's assets and operations. Wallets must carefully control which authorizations users and systems approve.
Can Binance users withdraw their cryptocurrency?
Binance temporarily suspended withdrawals while carrying out additional security reviews and remediation. Its October 30 announcement targeted a phased restoration, subject to successful security checks. Users should consult official Binance announcements for current availability.
How can Binance users protect themselves after the incident?
Users should enable two-factor authentication and an anti-phishing code, review account activity, use official Binance channels and never share passwords, OTP codes or seed phrases.
Sources and Further Reading
This investigation uses official announcements, blockchain-security research and independent reporting. The technical interpretation is subject to revision as additional forensic findings become available.
- Binance – Initial Security Incident Update, October 30, 2026
- Binance – Security Incident Update #2, October 30, 2026
- Hypernative – Inside the $6.3 Billion Binance Hot-Wallet Drain
- TRM Labs – North Korea Steals $6.36 Billion From Binance
- Reuters – Blockchain Analysis Firm TRM Says North Korea Behind Binance Crypto Theft
- Ethereum Improvement Proposal – EIP-7702
- Ethereum.org – Pectra EIP-7702 Guidelines
Disclaimer: This article is for informational and educational purposes only. It is not financial, investment or cybersecurity advice. Cryptocurrency investments involve substantial risk. Incident details may change as investigations progress.
0 Comments