Security · Crypto · October 30, 2026

The $6.36 billion Binance hack, explained: how one wallet was emptied with no sign of a leaked key

Binance is the world's largest crypto exchange. On Thursday, October 29, about $6.36 billion left its wallets on ten blockchains, most of it in about 20 minutes. Binance says it has found no evidence that a wallet's private key leaked.

Follow @EmergentMind on X · Subscribe on YouTube

The short version

Attackers took about $6.36 billion from Binance, about four times the previous record. On Ethereum they used a feature that lets a wallet hand control to code, with one signed permission. Each permission works only at the wallet's exact transaction count, so they sent fifty in a row and one matched. Stablecoin issuers and partners froze about $2.7 to $3 billion, depending on who is counting, but about $2.4 billion in ether and bitcoin is beyond anyone's freeze. The FBI has since named North Korea as responsible. Binance says it will pay for the loss itself and has replaced about 95% of the assets. It began turning withdrawals back on, in phases, on November 1, and on November 2 said its new Proof of Reserves can be checked.

What happened

TRM Labs, a blockchain intelligence firm, says the theft began at 20:05 UTC (4:05 pm Eastern) on October 29, with a second wave at about 23:05 UTC. It counts about $6.36 billion at the prices when each transfer was made. Binance puts it at about $6.3 billion, and Chainalysis at about $6.4 billion.

Binance confirmed the breach and paused withdrawals. It says deposits were unaffected. It linked the theft to a DevOps engineer's compromised laptop, which let attackers reach a service container and submit unauthorized withdrawals. It later said it had uncovered additional points of breach and is still gathering the facts.

On October 30, co-CEO Richard Teng said the attack was not carried out by one person, and that the attackers used a self-destruct mechanism that destroyed their tools and traces as they went. He also confirmed the EIP-7702 route on Ethereum: the delegation did not pass through our normal approval controls. Binance has not published a root cause. It promises a full post-mortem.

Ethereum
about $3.79B
Bitcoin
about $1.47B
Tron
about $628M
XRP Ledger
about $296M
Solana
about $96M
Arbitrum, Optimism, Base
about $39M
Avalanche
about $28M
Polygon
about $10M

Figures from TRM Labs.

How it worked on Ethereum

A hot wallet is one kept online so an exchange can pay out withdrawals quickly. Its private key is the secret that signs its transactions. Each wallet also has a nonce, a count of the transactions it has sent.

EIP-7702, an Ethereum feature, lets a wallet sign a permission that makes it run another program's code. The rule that matters here: the permission is valid only if its number equals the wallet's current nonce. Binance's wallet was busy, so its nonce kept moving and the attackers couldn't know which number would be current when their transaction landed.

TRM says they submitted 50 pre-signed permissions covering 50 consecutive numbers. Try it below.

Fifty permissions, one wallet count

Wallet count when the transaction lands: 18914775

When one matched, the wallet, known as Binance 14, became a sweeper under the attackers' control. TRM says that 3 minutes and 24 seconds after the 20:20 UTC delegation, 167,464 ether and 63 kinds of token, including 1.615 billion USDT, were gone. CoinDesk puts that wallet's loss at about $2.5 billion.

The open question is how the permissions got signed. Binance says it has found no evidence of a leaked private key. TRM assesses a likely compromise of the hot wallet signing infrastructure, the system that uses the keys. That would mean an attacker can get valid signatures without ever holding the key. On the other chains, funds left through ordinary signed transfers.

The freeze, and what can't be frozen

$2.7B

frozen as of 00:30 UTC, per TRM. Tether, Circle, Ripple and World Liberty Financial can lock their own stablecoins, and Arbitrum's Security Council froze about $30M. Chainalysis has since counted about $2.8B, and Binance says $3B.

$2.4B

in more than 420,000 ether and 18,270 bitcoin that TRM says the attacker holds, beyond any issuer's reach. No company can freeze those.

Chainalysis describes laundering it hadn't seen before: thousands of transactions in a short period, which suggests automation, with funds circling among addresses.

Who is blamed

TRM attributes the attack with high confidence to TraderTraitor, a North Korean state-backed unit the FBI named for the $1.5 billion Bybit hack in February 2025. Chainalysis reaches the same assessment, based on stolen Binance funds mixing in real time with funds from last month's Bitget exploit. Both are assessments from on-chain evidence.

On October 31, the FBI said North Korea was responsible for the theft of more than $6 billion from Binance, and used the same name, TraderTraitor. It says the group is converting stolen assets mainly into ether, and that it expects more laundering through DeFi and instant swap services. The FBI, the Secret Service and IRS Criminal Investigation are asking node operators, instant exchanges, DeFi services and analytics firms to block transactions tied to the addresses it published.

Reactions

  • "In the hours following this hack, 2x that amount was *frozen.*"
    Taylor Monahan, security researcher (@tayvano_), October 30, comparing it to Bybit's roughly $1.5B
  • "User funds are safe!"
    Changpeng Zhao, Binance founder and shareholder, who says he no longer manages it (@cz_binance), October 29
  • "This indicates the same actor is likely behind both incidents."
    ZachXBT, on-chain investigator (@zachxbt), October 30, on funds from Binance and Bitget mixing
  • "The heist itself only took 20 minutes, but the preparation is a business that has gone on for years."
    lordnacho, a Hacker News commenter, October 30

Timeline (UTC)

  1. Oct 28 Small Tornado Cash withdrawals begin, at least 36 hours ahead. The code is rehearsed on other wallets.
  2. Oct 29, 20:05 The theft begins. Most of it happens in about 20 minutes.
  3. 20:20 The 50-permission delegation is submitted on Ethereum.
  4. About 20:24 167,464 ether leaves Binance 14.
  5. 21:04 Circle freezes 823M USDC.
  6. About 23:05 A second wave reaches Avalanche and Polygon wallets.
  7. Oct 30, 00:30 About $2.7B is frozen.
  8. Oct 30, 10:55 Binance says it has reserved over $6.34B of its own funds.
  9. Oct 30, 14:33 Teng confirms the EIP-7702 route and says withdrawals are on track to return within 40 hours.
  10. Oct 31, 14:33 Teng says 90% of the stolen assets have been replenished.
  11. Oct 31 The FBI names North Korea and publishes a list of addresses.
  12. Nov 1, 05:11 Teng says about 95% is replenished and phased withdrawals are starting.
  13. Nov 1, 06:20 Binance opens the first network, bitcoin. Others follow through the morning.
  14. Nov 2 Binance says the Proof of Reserves for its October 31 snapshot is complete. Next snapshot: November 4.

What it means for customers

Binance says User funds are safe and that it will cover all losses from the SAFU fund and the company's funds. It says it has reserved over $6.34 billion of company funds, with $5 billion already held in the exact tokens that were taken, and is buying the rest on the market and over the counter. Those figures leave out frozen assets, which it is still trying to recover. Teng said on November 1 that about 95% of the affected assets have been replenished, up from 90% a day earlier. Replenished means Binance put the assets back. It doesn't mean the attackers returned them.

Teng says the affected wallet was Binance's own hot wallet, that most customer assets sit in cold wallets, and that customer funds were not touched. These are Binance's claims. The check it offers is a Proof of Reserves, a statement of what it holds that outsiders can test. Teng said on November 2 that the latest one is complete, and co-founder Yi He says holders of ten tokens, including bitcoin, ether and USDT, can now verify that their balance was backed at least 1:1 at the October 31 snapshot. That is Binance's own account, and the reserves haven't been checked for this page. Binance also added new wallet addresses to its reserve list on November 1. All withdrawals now come from those new wallets.

Withdrawals. They began coming back on Sunday, November 1, about when Teng's 40-hour estimate pointed. Bitcoin opened first, at about 06:20 UTC, followed by Ethereum and BNB Smart Chain for their main coins. By 12:36 UTC Binance's list had grown to include XRP, Base, Dogecoin, Optimism, Arbitrum, Tron, Solana, Polygon, Avalanche, Zcash, TON and Sui. It says the rest will follow in phases as security checks finish, so check its list for a specific coin and network. CoinDesk reports that about 204,500 ether taken is about 5.6% of Binance's ether reserves. This page isn't financial advice.

Questions people are asking

Was this a bug in Ethereum?

Nothing reported so far says so. EIP-7702 worked as designed: a validly signed permission was accepted. The problem is that valid signatures existed.

Why fifty permissions?

Each one is valid only at one exact nonce, and the wallet's nonce was moving. Fifty numbers in a row made it likely that one would match. Non-matching ones simply fail.

Why can stablecoins be frozen but not bitcoin?

Companies like Tether and Circle issue their stablecoins and can block specific addresses. Bitcoin and ether have no issuer to do that.

When can customers withdraw?

Many can now. Binance began restoring withdrawals on November 1, one network at a time, starting with bitcoin. Coins and networks not yet on its list are still waiting on security checks.

Did the Claude Code extension attack cause this?

Nothing from Binance, TRM or Chainalysis connects them. Some people on Hacker News wondered about it, without evidence.

Is the exact amount settled?

No. Binance says about $6.3B, TRM $6.36B and Chainalysis about $6.4B, and the investigation continues.

Updates

November 2, 2026. Binance completed its Proof of Reserves for the October 31 snapshot, on the November 2 date it had set. Yi He says users holding any of ten tokens can verify their balance was backed at least 1:1, and that another snapshot comes on November 4. Binance reports $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 UTC on November 1, a net outflow of about $3.64 billion, or 2.1% of the $171 billion it held on October 28. Remaining networks are still being tested. The post-mortem isn't out yet. Teng also warned of impersonators offering "priority processing" or compensation claims: Binance says it will never contact you first or charge to speed up a withdrawal.

November 1, 2026. Withdrawals started coming back, bitcoin first, then more networks through the morning. Binance says about 95% of the assets have been replaced. The FBI said on October 31 that North Korea is responsible, named TraderTraitor, published addresses and asked crypto services to block them. The full Proof of Reserves (due November 2) and the post-mortem are still to come. The short version, Who is blamed, What it means, the timeline and the FAQ now reflect this.

October 31, 2026. Binance's own posts added a lot. It has reserved over $6.34 billion, $5 billion of it in the exact tokens taken, and puts the frozen total at $3 billion. Richard Teng confirmed the EIP-7702 route, said the attackers used a self-destruct mechanism to erase their tools, and set two dates: withdrawals back within about 40 hours of October 30, and a full Proof of Reserves by Monday, November 2. A later update says a post-mortem follows. Correction: this page said deposits were suspended. Binance says deposits were unaffected and only withdrawals were paused. The original post and video are now linked too.

October 30, 2026. This page went up. It covers everything known as of October 30, 2026.

Sources

Follow @EmergentMind for the next explainer · YouTube