By Thorsten Meyer | October 30, 2026 | ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
At 20:24 UTC on Thursday, 29 October, a single Ethereum transaction emptied one of Binance’s main hot wallets. In one call, 167,464 ETH, 1.615 billion USDT and 62 other tokens moved to a wallet that had not existed a few hours earlier. Blockworks valued that call at roughly $2.5 billion. Over the next three hours, money left Binance wallets on up to ten blockchains.
Binance puts the “estimated total impact” at around $6.3 billion. If that holds, it is the largest crypto theft on record, about four times the $1.5 billion Bybit hack of February 2025. Binance says user funds are safe and that it will cover all losses.
I rebuilt the evening from Binance’s statements, the reports of the blockchain analysts TRM Labs and Blockaid, and the public Ethereum record, which I checked myself. Here is what happened, how the trick worked, and what is still open.
Key takeaways
- What happened: An attacker took over the Binance hot wallet labelled “Binance 14” through an Ethereum feature called EIP-7702 and swept it. In the same window, Binance wallets on Bitcoin, Tron, the XRP Ledger, Solana and smaller networks sent funds to the attacker through ordinary signed transfers, according to TRM Labs.
- How much: It depends on who counted, when and at which prices: at least $5.5 billion (Blockaid, 22:00 UTC), $6.01 billion (Arkham), about $6.36 billion (TRM), about $6.3 billion (Binance). All preliminary.
- How: One transaction carried 50 pre-signed permissions for 50 consecutive transaction numbers of Binance 14. One matched. Only the wallet’s own key, or the system that holds it, can produce such permissions.
- Why, per Binance: A compromised DevOps engineer’s laptop “may” have let the attacker into a “service container” to “submit unauthorized withdrawal transactions”. Binance found “no evidence of any wallet private key leak”. A post-mortem is still to come.
- Frozen: Stablecoin issuers froze roughly $2.5 to 3 billion within hours. Nobody can freeze ETH or bitcoin; TRM counted about $2.4 billion beyond any issuer’s reach.
- Who: TRM Labs attributes the attack “with high confidence” to TraderTraitor, a unit it links to North Korea. Neither Binance nor any government has confirmed that.
- For users: Withdrawals are paused; Binance’s co-CEO expects them to begin resuming within 48 hours of her post on 30 October. Expect scams posing as refunds or support.
Products Worth Considering
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Bose TV Speaker Compact Soundbar with Bluetooth and HDMI-ARC, Black
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The evening, minute by minute
All times are UTC. U.S. outlets such as Blockworks use Eastern Time, four hours behind on 29 October (4:24 PM ET is 20:24 UTC). Items marked “on-chain” I checked myself in the public Ethereum record on the morning of 30 October.
- 28 October: The attacker’s operator wallet receives three small withdrawals from Tornado Cash, a mixing service that hides where money comes from (TRM, Blockworks).
- 29 October, 13:51 to 14:24: The operator tests sweeper code on two small wallets (on-chain; TRM).
- 15:59: It deploys the contract it will later attach to Binance 14, then rehearses with it on a third wallet until 16:47 (on-chain; TRM).
- About 20:05: Outflows from Binance wallets begin on several chains, most within about 20 minutes (TRM).
- 20:20:59: One transaction carries 50 EIP-7702 permissions for Binance 14. One is valid. Binance 14 now runs the attacker’s code (on-chain; Blockaid).
- 20:24:23: The sweep: 167,464 ETH, 1.615 billion USDT and 62 other tokens go to the receiving wallet (on-chain). 24 seconds later, the wallet “Binance 16” sends 28,005.6 ETH to the same address in an ordinary signed transaction (on-chain).
- 20:38:47: 195,460 ETH, roughly $450 million, move on to a brand-new wallet. When I checked on 30 October, it had not sent a single transaction (on-chain).
- 20:41 and 20:59: A Binance smart account controlled by Binance 14, “Hot Wallet 34”, loses 780 million and then 43 million USDC (on-chain).
- 21:18 to 22:56: Circle and Tether announce freezes, then Ripple, World Liberty Financial with BitGo, and Paxos (Blockworks, issuer posts).
- 21:29: Binance on X: “Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.”
- 22:15: Binance: withdrawals “will resume as soon as the security issue is fully resolved”.
- About 23:05: A second wave hits Binance wallets on Avalanche and Polygon (TRM). Sweep calls on Binance 14 continue until 23:56 (on-chain).
- About 23:30: Binance puts the verified frozen total at $2.54 billion (Blockworks, TRM).
- 30 October, 02:23: Binance’s “Security Incident Update”: about $6.3 billion impact, about $3 billion frozen, the laptop finding, deposits and withdrawals suspended.
- 04:17: Co-CEO Yi He: deposits “continue to operate as normal”, withdrawals expected to begin resuming “in the next 48 hours”.
- By the morning of 30 October: Binance 14 no longer runs the attacker’s code. Binance says it “revoked the affected address authorisation” (on-chain; Binance).
Infographic 01 · The evening of 29 October 2026
How billions left Binance in one evening.
From the staging to Binance’s statements, in UTC (ET = UTC − 4 on 29 Oct). “On-chain” items were checked in the public Ethereum record.
- 28 OctOperator wallet fundedTRMThree small withdrawals from the Tornado Cash mixer
- 13:51–16:47Tests and a rehearsalon-chainSweeper code tried on three small wallets; the final contract deployed at 15:59
- ≈ 20:05Outflows begin on several chainsTRMMost within about 20 minutes
- 20:20:59Binance 14 taken overon-chainOne transaction, 50 EIP-7702 permissions, one valid
- 20:24:23The sweepon-chain167,464 ETH, 1.615 billion USDT and 62 other tokens leave in one call. 24 s later: 28,005.6 ETH from Binance 16
- 20:38:47195,460 ETH forwardedon-chainTo a brand-new wallet that had sent nothing when checked on 30 Oct
- 20:41 / 20:59Hot Wallet 34 drainedon-chain780 million, then 43 million USDC from a smart account Binance 14 controlled
- 21:18–22:56The freeze raceBlockworksCircle, Tether, Ripple, World Liberty Financial with BitGo, Paxos
- 21:29Binance’s first statementX“Actively investigating. User funds are completely safe.”
- 22:15Withdrawals haltedXBinance: they resume “as soon as the security issue is fully resolved”
- ≈ 23:05Second waveTRM · on-chainAvalanche and Polygon; sweep calls on Binance 14 continue to 23:56
- 30 Oct 02:23“Security Incident Update”Binance~$6.3B impact, ~$3B frozen, compromised DevOps laptop, no evidence of a key leak
- 04:17Service updateYi HeDeposits “operate as normal”; withdrawals to begin resuming within 48 hours
Sources: Ethereum record, checked by Thorsten Meyer AI on 30 Oct; TRM Labs (as of 00:30 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Binance posts on X, 29 Oct; Yi He, 30 Oct. All figures preliminary.
Powered by Thorsten Meyer AI
How a signed permission emptied a wallet
Think of a hot wallet as a safe with a guard who opens it only for notes signed with the safe’s own key. Since Ethereum’s Pectra upgrade in May 2025, there is a new kind of note, defined in EIP-7702: “From now on, let this program run the safe.” The program stays in charge until the owner signs a new note.
Each note is tied to one transaction number, the nonce. Think of the numbered tickets at a deli counter: a ticket only works when its number is called. Binance 14 was busy, so its number kept moving. Blockaid’s reading: the attacker did not know which number would be current, so they brought 50 consecutive tickets, nonces 18,914,775 to 18,914,824, in one transaction. The network simply skips notes with the wrong number. One was right.
I checked that transaction in the public record. It holds exactly 50 permissions, the nonce range has no gaps, and all 50 point to the same contract. That contract lets only one address, the attacker’s operator wallet, call its sweep function, which moves out ETH and every listed token.
The crucial point: Ethereum accepts such a permission only with a valid signature from the wallet’s own key. So the signatures came from Binance’s side. Either a key leaked, or Binance’s own signing system was made to sign.
Laptop, container, signatures: how the explanations fit
The accounts sound different, but they do not contradict each other.
- Binance says the incident “may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions”, and that it found “no evidence of any wallet private key leak”.
- Blockaid writes that “Binance’s own signing infrastructure, under the attacker’s control, signed an EIP-7702 authorization”, and that eleven Binance hot-wallet keys signed transfers to an address created minutes earlier. Its CEO, Ido Ben-Natan, told Cointelegraph in a preliminary assessment: “We don’t think a key was leaked.” Arkham’s CEO told the same outlet there was not yet enough information to tell.
- TRM Labs notes that on nine chains, Binance wallets sent funds through ordinary signed transfers: “In TRM’s assessment, this points to a compromise of Binance’s hot wallet signing infrastructure.”
- Blockworks adds an argument: whoever holds a key can sign the right number on the spot. Pre-signing 50 suggests someone who had to obtain signatures in advance.
My reading, not confirmed: the pieces fit if the attacker got into the internal service that asks Binance’s signers for signatures. A vault that signs whatever a trusted internal service requests never has to give up its keys. That would explain “no key leak” and valid signatures at the same time. What nobody has explained yet is why a request that hands a wallet to outside code passed Binance’s checks. The post-mortem has to answer that.
Where the money went, and why most of it cannot be frozen
Stablecoins such as USDT and USDC have issuers that can block an address. ETH and bitcoin have no such switch.
- Frozen in place: On 30 October I checked the receiving wallet on the token contracts themselves: 1,175.5 million USDT and 823.0 million USDC sit there, both marked as frozen.
- Issuer freezes: Tether’s CEO reported more than 1.567 billion USDT frozen; TRM later counted about 1.77 billion. Circle froze more than 800 million USDC “in coordination with law enforcement”. Ripple froze about 40.5 million RLUSD, World Liberty Financial 27.8 million USD1 with BitGo, Paxos 1,906.67 PAXG. The Arbitrum Security Council froze about $30 million in ETH and ARB (TRM).
- Moved before the freeze: About 700 million USDT left the receiving wallet first (Blockworks). TRM says around 325 million USDT were sold for ETH through intent-based trading contracts at a price more than 10 percent worse than the market, and 60 million USDT served as collateral to borrow about 19,760 ETH on Aave before Aave froze the affected markets. On Tron, about 300 million USDT moved into DeFi protocols before it could be blocked.
- Out of reach: 18,270 BTC, about $1.47 billion, moved on through chains of ever smaller payments (TRM). As of 00:30 UTC, TRM counted more than 420,000 ETH plus the bitcoin, about $2.4 billion, beyond any issuer’s reach.
Infographic 02 · Where the money went
Stablecoins can be frozen. ETH and bitcoin cannot.
Outflows by chain, the single biggest sweep, and what issuers managed to freeze within hours. All figures preliminary.
Outflows by chain
TRM Labs, valued when taken · total ≈ $6.36B
One sweep, one wallet
Binance 14 at 20:24 UTC · amounts on-chain, dollars per Blockworks
Blockworks values the whole call at roughly $2.5B.
Frozen vs. out of reach
TRM Labs, as of 00:30 UTC on 30 Oct
Binance: $2.54B frozen (≈ 23:30 UTC), “~$3 billion” (02:23 UTC). Arkham: $2.80B frozen, $2.9B still movable (04:20 UTC).
The freeze race
Frozen by issuers (TRM count unless noted)
On 30 Oct the receiving wallet held 1,175.5M USDT and 823.0M USDC, both frozen (on-chain check).
Why the totals differ
Same theft, four counts: cut-off time, chains counted, price used
- At least $5.5B · Blockaid, six chains, as of 22:00 UTC on 29 Oct
- $6.01B · Arkham, nine chains, 20:10 to 23:05 UTC
- ≈ $6.36B · TRM, ten chains, priced when taken (≈ $6.23B at later prices)
- ≈ $6.3B · Binance, “estimated total impact”, 30 Oct 02:23 UTC
Sources: TRM Labs (as of 00:30 UTC); Blockaid (as of 22:00 UTC); Arkham (04:20 UTC); Blockworks reporting (29 Oct, converted from ET); Binance, 30 Oct 2026; Ethereum record, checked by Thorsten Meyer AI on 30 Oct. Bar lengths are proportional within each card.
Powered by Thorsten Meyer AI
Why nobody agrees on the total
Three plain reasons. The cut-off time: the second wave on Avalanche and Polygon came at about 23:05 UTC, after Blockaid’s 22:00 count. The chains counted. And the price: TRM values each transfer at the moment it was taken (about $6.36 billion) and notes the same assets were worth about $6.23 billion a few hours later.
The frozen amount moved the same way: $2.54 billion (Binance, late on 29 October), about $2.7 billion (TRM, 00:30 UTC), “~$3 billion” (Binance, 02:23 UTC). Frozen money still counts as stolen; whether and how it returns is a matter for issuers and law enforcement.
The shock waves
- Binance: Withdrawals halted at 22:15 UTC, Binance Alpha trading suspended (Blockworks). On deposits, Binance’s statements conflict: its 02:23 UTC update lists them as suspended, its co-CEO wrote at 04:17 UTC that they “continue to operate as normal”.
- DeFi: In about three hours, Blockworks logged 29 separate responses. Aave froze markets on its V3 and V4 deployments, Compound paused supply on major markets, others cut limits or paused. Reserve pulled its own RSR liquidity because the haul included about 3.4 billion RSR.
- Markets: BNB fell 6.3 percent in 20 minutes to a low of $691 (Blockworks). Bitcoin fell nearly 5 percent to under $77,000 (AFP, CoinDesk). By about 04:00 GMT on Friday, bitcoin was down only 0.8 percent and BNB up 2.7 percent (AFP). Reporting, not investment advice.
Who did it?
TRM Labs “attributes the attack to TraderTraitor, North Korea’s elite hacking unit, based on robust on and off-chain intelligence”, adding: “We make this judgment with high confidence.” Its reasons: small Tornado Cash funding, staging hours ahead, signatures obtained in advance and used in one burst, a pattern it also saw in the Bybit and KelpDAO thefts. The FBI attributed the Bybit hack to North Korea in February 2025. Chainalysis CEO Jonathan Levin called TraderTraitor the “likely” culprit on X, according to several outlets.
These are assessments by private analytics firms. Binance says it is working with law enforcement “to confirm the identity of these criminals”. No government has confirmed an attribution.
What this means for companies
The lesson is not “store keys better”. On the evidence so far, Binance’s keys may never have left their vault. The weak spot was what the vault agreed to sign.
- Treat delegation signatures like a cold-wallet transfer. Blockaid’s first recommendation: put EIP-7702 permissions under “the same policy controls as a cold wallet transfer”. In practice, a separate approval path with more than one person, and HSM or MPC policies that refuse such requests by default.
- Put the policy at the signer, not the caller. A request from an internal service does not prove it is legitimate. The signer itself should check destination allowlists, cap values per transaction and per hour, and stop transfers to brand-new or mixer-funded addresses.
- Guard the engineers’ machines. One laptop reportedly opened the door. Hardware-backed logins, short-lived credentials, no standing access to signing services, separate admin workstations. We covered the same pattern this week in Attackers Now Go After Your AI Tools.
- Watch your hot wallets for code. Alert on any transaction that installs code on a hot wallet, keep a revocation transaction ready, and keep funds out of addresses whose delegation status is unknown. After a compromise, Blockaid advises removing the delegation before rotating keys, because the delegation belongs to the address, not the key.
- Cut chains of control. Binance 14 controlled Hot Wallet 34, so one takeover cost another 823 million USDC.
- Have the freeze playbook ready. The biggest recovery here came from stablecoin issuers within about two hours. Know your contacts and the evidence they need before you need them.
More on letting software act with your keys: AI Agents Now Hold Our Keys.
What this means for users
- Your balance: Binance says “user funds are safe” and that it will cover all losses “from the SAFU fund and the company’s funds”, with an updated proof of reserves to follow. That is Binance’s statement; outsiders cannot check it yet.
- Withdrawals: Paused. Co-CEO Yi He expects them to “begin” resuming within 48 hours of her post at 04:17 UTC on 30 October. “Begin” may mean step by step.
- Only official channels: the Binance app, binance.com and Binance’s verified accounts. Binance itself warned that users “should not trust unofficial links, messages, or requests for account information”.
- Expect recovery scams: Nobody legitimate asks for your seed phrase, your 2FA codes or a “verification” payment to unlock a refund. Never send crypto to an address from a social media post, a direct message or a comment.
- Where you keep crypto: Money on any exchange depends on that exchange’s security. How much you keep there is your decision; this is not investment advice.
The same habits protect you elsewhere, see Don’t Give Your AI Agent Your Bank Password.
Infographic 03 · The weak spot
Signing, not key storage.
How one signed permission handed a hot wallet to outside code, how the explanations fit, and what to do now.
How a signed permission emptied a wallet
Ethereum’s EIP-7702, in three steps (concept only)
- 1 · A signed noteThe wallet’s own key signs: “let this program run me”. Each note is valid for one transaction number only, the nonce
- 2 · Fifty ticketsThe wallet was busy, its number kept moving. So one transaction carried 50 notes for 50 numbers in a row. 49 were skipped, one fit
- 3 · The sweepThe installed program obeyed only the attacker’s wallet. One call moved ETH and every listed token out
Three accounts, one picture
- Binance: a compromised DevOps laptop gave access to a service container that submitted unauthorized withdrawals; “no evidence” of a key leak
- Blockaid: Binance’s own signing infrastructure, under the attacker’s control, signed the permission; eleven hot-wallet keys signed transfers
- TRM Labs: ordinary signed transfers on nine chains point to a compromised signing infrastructure
- My reading, unconfirmed: the attacker could ask the signer to sign. The keys never had to leave the vault
Still open
- How did 50 valid permissions get out of the signing system?
- Why did a request that hands a wallet to outside code pass the checks?
- Who is behind it? TRM says TraderTraitor (North Korea), “high confidence”; no government confirmation
- When do withdrawals fully reopen? Where do the ETH and bitcoin go?
For companies
- Treat delegation signatures like a cold-wallet transfer: separate approval, more than one person
- Enforce policy at the signer (HSM/MPC): allowlists, value caps per hour, no fresh or mixer-funded destinations
- Lock down engineers’ machines: hardware-backed logins, short-lived credentials, no standing access to signers
- Alert on any code installed on a hot wallet; keep a revocation ready
- Cut chains of control between wallets
- Prepare freeze contacts with stablecoin issuers before you need them
For users
- Binance says user funds are safe and losses will be covered (its statement)
- Withdrawals are paused; Binance expects them to begin resuming within 48 h of 04:17 UTC on 30 Oct
- Updates only from the app, binance.com or verified accounts
- Nobody legitimate asks for your seed phrase, 2FA codes or a “verification” payment
- Never send crypto to an address from a post, comment or message
The keys may never have left the vault. The vault signed what it was asked to sign.Thorsten Meyer · my reading of the evidence so far
Sources: EIP-7702; Blockaid (as of 22:00 UTC); TRM Labs (as of 00:30 UTC); Binance, 30 Oct 2026; Yi He, 30 Oct. Concept-level description only.
Powered by Thorsten Meyer AI
Honest limits
- Everything is preliminary. No post-mortem yet. Totals, frozen amounts and the chain list may change.
- What I checked myself: the Ethereum timeline, the 50 permissions and their nonce range, the first sweep, the Binance 16 transfer, the ETH forward and the frozen USDT and USDC balances, all on the morning of 30 October. Bitcoin, Tron and the other chains come from TRM, Blockaid and Arkham.
- Dollar values come from the analysts and depend on prices at the time.
- Open questions: How did 50 valid permissions get out of Binance’s signing system? Who is behind it? When do withdrawals fully reopen? Where do the ETH and bitcoin go next?
We will update this story when Binance publishes its post-mortem. Earlier crypto security coverage: The Time Machine Is Open: What the Coldcard Hack Tells Us. On stolen keys at network level: They Came for the Keys, Not the Data. And on how fast attackers move once they are inside: Two Days From Patch to Root.
Sources
- Binance: Security Incident Update, 30 Oct 2026, 02:23 UTC; posts on X at 21:29 UTC and 22:15 UTC, 29 Oct 2026
- Yi He, co-CEO of Binance: Service Update on X, 30 Oct 2026, 04:17 UTC
- TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History, 30 Oct 2026 (figures as of 00:30 UTC)
- Blockaid: Binance $5.5B Hack, 29 Oct 2026 (figures as of 22:00 UTC), and post on X, 29 Oct 2026, 21:50 UTC
- Arkham: post on X, 30 Oct 2026, 04:20 UTC
- Ethereum record: the 50-permission transaction and the first sweep, checked by the author via a public Ethereum node and Blockscout, 30 Oct 2026
- Blockworks: “Everything you need to know about the Binance hack”, thread on X, 29 Oct 2026 (times in ET, prices through 7:45 PM ET)
- Cointelegraph: Binance hack may involve private key “misuse,” not theft: Blockaid CEO, 30 Oct 2026
- CoinDesk: Binance loses over $6 billion in the largest crypto hack to date, 29–30 Oct 2026
- AFP via France 24: Crypto platform Binance confirms major hack, 30 Oct 2026
- EIP-7702: Set Code for EOAs, Ethereum Improvement Proposals
- FBI: North Korea Responsible for $1.5 Billion Bybit Hack, 26 Feb 2025
