1. Introduction
On 29 October 2026, attackers drained about US$6.3 billion in digital assets from Binance’s hot wallets across ten blockchains in roughly 20 minutes. It is the largest crypto theft on record, well ahead of the roughly US$1.5 billion Bybit hack of February 2025. The FBI attributes the theft to TraderTraitor, a North Korean hacking group. Binance says it will cover all losses itself, and by 2 November it had replaced about 95% of the stolen assets. Customer withdrawals reopened on 1 November.
This case study covers what happened, how the attack worked, how Binance and its partners responded, and what exchanges, regulators and users can take from it. It draws on reporting up to 2 November 2026. The investigation is still open and Binance has promised a fuller root-cause report, so some details may change.
2. Background
Binance is the world’s largest crypto exchange by trading volume. Like most exchanges, it keeps funds in two kinds of wallets: offline “cold” wallets, and internet-connected “hot” wallets that process withdrawals quickly. Hot wallets need constant signing access, which makes them the most exposed part of an exchange.
Binance has been hit before. In May 2019, attackers stole about 7,000 BTC (around US$40 million) from a hot wallet, and the Secure Asset Fund for Users (SAFU), an emergency reserve funded from trading fees, covered the loss. In October 2022, an attacker exploited the BNB Chain bridge and minted 2 million BNB, although that hit blockchain infrastructure and not the exchange itself. Section 10 compares all three incidents.
The 2026 attack also fits an earlier pattern. In February 2025, the FBI blamed TraderTraitor for stealing about US$1.5 billion from the exchange Bybit. It has named the same group in the Binance case.
3. What happened
The drain began on 29 October 2026 at about 4:05 p.m. US Eastern Time on the XRP Ledger, and at about 4:20 p.m. on Ethereum and Bitcoin. In roughly 20 minutes the attackers took about US$6.36 billion from ten blockchains. Ethereum was hit hardest at US$3.8 billion, followed by 18,270 BTC worth about US$1.5 billion. TRON (US$628 million), XRP (US$296 million) and Solana (US$96 million) were also affected. One transaction alone moved more than US$2.5 billion. A second wave hit Avalanche and Polygon at about 7:05 p.m., followed by a final Ethereum transaction at 7:56 p.m.
Binance halted trading and suspended withdrawals. Reporting suggests the attackers began preparing at least 36 hours earlier. The total varies slightly by source: Binance says about US$6.3 billion, Chainalysis about US$6.4 billion and Elliptic US$6.43 billion.
4. How the attack worked
Binance’s account has changed as its investigation has progressed. The steps below follow what the company has said and flag what is still unclear.
Binance’s first finding was that a DevOps engineer’s laptop had been compromised. That gave the attacker access to a service container able to submit withdrawal transactions. Binance has not said how the laptop was compromised.
Binance says it found no evidence that wallet private keys leaked. Security analysts describe the result as a compromise of signing access: the attacker could obtain valid signatures for withdrawals. On 30 October, co-CEO Richard Teng said investigators had found more breach points beyond the laptop, and called it a complex attack.
On Ethereum, the attacker used EIP-7702, part of the Pectra upgrade, which lets an ordinary wallet borrow the code of a smart contract by signing an authorization. The attacker deployed a “sweeper” contract and submitted a transaction with 50 authorizations. Only one matched the wallet’s current nonce, and that one worked: Binance’s hot wallet labelled Binance 14 began running the attacker’s code. Teng said the delegation did not pass through Binance’s normal approval controls. Analysts found no flaw in EIP-7702 itself.
About US$2.5 billion left Ethereum in under four minutes. Hot wallets on other chains signed transfers for the attacker in the same half hour, some of them plain transfers. Teng also said the attackers used a self-destruct mechanism to wipe evidence, which slowed the investigation.
5. Timeline
Times are US Eastern Time unless stated.
Date and time
What happened
29 Oct, about 4:05 p.m.
Drain begins on the XRP Ledger.
29 Oct, about 4:20 p.m.
Ethereum and Bitcoin drains begin. About US$6.36 billion leaves ten chains in about 20 minutes.
29 Oct, 4:24 p.m.
Main Ethereum transaction is processed, with 64 transfers.
29 Oct, 5:01 p.m.
Tether freezes wallets linked to the theft. Circle follows about three minutes later.
29 Oct, 6:06 p.m.
Tether blocks Binance’s hot wallet. Circle does the same at 7:53 p.m.
29 Oct, 7:05 to 7:56 p.m.
Second wave on Avalanche and Polygon, then a final Ethereum transaction.
29 Oct, 8:10 p.m.
Binance removes the attackers’ permissions from its hot wallet.
30 Oct, 1:15 a.m.
Attackers move 17,260 ETH to a new address.
30 Oct
Binance says it will cover all losses and names a compromised DevOps laptop as the preliminary cause. Teng later reports additional breach points and the EIP-7702 delegation.
31 Oct
FBI alert attributes the theft to North Korea. Binance says it has replaced 90% of the stolen assets.
1 Nov
Withdrawals reopen, starting with Ethereum, USDT, USDC and some BNB Chain tokens.
2 Nov
Binance adds more fiat currencies for withdrawal, bringing the total to 28, and says about 95% of the stolen assets are replaced.
6. How Binance responded
Binance first halted trading and suspended withdrawals while it investigated. At 8:10 p.m. on 29 October, about four hours after the drain began, it removed the attackers’ permissions from its hot wallet.
It then worked with partners to freeze stolen assets. Tether, Circle and others froze about US$3 billion of stolen stablecoins, roughly half the total.
The next day Binance said it would cover all losses and that user funds were safe. CEO Richard Teng put it this way: “Binance will absorb the financial impact of the stolen funds, not our users.”
The cover came from the Secure Asset Fund for Users (reported at roughly US$1 billion to US$1.2 billion), the Futures insurance fund, the Bitcoin reserve and the corporate treasury. Binance set aside more than US$6.34 billion and bought tokens to replace what was taken, partly through over-the-counter deals. About 90% was replaced by 31 October and about 95% by 2 November. The remainder is made up of less liquid tokens that take longer to source.
Withdrawals reopened in stages from 1 November, and Binance planned to publish proof of reserves. It reported about US$4.7 billion in withdrawals on the day they reopened. It also warned users about scams, since fake posts claiming a US$150 compensation payment for the withdrawal suspension began circulating within days.
7. How cybersecurity helped contain and investigate the attack
Halting trading and withdrawals and revoking the attackers’ permissions closed their access. The gap between the first drain at about 4:05 p.m. and the permission removal at 8:10 p.m. is the window investigators will look at closely.
Tether and Circle can freeze tokens they issue, and they began within about an hour of the first drain. Elliptic has verified US$2.85 billion as frozen or seized, about 44% of the US$6.43 billion it counts as stolen.
TRM Labs, Chainalysis and Elliptic linked the theft to North Korea through on-chain ties to earlier hacks, including Bybit. The FBI formally attributed it to TraderTraitor on 31 October. It also published Ethereum, Bitcoin and Solana addresses linked to the hack, asked the public for information, and asked THORChain node operators, decentralised finance services and other providers to block addresses tied to the laundering. The US Secret Service said it was working to track, freeze and recover the funds.
On the forensics side, Binance’s investigation moved from a single compromised laptop to multiple breach points, and it had to work around the attackers’ attempt to erase evidence. Binance planned to publish proof of reserves to show that its assets cover customer balances.
8. Laundering and recovery so far
As of 30 October, the attackers had not converted the stolen crypto into cash. The FBI says they are mainly converting it into Ethereum. Chainalysis reports that more than US$500 million moved through intermediary wallets on Tron, spread across more than 1,000 addresses, and then left through services such as Chainflip, Relay, THORChain and NEAR into new wallets on Ethereum and Bitcoin. By 2 November, laundering had spread to Solana.
THORChain paused swaps on ten networks on 31 October after an unrelated Ethereum reorganisation exposed a refund bug. Chainalysis said the pause unintentionally delayed a substantial amount of laundering. One tracker reported that the 18,270 BTC, spread across 19 wallets, had not moved as of 2 November.
Recovery will take time. One security expert told CNBC that a freeze can happen quickly, but returning funds can take months or years. Issuers can freeze stablecoins but not Bitcoin or Ether, so those assets depend on tracing and law enforcement.
9. Impact
Markets reacted fast. Bitcoin fell about 5% to below US$80,000, Ether nearly 6% and BNB nearly 10%. Total crypto market value dropped about 4.6% to US$2.59 trillion, and shares in Coinbase and Robinhood fell. One Fundstrat analyst said the breach did not appear to pose a significant solvency risk to Binance.
For users, withdrawals were unavailable from 29 October until 1 November, with some assets and currencies returning later. Binance says no customer will bear the loss.
Policy reaction has started. Reports say the CFTC is seeking safeguards for crypto exchanges, the industry group Digital Chamber has urged oversight, and Better Markets says the hack exposes gaps in US crypto regulation. President Trump said the US is looking into it.
10. Comparison with Binance’s earlier incidents
May 2019
October 2022
October 2026
Target
Bitcoin hot wallet
BNB Chain bridge (BSC Token Hub)
Hot wallets on ten blockchains
Amount
7,000 BTC (about US$40 million)
2 million BNB minted (about US$566 million); roughly US$100 million to US$130 million moved out
About US$6.3 billion
Method
Phishing, malware, stolen API keys and 2FA codes
Forged proof exploiting a verification flaw
Compromised DevOps access, valid withdrawal signatures, EIP-7702 delegation on Ethereum
Attribution
Not publicly established
Not publicly established
FBI: North Korea’s TraderTraitor
Response
Withdrawals halted about eight days; SAFU covered the loss
Chain halted about seven to eight hours; flaw patched
Trading halted; about US$3 billion frozen; Binance replaced about 95% from its own funds; withdrawals reopened after about three days
The attack surface has moved each time. In 2019 attackers went after user credentials, in 2022 after protocol code, and in 2026 after the exchange’s own signing infrastructure and the people who run it. The scale grew with it, from tens of millions of dollars to billions.
11. Lessons learned
The attacker did not need a stolen private key, only valid signatures from an internal service. That makes signing infrastructure the most valuable asset an exchange has. Services that can request withdrawals should be isolated, and no single compromised machine should be able to bypass approvals.
A single DevOps laptop was the first foothold Binance reported. Monitored, locked-down devices, short-lived access and hardware-backed credentials limit what one machine can reach.
EIP-7702 had no flaw, but it let the attacker turn a hot wallet into a sweeper, and Teng said the delegation skipped normal approvals. Exchanges should treat any unexpected delegation on a hot wallet as a high-severity alert.
About US$6.3 billion left in 20 minutes. Per-transaction and per-hour limits, delays on large withdrawals and automatic circuit breakers give defenders time to react.
Tether and Circle acted within about an hour, and roughly half the stolen value was frozen. That only works for stablecoins, so exchanges need pre-agreed contacts and playbooks with issuers before a crisis.
SAFU alone could not cover a loss of this size, and Binance also drew on its other funds and treasury. Reserve funds should be sized to the risk.
Binance’s explanation changed from one laptop to several breach points. Updating openly helped, but early statements that customer funds were not targeted were questioned after CoinDesk found the affected wallets had appeared in Binance’s reserve data.
Fake compensation posts appeared within days of the hack, so scam warnings to users should go out early.
12. What is still unknown
- How the DevOps laptop was compromised, and who or what else was breached.
- The full sequence of events. Binance has promised a comprehensive report.
- How much of the stolen value can be recovered, especially the Bitcoin and Ether that issuers cannot freeze.
- Whether the affected wallets held assets backing customer balances, as CoinDesk reported, or only Binance’s own funds, as Teng said.
- What regulators will require of exchanges as a result.
13. Conclusion
The hack shows that the weakest point in a large exchange can sit in the people and systems around its keys. A compromised engineer’s laptop and an Ethereum feature used in an unexpected way were enough to move billions of dollars in 20 minutes.
The response limited the damage to customers. Binance stopped the attack, helped freeze about half the stolen value, and replaced most of the rest from its own funds. How the attackers got in, and whether Binance closes those gaps, remains the open question for the next incident.
Sources
Information is current to 2 November 2026 and may change as the investigation continues. Figures differ between sources and are approximate. Sources used: 2026 Binance hack (Wikipedia); CNBC, 30 October 2026; CoinDesk, 30 October 2026; CNN, 1 November 2026; Help Net Security, 2 November 2026; Euronews, 2 November 2026; Crypto Times on EIP-7702; GN Crypto on THORChain; TechFlow on Chainalysis laundering data; CoinCentral on Elliptic figures. Earlier incidents (2019 and 2022) draw on CoinDesk, TechCrunch, The Hacker News, Nansen, Verichains and SlowMist reporting.
