On the evening of October 29, 2026, around 20:05 UTC, Binance’s own signing systems authorized transfers of approximately $6.3 billion from its hot wallets across ten blockchains. Most of the funds left in about 20 minutes. That is four times the previous record set by Bybit in February 2025 and, according to Elliptic, almost certainly the largest theft of any kind on record.
Binance halted withdrawals, said user funds are safe, and set aside $6.34 billion of company resources to cover the losses. TRM Labs and Chainalysis attribute the attack, with high confidence, to TraderTraitor, the North Korean unit linked to Lazarus. No government has confirmed the attribution yet.
What Happened, in Plain English
A hot wallet is the online wallet an exchange uses to process withdrawals. The attacker emptied Binance hot wallets on Ethereum, Bitcoin, Tron, the XRP Ledger, Solana and other chains. Binance says it found no evidence that private keys leaked. The attacker made Binance’s own signing system—the machinery that approves each payout—sign the transfers.
On Ethereum the attacker used EIP-7702 (a May 2025 upgrade) with 50 pre-signed authorizations to turn a hot wallet into a sweeper controlled by the attacker. On the other chains the transfers were ordinary signed transactions. Everything points to a compromise of the signing infrastructure, not a classic private-key theft.
Binance’s initial investigation pointed to a compromised DevOps engineer’s laptop that gave access to a service container. The company later spoke of “additional points of breach” and a more complex attack. It has not yet published the full technical post-mortem.
According to TRM Labs (value at the moment of each transfer): Ethereum ~$3.79 billion (200,630 ETH plus tokens, including large amounts of USDT and USDC), Bitcoin 18,270 BTC (~$1.47 billion), Tron ~$628 million, XRP Ledger ~$296 million, Solana ~$96 million, and the rest on other chains. Total ~$6.36 billion. Elliptic arrives at $6.43 billion.
The Freeze Button and Its Limits
A freezable coin has an issuer that can lock a wallet (Tether for USDT, Circle for USDC). An unfreezable coin, such as native bitcoin or ether, has no such switch.
Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s Security Council froze or seized roughly $2.7 billion within a few hours, according to TRM. Binance speaks of about $3 billion frozen. Almost everything that was stopped came from assets with an issuer. Not a single stolen bitcoin was halted that way.
The attacker tried to race the freezes: it sold hundreds of millions of USDT for ETH and TRX, and deposited USDT on Aave to borrow ETH. Frozen is not the same as returned. Getting the money back requires a separate legal process.
The cryptography of the keys held. What failed was the operational environment around them. The freeze button—which many purists dislike—stopped nearly half the haul in hours.
Can Binance Cover It?
Yes, according to the company. It reserved more than $6.34 billion of its own funds. About $5 billion was already held in the exact tokens that were affected; the rest is being bought on the open market and OTC. It also has the SAFU (Secure Asset Fund for Users), historically near $1 billion in BTC.
Co-CEO Yi He said the affected amount represented roughly 2% of user assets and public reserves. Data from Binance’s site and its October 1 Proof of Reserves placed customer assets near $129.4 billion, with reserve ratios ≥100% on the main assets.
Withdrawals were paused with a target to reopen toward Sunday, November 1, and an updated Proof of Reserves was promised for Monday. Deposits remained open. The company insists user funds are safe and that it will cover every loss.
What Supports or Weakens Exchange Security
What supports trust is the combination of three layers: solid operational controls around the keys, rapid response capability (freezes, insurance, reserves) and transparency (frequent and audited Proof of Reserves). In this case the operational layer failed, but the response layer worked better than many expected.
What weakens it is reliance on hot wallets holding large balances, the complexity of multi-chain signing systems, and the risk of laptop or privileged-access compromises. State actors (as suspected here) have resources and patience that exceed those of most ordinary criminal groups. The fact that private keys did not leak is positive, but it also shows that the weak point has moved to infrastructure and people.
Signals to Watch in the Coming Days
- Whether Binance publishes the detailed technical post-mortem and an updated Proof of Reserves that verifies 1:1 coverage.
- How much of the frozen amount is actually recovered and on what timeline.
- Whether the roughly $2.4–3.2 billion still controlled by the attacker (mainly BTC and ETH) begins moving toward bridges, OTC desks or mixers.
- Whether other exchanges or custodians announce reviews of their signing systems and hot wallets.
- Any official confirmation (FBI or others) of the TraderTraitor attribution.
What to Ask Your Exchange, Your Stablecoin Issuer and Your Board This Week
- What is the maximum balance kept in hot wallets and how is it segmented?
- What controls surround the signing system? Are there per-transaction limits, real-time multi-person approvals, or anomaly detection?
- When was the last penetration test or red-team exercise of the withdrawal flow?
- What percentage of assets are freezable and with which issuers do you have rapid-response agreements?
- How often do you publish Proof of Reserves and which external auditor verifies it?
- Does the insurance fund (SAFU or equivalent) cover an event of this size and is it funded in the same assets?
For users: diversification across exchanges, the use of self-custody for large amounts, and preference for assets with good liquidity on multiple venues reduce the risk of a single point of failure.
Conclusion
The largest crypto theft in history was not a failure of cryptography. It was a failure of the human and operational machinery surrounding the keys. At the same time, it demonstrated that the ability of stablecoin issuers to freeze funds can materially and rapidly limit damage. Binance says it will cover everything with its own resources and that users will be made whole. The market and regulators will watch whether execution and transparency match the statements.
The incident leaves a practical question for the entire industry: how much of your exposure depends on an exchange perfectly controlling its signing system, and how much on an issuer being able to press a pause button?
If you want analysis like this on a regular basis, subscribe here: https://cryptopress.substack.com/subscribe
