Between 20:04 and 23:56 UTC on October 29, 2026, roughly $6.3 billion in digital assets left Binance's hot wallets and did not come back. According to blockchain analytics firm Bitquery, the outflows spanned nine to ten separate blockchains. TRM Labs put the figure at approximately $6.36 billion and noted that most of it moved in about twenty minutes, starting at 20:05 UTC.

The single most important moment came at 20:20:59 UTC. Security firm Blockaid traced one Ethereum transaction containing fifty so-called EIP-7702 authorizations, all aimed at the wallet known publicly as Binance 14. Forty-nine failed. One succeeded. That one authorization handed control of the wallet to a smart contract the attacker controlled, which then swept out 167,464 ETH and 1.6 billion USDT. A second Binance hot wallet on Ethereum separately signed nine transfers worth $174 million straight to the attacker. On Ethereum alone, Etherscan data showed around $2.8 billion leaving, made up of 195,470 ETH, 1.615 billion USDT, 780 million USDC and more than sixty other tokens.

For scale: the previous record crypto theft was the Bybit hack of February 2025, at about $1.5 billion. This was roughly four times larger. Binance's founder, Changpeng Zhao, posted on X at 21:15 UTC that it did look like a hack, while the money was still moving.

In this article we explore how an exchange hot wallet actually works, what EIP-7702 is and why it turned a signature into a skeleton key, how a compromised engineer's laptop fits into the picture, why Binance's own account of events has shifted, how roughly $3 billion was frozen in flight, and what the episode does to the case for keeping assets on centralized exchanges.

Hot Wallets, Cold Wallets and Why Exchanges Keep Both

A crypto exchange holds customer assets in two broad categories.

  • Cold wallets are storage whose private keys, the secret strings that authorise a transaction, are kept offline. Moving funds out requires physical, deliberate, often multi-person action. Safe, but slow.
  • Hot wallets are connected to the internet and to the exchange's own software. They exist so that when a customer clicks withdraw, the coins arrive in minutes rather than hours. They are the cash register, not the vault.

The trade-off is structural, not a mistake. An exchange with no hot wallet cannot function. An exchange with a hot wallet has an internet-connected system that is authorised, by design, to sign transactions moving customer money. Many large exchange thefts have been attacks on that seam, though not all of them: the $1.5 billion Bybit theft of February 2025 drained an Ethereum multisig cold wallet during a scheduled transfer, via a manipulated signing interface.

The proportions here are worth noting. DefiLlama data indicated Binance's public wallets held almost $145 billion before the hack, so the theft represented roughly 4.4 percent of the total. That is a devastating number in absolute terms and a survivable one in relative terms, which is precisely why the hot wallet model persists.

What EIP-7702 Is, in Plain Terms

Ethereum has historically had two kinds of accounts. An externally owned account is a plain wallet controlled by a private key: it can hold assets and send them, and that is all. A smart contract account is a piece of code that can hold assets and follow programmed instructions, but has no key of its own.

EIP-7702, introduced with Ethereum's Pectra upgrade, blurs that line. It lets an ordinary key-controlled wallet temporarily delegate its execution to smart contract code, by signing an authorization message. In effect the wallet says: for the purposes of this transaction, treat me as though I were running this program.

The intent is user convenience. Delegation allows features such as batching several actions into one transaction, or letting a third party pay the gas fee on a user's behalf, without forcing people to migrate to an entirely new wallet address. It is a genuine usability improvement.

The risk is the mirror image of the benefit. An EIP-7702 authorization is not a transfer. It is a grant of control. Approve the wrong one and the signer has not lost a single coin at the moment of signing; it has handed the keys of the car to a stranger who can drive it away later.

That is exactly what happened. The successful authorization delegated the Binance hot wallet to what Elliptic described as a sweeper contract, a program built for one purpose: to drain everything the wallet holds in a single pass. The transaction that emptied the wallet was, from the blockchain's point of view, entirely valid. Etherscan ended up labelling the destination addresses Binance Hot Wallet Exploiter and Binance Hot Wallet Exploiter 2, tagged Exploit, because there was no protocol-level sense in which anything had gone wrong.

The Human Door

A valid authorization has to be signed by something. At 02:23 UTC on October 30, Binance announced an initial finding: a compromised DevOps engineer's laptop had allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. A DevOps engineer is the person who maintains the plumbing that runs an exchange's systems; a service container is an isolated software environment where one of those systems runs.

Crucially, Binance said it found no evidence that any wallet private key had leaked. Blockaid's chief executive, Ido Ben-Natan, said the evidence points to compromised signing infrastructure rather than a leaked key, and drew a parallel with the Bybit hack of February 2025.

That distinction matters more than it sounds. A stolen key is a theft of a secret. A compromised signing pipeline is the subversion of a legitimate process: the system still holds its secrets, but it has been persuaded to use them on an attacker's behalf. From the outside, on-chain, the two are indistinguishable. Both produce perfectly valid signatures.

The precise mechanism by which laptop access turned into a signed EIP-7702 authorization has not been published, and it would be wrong to guess at it.

Where the Accounts Diverge

Binance's story did not stay still. Having first pointed at the laptop, the company later said the incident stems from multiple factors and that its continuing investigation had uncovered additional points of breach. Co-CEO Richard Teng, who succeeded Changpeng Zhao in November 2023, stated that the attacker did not simply use one engineer's permissions and that this was not a single one-click action. Teng also said the investigation has not attributed responsibility to any individual.

Outside investigators moved faster on attribution. TRM Labs pinned the heist on TraderTraitor, a North Korean state-backed hacking unit also tracked as Lazarus Group and APT38. Binance itself has not linked the incident to any hacking group or threat actor in its own statements.

This divergence is normal rather than suspicious. Blockchain intelligence firms attribute on the balance of on-chain and off-chain patterns and publish quickly. An exchange under legal and regulatory scrutiny attributes only what it can evidence. It is worth noting that in the sources available, no official law enforcement attribution had been confirmed; the North Korea link rests on private firms' analysis.

The Freeze: Crypto's Quiet Centralisation

About $3 billion of the stolen funds, roughly half the total, has been frozen on-chain. Tether's chief executive said more than 1.567 billion USDT had been frozen. Circle, issuer of USDC, and Trump-backed World Liberty Financial also froze stablecoin holdings.

This deserves to be sat with. A dollar-pegged stablecoin is a liability of its issuer, and the issuer retains the technical ability to blacklist an address, rendering the tokens held there inert. The asset still sits on the blockchain. It simply stops being redeemable or transferable.

So the single largest mitigating factor in the largest crypto theft in history was not cryptography, decentralisation or immutability. It was a handful of private companies exercising administrative control over their own tokens. Stolen ETH, which has no issuer, could not be frozen the same way. The practical lesson is that the more centralised a crypto asset is, the more recoverable it is after a theft, and the more its holders depend on an issuer's discretion the rest of the time.

Who Bears the Loss

Binance said it would cover all losses using its Secure Asset Fund for Users, known as SAFU, a reserve of roughly $1 billion in bitcoin, plus company funds. SAFU is an insurance pool Binance set aside for precisely this event. At roughly $1 billion against a $6.3 billion gross loss, it covers a fraction, with the balance coming from the company's own balance sheet and, if recovery efforts work, from frozen funds returned.

Operationally, Binance suspended deposits and withdrawals, revoked the affected address's authorization, and engaged law enforcement and blockchain intelligence partners. It expected to resume withdrawals within about 48 hours, later described as on track within 45 hours of its latest update, following a security revamp of the withdrawal service.

A suspension of withdrawals is the moment at which a trading venue becomes a credit question. Customers who thought they owned assets discover they own a claim on a company, and the value of that claim depends on whether the company can absorb the hole.

What It Means for Centralized Exchanges

Three uncomfortable implications follow.

  • New protocol features expand the attack surface in ways institutions have not priced. EIP-7702 is a reasonable design serving real users. It also converts a signature into a transfer of control, which raises the stakes of every compromised signing path.
  • The weakest link remains human and operational. Nothing about this attack required breaking cryptography. It required reaching the machinery that uses cryptography legitimately.
  • Scale is now its own risk factor. A venue holding close to $145 billion in visible wallets is a target worth months of preparation by a well-resourced adversary, including a state-backed one.

The counterpoint is that the system held. Binance stayed solvent, roughly half the funds were immobilised, and withdrawals were expected to resume on a timescale measured in days, with the exchange saying it remained on track to restart them in approximately 45 hours from its latest update, having suspended them at about 22:15 UTC on October 29. That is a materially different outcome from the exchange failures of crypto's earlier history.

Key Takeaways for Investors

  • Approximately $6.3 billion left Binance hot wallets on October 29, 2026 across nine to ten blockchains, about four times the $1.5 billion Bybit hack of February 2025.
  • A single successful EIP-7702 authorization at 20:20:59 UTC, one of fifty attempted in one transaction, delegated a Binance hot wallet to an attacker-controlled sweeper contract.
  • Binance reported no evidence of a leaked private key, pointing instead to compromised signing infrastructure reached via a DevOps engineer's laptop and, later, additional points of breach.
  • Roughly $3 billion was frozen, a total that includes stablecoins frozen by issuers Tether, Circle and World Liberty Financial, highlighting that recoverability in crypto depends on centralised issuer control.
  • Binance committed to covering losses from its roughly $1 billion SAFU reserve plus company funds, and the theft was about 4.4 percent of its publicly visible holdings.
  • Attribution to North Korea's TraderTraitor comes from private intelligence firms, not from Binance or from confirmed official law enforcement statements in the available reporting.

Conclusion

The striking thing about this hack is how little of it was a failure of blockchain technology. Every transaction was valid. Every signature checked out. The ledger worked exactly as designed, which is the problem: a system built to execute instructions without judgement will execute a thief's instructions with the same indifference it shows a customer's.

What stopped the bleeding was not code but counterparties. Tether froze tokens. Circle froze tokens. Binance pledged its own balance sheet. The infrastructure that limited the damage was the centralised, discretionary, corporate layer that crypto was originally designed to route around. Holding assets on an exchange has always been a bet on an institution rather than on a protocol. The October 2026 hack did not change that. It simply made the bet legible, and showed what it costs when it comes due.