$6.3 billion stolen, billions frozen, and an entire industry forced to confront a question: what happens when a blockchain transaction is valid, but the authorization behind it is compromised?
Key Takeaways
Record-breaking theft: Hackers stole approximately $6.3 billion from Binance on October 29, 2026, making it the largest crypto hack in history.
How it happened: Attackers exploited transaction authorization systems, including Ethereum's EIP-7702 delegation. Binance says it has found no evidence of stolen private keys.
Billions frozen: Around $3 billion has been frozen, but freezing assets does not guarantee their recovery.
Security vs. decentralization: The response exposed a critical trade-off: centralized controls can stop stolen funds but may also restrict legitimate users.
On October 29, 2026, hackers stole approximately $6.3 billion from Binance hot wallets in what became the largest cryptocurrency theft on record. Most of the funds disappeared within 20 minutes, according to blockchain intelligence firm TRM Labs. But the attackers kept draining some wallets for hours afterward.
The attackers exploited wallet authorization mechanisms, converted hundreds of millions in stablecoins into ETH, and borrowed cryptocurrency against stolen USDT.
Meanwhile, stablecoin issuers froze billions, Aave restricted lending markets, and Arbitrum took extraordinary steps to secure assets on its network.
A transaction can be valid on-chain without being authorized by its rightful owner, and different cryptocurrencies offer very different ways to stop stolen funds.
Here is what investigators have established, what remains unconfirmed, and what the breach means for crypto users. We also spoke with Viacheslav (Slava) Demchuk, CEO and Co-founder of AMLBot, our trusted partner, to get his perspective on the attack and its wider implications for the crypto industry.
What Happened to Binance on October 29, 2026?
Binance suffered a security breach that allowed attackers to transfer approximately $6.3 billion from exchange-controlled hot wallets across multiple blockchains.
In its official October 30 statement, Binance said its initial investigation pointed to a compromised DevOps engineer's laptop. The attacker may have used that access to reach an internal service container and submit unauthorized withdrawal transactions.
Frequently Asked Questions
Yes. On October 29, 2026, attackers transferred approximately $6.3 billion from Binance-controlled hot wallets. The exchange confirmed the security incident, and independent blockchain researchers traced the stolen assets across multiple networks.
Binance estimates the impact at approximately $6.3 billion. TRM Labs calculated roughly $6.36 billion using asset prices at the time of the theft. It is the largest recorded cryptocurrency theft by dollar value as of October 30, 2026.
Binance's preliminary investigation points to a compromised DevOps engineer's laptop and unauthorized access to transaction infrastructure. On Ethereum, investigators also identified malicious EIP-7702 delegation using 50 pre-signed authorizations. The definitive root cause has not been published.
Binance says it has found no evidence of private-key leakage. Researchers suspect the attackers gained access to infrastructure capable of generating or obtaining valid transaction signatures, but the precise method remains under investigation.
Binance reported approximately $3 billion frozen on-chain. TRM Labs independently identified roughly $2.7 billion in frozen or secured assets at its earlier reporting cutoff. Those amounts should not be confused with funds already returned to the exchange.
TRM Labs attributes the incident to North Korea's TraderTraitor group with high confidence. The FBI previously linked TraderTraitor to the February 2025 Bybit hack. Binance has not published a final attribution for the October 2026 incident.
The confirmed Ethereum technique involved EIP-7702 delegation and nonce spraying, not a conventional replay attack. Other affected wallets executed ordinary signed transactions. The underlying compromise of Binance's authorization infrastructure remains under investigation.
Binance states that customer funds are safe and promises to cover losses using SAFU and company funds. Independent confirmation of post-hack asset backing depends on updated reserve disclosures and the completion of remediation.
Binance later said its investigation had uncovered additional points of breach, suggesting the attack was more complex than the compromise of a single employee's laptop. The full sequence of events remains under investigation.
Blockchain researchers independently confirmed massive withdrawals from Binance-controlled addresses. TRM Labs calculated the total at $6.36 billion across ten blockchains, while Chainalysis confirmed at least $5.912 billion stolen as of 00:30 UTC on October 30.
Binance suspended withdrawals, revoked an affected wallet authorization, and began coordinating with blockchain security firms, token issuers, and law enforcement.
The company says it will cover losses through its Secure Asset Fund for Users (SAFU) and corporate funds.
Binance Hack 2026: Key Facts
Detail
Confirmed findings
Date
October 29, 2026
Estimated amount stolen
$6.3B reported by Binance; $6.36B estimated by TRM Labs
Affected blockchains
10, according to TRM Labs
Main attack window
Beginning around 20:05 UTC
Suspected entry point
Compromised DevOps engineer's laptop
Ethereum exploit mechanism
EIP-7702 delegation and nonce spraying
Assets frozen
Approximately $3B reported by Binance
Suspected attacker
North Korea's TraderTraitor, according to TRM Labs
User compensation
Binance promises to cover losses
Root cause
Still under investigation
The incident is approximately four times larger than the $1.5 billion Bybit hack of February 2025.
The total value stolen should not be confused with the amount permanently lost. A substantial portion has already been frozen or secured, while other assets remain under attacker control.
How Did Hackers Breach Binance Without Stealing Private Keys?
The available evidence points toward compromised transaction authorization infrastructure, although Binance has not published a definitive root-cause analysis.
To understand how this could happen, it's important to look at how exchanges authorize transactions from their wallets.
A hot wallet is a cryptocurrency wallet kept connected to the internet so an exchange can process withdrawals and move funds. Its transactions require valid cryptographic signatures.
Normally, these signatures are generated through the exchange's authorized systems.
But a valid signature proves that a transaction was authorized cryptographically. It does not prove that the person requesting it had legitimate permission to move the funds.
“There is a fundamental difference between a cryptographically valid transaction and an operationally authorized one. A transaction can be one without necessarily being the other.”
— Viacheslav Demchuk, CEO & Co-founder of AMLBot
If an attacker gains control over the infrastructure that requests signatures, they may be able to make a wallet execute transactions without extracting the underlying private key.
According to TRM Labs, attackers transferred funds from wallets using different blockchain networks and signing mechanisms within the same short period. Most of those transactions were ordinary, correctly signed transfers.
The Ethereum attack involved an additional technique that gave the attacker continuing control over one of Binance's largest hot wallets.
How 50 Signatures Gave the Attacker Control of Binance 14
Security firm Blockaid reconstructed the Ethereum exploit using on-chain transactions.
The attack targeted Binance 14, one of the exchange's largest and busiest Ethereum hot wallets.
It relied on EIP-7702, an Ethereum feature introduced in the Pectra upgrade in May 2025. EIP-7702 allows an ordinary Ethereum wallet to execute smart contract code through a signed authorization. The delegation remains active until it is replaced or revoked.
This is useful for legitimate features such as transaction batching. But an authorization directing a wallet to malicious code can give an attacker extensive control over that account.
The attacker prepared a contract capable of transferring tokens and ETH from a delegated wallet.
At 20:20:59 UTC, they submitted an Ethereum transaction containing 50 EIP-7702 authorizations, each signed for Binance 14.
Why 50?
Every Ethereum account has a nonce, a counter used to establish the order of transactions. Binance 14 was processing transactions continuously, so its nonce kept increasing.
The attacker could not be certain which value would be current when the authorization transaction executed. Instead, they prepared authorizations covering 50 consecutive nonce values, from 18,914,775 to 18,914,824.
Forty-nine were invalid when processed. One matched.
That single valid authorization delegated Binance 14's behavior to the attacker's contract.
“The reported use of EIP-7702 delegation is particularly interesting because it highlights another risk: a single authorization can potentially grant capabilities that extend well beyond an ordinary transfer. Such changes deserve an entirely different level of scrutiny.”
— Viacheslav Demchuk, CEO & Co-founder of AMLBot
Blockaid calls this method nonce spraying. It should not be confused with a conventional replay attack.
The $2.5 Billion Withdrawal
At 20:24:23 UTC, just three minutes and 24 seconds after the successful delegation, the attacker executed a withdrawal through the compromised wallet.
The transaction transferred:
167,464 ETH.
Approximately 1.615 billion USDT.
Around 60 additional tokens.
The combined value was approximately $2.5 billion. The wallet was left with roughly 1 ETH.
Etherscan records show that the attacker initiated the transaction from their own address, interacting directly with Binance 14 through the malicious delegation. No new signature from Binance 14 was needed to execute the withdrawal.
Binance Hack Timeline: How the Attack Unfolded
Unlike a normal transaction approval, the EIP-7702 delegation remained active after the first withdrawal.
As a result, the attacker could continue executing the delegated contract without obtaining another authorization each time.
TRM Labs identified repeated withdrawals throughout the evening:
The malicious delegation was not revoked until shortly after midnight UTC. For nearly four hours, the attacker's code remained connected to a major Binance wallet.
The timeline raises another question: which warning signs should have triggered an automatic security response?
“Withdrawal velocity, unusual destinations, aggregate exposure across multiple wallets and blockchains, and changes to wallet permissions or execution logic should all be evaluated before authorization.”
— Viacheslav Demchuk, CEO & Co-founder of AMLBot
How Much Crypto Was Stolen From Binance?
TRM Labs traced approximately $6.36 billion in unauthorized transfers across ten blockchains.
Ethereum accounted for the largest share, followed by Bitcoin and TRON.
Blockchain
Stolen assets
Estimated value
Ethereum
200,630 ETH and 185 other tokens
$3.79B
Bitcoin
18,270 BTC
$1.47B
TRON
612.7M USDT and 46.4M TRX
$628M
XRP Ledger
233.46M XRP
$296M
Solana
970,500 SOL
$96M
Arbitrum, Optimism, Base
ETH, ARB, and other tokens
$39M
Avalanche
AVAX and other assets
$28M
Polygon
Various tokens
$10M
Source: TRM Labs. Values are approximate and based on asset prices at the time of the theft.
A separate Bitquery investigation identified 17 affected hot wallets across nine networks, reflecting a different tracking methodology.
The findings support the same central conclusion: the attack was not limited to Ethereum or to EIP-7702.
Wallets on Bitcoin, TRON, Solana, XRP Ledger, and other networks executed ordinary signed transfers to attacker-controlled addresses.
Viacheslav Demchuk, CEO & Co-founder of AMLBot, argues that defenses must recognize a coordinated attack rather than evaluate withdrawals one by one:
“... When billions begin moving across multiple chains within minutes, security controls must be capable of recognizing the activity as a coordinated event rather than treating each transaction in isolation.”
Where Did the Stolen $6.3 Billion Go?
Some stolen assets remained in identifiable wallets. Others were converted through decentralized exchanges, deposited into lending protocols, or frozen by their issuers.
Two assets can leave the same compromised wallet at the same time but face completely different recovery possibilities.
A centralized stablecoin issuer may have the ability to block its token. Native Bitcoin or Ethereum does not have an equivalent issuer-controlled blacklist.
And some blockchain networks retain emergency governance powers that can be used under exceptional circumstances.
The aftermath of the Binance hack demonstrated all of these mechanisms.
Viacheslav Demchuk, CEO & Co-founder of AMLBot, also highlights the risk of a taint cascade, where stolen funds move through multiple addresses and expose downstream recipients to compliance restrictions.
“The first is the taint cascade: stolen funds get split and swapped through hundreds of addresses, every compliance tool flags everything downstream, and whoever received funds two or three hops from the attacker can have their assets frozen.”
How Much of the Stolen Crypto Was Frozen?
In its October 30 update, Binance reported that approximately $3 billion of affected assets had been frozen on-chain.
TRM Labs independently identified approximately $2.7 billion in frozen or secured funds at its earlier reporting cutoff. That amounted to roughly 42% of TRM Labs' estimated $6.36 billion theft.
The independently traced interventions included:
Organization
Assets affected
Approximate amount
Tether
USDT
$1.77B
Circle
USDC
$825M
Ripple
RLUSD
$40.5M
World Liberty Financial
USD1
$27.8M
Arbitrum Security Council
ETH and ARB
$30M
Source: TRM Labs. The figures represent a particular reporting cutoff; further freezes may change the totals.
Other token issuers also restricted assets associated with the attack.
Frozen funds are not recovered funds.
A token issuer can prevent assets from moving without immediately returning them to their previous owner. Some frozen assets may require additional procedures or legal authorization before they can be restored to Binance.
The same distinction applies to assets secured through emergency blockchain governance.
Freezing stolen assets is only the first step. Returning them can take much longer.
“The second is frozen-funds limbo: issuer freezes are fast, two to three minutes this time, but unfreezing is slow and needs a law enforcement or court order, which in our practice takes months, sometimes years.”
— Viacheslav Demchuk, CEO & Co-founder of AMLBot
How the Hacker Converted Stolen USDT Before It Could Be Frozen
Stablecoins became an immediate focus of the recovery effort.
Tether and Circle can blacklist addresses holding their respective tokens, restricting transfers from those addresses.
The attackers responded by moving USDT between addresses and converting it into other cryptocurrencies.
According to Bitquery, approximately $729 million in stolen USDT was converted into ETH and TRX before the relevant freezes took effect.
The activity involved Uniswap, UniswapX, 1inch Fusion, and SunSwap.
TRM Labs separately identified approximately $325 million in USDT sold through market makers and intent-based trading mechanisms in exchange for roughly 122,300 ETH.
The implied execution price was near $2,650 per ETH while the prevailing market price was approximately $2,300–2,350. That represented an unusually unfavorable exchange rate for the attacker.
The reasoning is straightforward: once USDT is exchanged for native ETH, Tether can no longer freeze those ETH holdings through its token contract.
That does not make the ETH untraceable, but it removes one direct method of immobilizing the stolen funds.
Six Tether Freezes Reached Empty Wallets
According to Bitquery, Tether blacklisted 11 attacker-controlled wallets on Ethereum and TRON, but six were already empty. One address moved 130 million USDT less than a minute before being frozen.
Timing proved critical: blacklisting stopped funds still held in targeted wallets but could not reverse completed transfers or swaps.
How the Binance Hacker Used Aave to Borrow $44.6 Million in ETH
The attacker knew how to put stolen crypto to work.
Instead of simply swapping stolen USDT for ETH, the hacker used Aave's lending system to turn the stolen stablecoins into collateral and borrow millions in ETH without selling them.
Between 20:58 and 21:01 UTC on October 29, an address linked to the attacker deposited 60 million USDT into Aave V3 and borrowed 19,762 WETH, worth approximately $44.6 million.
The attacker used the protocol's lending functionality: deposit collateral, then borrow another asset against it.
At the time of LlamaRisk's report, the position remained overcollateralized, with approximately $59.9 million in collateral against $43.8 million in debt.
Why Aave Restricted 292 Reserves
Freezing the stolen tokens alone wasn't enough. The attacker could swap them into other assets supported by Aave and use those instead.
Within 10 minutes of the first reports, LlamaRisk joined Aave Labs, TokenLogic, and Certora in an emergency response group. The teams decided to restrict new lending and deposits across Aave's markets.
Between 21:42 and 23:04 UTC, they froze:
175 Aave V3 reserves across 16 networks.
117 Aave V4 reserves across four networks.
In total, 292 reserves were restricted. Existing users could still repay loans, withdraw available funds, and undergo normal liquidations. No market was completely paused.
But the emergency measures came with a trade-off.
Legitimate borrowers could no longer add collateral to protect their positions from liquidation. During the freeze, repaying debt was their only way to improve their health factor.
A prolonged freeze could also increase borrowing rates as available liquidity declined.
Aave chose this approach because its guardians could reverse the restrictions quickly. Reducing supply and borrowing caps instead would have required governance approval and approximately five days to restore.
The response highlights a broader consequence of major crypto thefts: even protocols that haven't been hacked may need to restrict legitimate users to contain the damage.
Viacheslav Demchuk, CEO & Co-founder of AMLBot, argues that the broader consequences can outweigh the direct theft:
“The secondary effects land on everyone else: within hours, deposits and withdrawals were suspended at the largest exchange, Aave froze 175 reserves across 16 networks over a single $60M position, Kamino paused markets the attacker never touched, and BTC and ETH hit multi-week lows. None of those were hacked.”
Kamino separately confirmed that it had temporarily paused borrowing in its SOL/BTC Market as a precaution, despite reporting no direct exposure to the exploit.
How Did Arbitrum Freeze Stolen ETH Without the Hacker's Signature?
One of the most unusual developments occurred on Arbitrum.
On October 30, the Arbitrum Security Council announced that it had secured:
8,425 ETH.
74,559,805.2 ARB.
Together, the assets were worth approximately $30 million at the time.
According to the official Arbitrum incident report, the Security Council temporarily upgraded the network's Inbox contract on Ethereum.
The temporary implementation introduced a function called sendUnsignedTransactionOverride.
Using this mechanism, the council executed two transactions that represented the attacker-controlled address and moved the assets to a designated holding wallet.
The original Inbox implementation was then restored.
The secured assets were transferred to 0x0000000000000000000000000000000000000DA0.
Arbitrum stated that further movement of those funds would require an ArbitrumDAO governance vote.
What This Means for Blockchain Decentralization
If an attacker controls a wallet's private key, can a blockchain still move its assets without their permission?
On Ethereum mainnet, native ETH does not have an issuer-controlled blacklist or a standard mechanism allowing an administrator to transfer arbitrary users' funds.
Arbitrum One, however, operates with its own governance and security architecture.
In this case, the network's emergency powers enabled an intervention that would not be available through ordinary user transactions.
The event does not establish that native ETH can be arbitrarily frozen on Ethereum mainnet. It demonstrates that some Layer 2 networks have additional governance mechanisms capable of overriding normal transaction behavior under exceptional circumstances.
Whether those powers are viewed primarily as necessary security safeguards or as centralization risks depends on the authority granted to them, the oversight involved, and the conditions under which they can be exercised.
In this incident, they were used to secure assets linked to a major theft.
Who Can Actually Stop Stolen Cryptocurrency?
The Binance hack offers a particularly clear comparison of four distinct security mechanisms.
Mechanism
Who controls it?
What it can do
What it cannot guarantee
Wallet authorization revocation
Wallet operator
Remove malicious delegated permissions
Reverse completed withdrawals
Stablecoin blacklisting
Token issuers
Restrict transfers of affected tokens
Recover assets already converted into other coins
DeFi market restrictions
Protocol guardians and governance
Prevent new lending or supply positions
Stop activity across unrelated protocols
Emergency network intervention
Authorized blockchain governance bodies
Secure assets using specific network powers
Provide universal recovery across all chains
Restrictions capable of stopping thieves may affect legitimate users, while assets designed to avoid centralized control are often harder to immobilize after a theft.
The Binance incident shows how these differences play out in practice, rather than merely in discussions about decentralization.
Viacheslav Demchuk, CEO & Co-founder of AMLBot, sees these interventions as necessary despite their impact on legitimate market participants:
“If $6.3B can walk out of the largest exchange and nobody can do anything about it, no regulator, bank or institutional client will take this industry seriously again.”
Where Are the Stolen Bitcoin and Ethereum Now?
While billions in stablecoins were frozen, substantial amounts of BTC and ETH remained accessible to the attacker.
As of 06:43 UTC on October 30, Bitquery estimated that attacker-controlled wallets still held approximately $3.2 billion in cryptocurrency.
Its tracking identified:
508,621 ETH held by the attacker.
18,270 BTC distributed across 19 Bitcoin addresses.
Additional balances in XRP, SOL, TRX, and other assets.
According to TRM Labs, approximately 200,630 ETH was stolen directly from Binance. The much larger ETH balance subsequently observed by Bitquery reflects the conversion of stolen stablecoins and other tokens.
Bitquery reported that most of the tracked BTC and ETH remained in identifiable wallets, with no observed transfers from those particular holdings to known centralized exchanges, mixers, or bridges by its reporting cutoff.
These figures are snapshots, not live balances.
Blockchain investigators can monitor the funds, but that does not mean they can automatically recover them.
Who Hacked Binance in 2026?
TRM Labs attributes the attack to TraderTraitor, a North Korean hacking group, with high confidence.
The firm's assessment relies on on-chain and off-chain intelligence, including similarities with earlier attacks.
Researchers identified several characteristics associated with previous North Korea-linked operations, including advance preparation, funding through Tornado Cash, and the use of previously obtained signatures.
The public evidence does not yet establish every step connecting the Binance incident to the group.
Binance has not released a definitive attacker attribution and continues working with law enforcement.
Did the Binance Hack Affect Customer Funds and Reserves?
Binance says customer funds are safe and promises to cover losses through SAFU and company reserves.
Binance has begun restoring assets affected by the $6.3 billion hack, reserving more than $6.34 billion in company funds. Of that amount, $5 billion is already held in the affected tokens, while the exchange is acquiring the remainder through market and OTC transactions. The funds are separate from the approximately $3 billion in stolen assets frozen so far.
Based on that earlier reserve snapshot, CoinDesk estimated that the loss of approximately 204,500 ETH could temporarily reduce the exchange's ETH coverage to roughly 94%, assuming Binance had not replaced the stolen assets.
This is a conditional estimate, not Binance's verified post-hack reserve ratio.
Binance has committed to publishing an updated Proof of Reserves following remediation.
Are Binance Withdrawals Available?
Binance temporarily suspended deposits and withdrawals during its initial security response.
In an October 30 service update, the exchange said deposits were operating normally while withdrawals remained paused for additional security work.
It expected withdrawal services to begin resuming within 48 hours.
The exchange has not confirmed that all withdrawal services were restored at the time of this article's latest update.
Users should rely on official Binance announcements for current network availability rather than unofficial recovery links or messages.
How Did the $6.3 Billion Binance Hack Affect Crypto Markets?
The Binance hack rattled crypto markets. As of October 30, Bitcoin traded near $77,483 (−3.17% in 24 hours), Ethereum at $2,219 (−4.34%), and BNB at $704 (−6.47%), according to CoinMarketCap.
Trading on Binance became more expensive as the gap between buying and selling prices widened. Bitcoin's bid-ask spread temporarily increased fivefold, while Ethereum's grew 2.5 times, reflecting reduced market liquidity following the breach.
What Happens Next?
Several developments will determine the longer-term consequences of the Binance hack.
The root-cause investigation. Binance has promised a detailed technical post-mortem explaining the entry point, authorization failure, and measures implemented to prevent a similar breach.
Further asset recovery. Stablecoin issuers and law enforcement will continue tracing and potentially securing stolen funds. Previously frozen assets may still require formal recovery procedures.
Updated reserves. Binance's forthcoming Proof of Reserves will provide information about asset backing after the company's compensation and remediation efforts.
Movement of remaining BTC and ETH. Investigators continue monitoring wallets holding large balances that cannot be immobilized through ordinary issuer blacklists.
Security changes across the industry. The attack highlights the importance of independent transaction authorization checks, restrictions on signing privileges, and monitoring for unexpected wallet delegations.
For Viacheslav Demchuk, CEO & Co-founder of AMLBot, the central safeguard is separating transaction initiation from the controls that approve it:
“The infrastructure initiating a transaction should never be able to override the controls designed to stop it.”
The blockchain networks involved did not need to be compromised for billions in assets to leave their owners' wallets.
What the Binance Hack Reveals About Crypto Security
The October 29 attack demonstrated how much depends on the systems that authorize cryptocurrency transactions.
The attackers did not need to rewrite Bitcoin's transaction history or compromise Ethereum's consensus. They obtained valid authorizations and used them to move assets that the blockchain considered legitimate transfers.
“The objective isn't simply to protect private keys. It's to build a security architecture where compromising one component, however privileged, does not give an attacker the ability to move billions before anyone can intervene.”
— Viacheslav Demchuk, CEO & Co-founder of AMLBot
Once those assets were stolen, the recovery response depended on their underlying design.
Stablecoin issuers could freeze tokens. Aave could restrict lending activity. Arbitrum could invoke emergency governance powers. Native Bitcoin and Ethereum holdings remained traceable but lacked equivalent issuer-controlled freezing mechanisms.
The Binance hack exposed both sides of crypto's security model: decentralized settlement can make transactions extremely difficult to reverse, while centralized controls can help contain theft but introduce their own questions about authority and user freedom.
For Viacheslav Demchuk, the coordinated response demonstrated something beyond the ability to trace stolen cryptocurrency:
“The freezes, the pauses and the coordination between issuers, protocols and investigators are the industry proving it can police itself. The secondary damage is real, but it is the cost of credibility.”
The challenge now is to prevent compromised signing systems from authorizing theft in the first place, while ensuring that emergency recovery powers remain transparent and accountable.
