On October 29, 2026, attackers took about $6.3 billion from Binance hot wallets, most of it in roughly 20 minutes. It is the largest crypto theft on record, about four times the Bybit hack of February 2025. Binance says it has found no evidence of a private key leak.
That last sentence is the one security teams should sit with. If it holds, the keys stayed secret and the wallets signed anyway.
Binance has been breached or targeted before, but people tend to file it all under one “Binance hack”. That hides the useful part. The major incidents since 2018 failed at different trust boundaries: stolen customer credentials, a broken proof verifier, and now, apparently, the systems that ask keys to sign.
Our take: the control that matters is independent authorization of economic intent. A signer should never approve a transaction just because an authenticated internal service asked.
The 2026 investigation is open as of October 30, 2026, so we mark what is confirmed, what is Binance’s preliminary view, and what is third-party assessment.
Key takeaways
- The October 2026 theft is about $6.3 billion by Binance’s estimate, $6.36 billion by TRM Labs’ count and $6.43 billion by Elliptic’s. About $3 billion is frozen, which is not the same as recovered.
- On Ethereum, one transaction carried 50 pre-signed EIP-7702 authorizations. We confirmed this on-chain. It handed a Binance hot wallet to an attacker-controlled sweeper contract.
- TRM Labs and Chainalysis attribute the attack to North Korea’s TraderTraitor, and Elliptic calls North Korean involvement likely. No government has confirmed that, and Binance has not named anyone.
- The 2019 loss was 7,000 BTC, about $40 million. The 2022 event was a 2 million BNB bridge exploit on BNB Chain, not a Binance.com wallet compromise.
Binance security incidents at a glance
| Incident | What was hit | Amount | How | Outcome |
|---|---|---|---|---|
| March 2018 | User accounts, VIA market | No theft reported | Phished logins, attacker-created API keys | Withdrawals blocked |
| July 2018 | API users, SYS market | No theft reported | Irregular API trading | Trades rolled back, all API keys deleted, SAFU created |
| May 2019 | BTC hot wallet | 7,000 BTC, about $40M | Stolen API keys and 2FA codes, coordinated withdrawal | All left Binance, SAFU covered it |
| October 2022 | BNB Chain bridge | 2M BNB, about $586M | Forged IAVL proof | BSC halted, about $110M left the chain |
| October 2026 | Hot wallets on 10+ chains | About $6.3B | Under investigation: signing path, EIP-7702 on Ethereum | About $3B frozen, Binance covering losses |
2018: attackers learned the API surface
In March 2018, attackers used phishing to take Binance logins, then created trading API keys on those accounts. On March 7 they used the keys to sell victims’ bitcoin and buy Viacoin from 31 accounts the attackers controlled. Binance’s automated risk system halted withdrawals, and the heist failed.
On July 3, 2018, irregular API trading hit the Syscoin market. Binance rolled back the trades and deleted all API keys. It then announced SAFU, funded with 10% of trading fees from July 14, to cover extreme losses. That fund would be needed within a year.
2019: valid credentials crossed the withdrawal boundary
On May 7, 2019, attackers withdrew 7,000 BTC. Binance said they had obtained a large number of user API keys, 2FA codes and potentially other information through phishing, viruses and other attacks. The theft came from a hot wallet holding about 2% of Binance’s BTC, and its other wallets were not affected.
The clever part was the structure. Reporting on Changpeng Zhao’s recap says the withdrawal passed pre-withdrawal risk checks, and monitoring only flagged it after the coins had left. Everything arrived in a single Bitcoin transaction.
That detail explains a long-running discrepancy. The transaction has 44 outputs totalling 7,074.18 BTC, which is where the “7,074” figure comes from. Chainalysis says legitimate Binance transfers shared that transaction, so 7,000 is the better number for the theft. Chainalysis labelled 26 attacker addresses, and on May 8 the funds moved to seven wallets. It credited Binance’s fast disclosure with making a cash-out harder.
Laundering came later. Forensics firm Clain estimated that at least 4,836 BTC went through ChipMixer, an estimate rather than a fully confirmed total. Binance covered the loss from SAFU and announced changes to API, 2FA and withdrawal validation. A proposal to reorganize the Bitcoin chain to undo the theft was floated and dropped.
2022: the keys were fine and the proof check was wrong
The October 2022 attack hit BSC Token Hub, the native bridge between BNB Beacon Chain and BNB Smart Chain. It belongs in this history because BNB Chain grew out of Binance, but it was not a compromise of Binance.com custody.
Coinbase’s investigation is the best public reconstruction. The bug sat in the IAVL library’s root hash calculation: when a proof node had a left child, a right child was ignored. An attacker could add a leaf holding any payload’s hash without changing the root, so a forged proof still verified.
The attacker prepared in the open. The wallet received about 101.5 BNB from ChangeNOW on October 5, then paid the 100 BNB deposit that lets anyone register as a relayer on October 6. At 18:26:46 UTC the first forged message issued 1,000,000 BNB. A second million followed at 20:43:18 UTC. Funding through a swap service does not show that the service knew or took part.
Containment was blunt. BNB Chain contacted validators one by one, 26 active and 44 in total, and BSC stopped for about 8 hours. Coinbase says the halt kept more than $400 million from leaving and puts the amount taken off BSC at about $110 million. Beosin counted about $143.57 million bridged, including lending, so the figure depends on the method. Tether froze the attacker’s address at 21:24:59 UTC. Circle followed at 01:34:34 UTC, after most of the USDC had been swapped.
2026: how $6.3 billion left in 20 minutes
Staging began at least 36 hours earlier, according to TRM Labs. An operator wallet took three small Tornado Cash withdrawals from October 28. On October 29 the operator deployed and tested code, then rehearsed it about four hours before using it on Binance.
The outflow started at 20:05 UTC, when five XRP Ledger wallets sent 233.46 million XRP to one address. Solana and Optimism followed shortly after 20:10. At 20:20, a Bitcoin hot wallet sent 18,270 BTC, which has since been split into 19 addresses. Within two minutes, a Tron wallet sent 612.7 million USDT and 46.4 million TRX.
Ethereum was the largest leg and the most technically interesting. Transaction 0xad99…298b landed at 20:20:59 UTC. It is a type 4 transaction carrying 50 authorizations, sent from the operator to the hot wallet Elliptic calls Binance 14. We checked this directly on-chain.
The 50 is the trick. An EIP-7702 authorization is only valid at the wallet’s current nonce, and a busy hot wallet’s nonce keeps moving. Signing 50 consecutive nonces in advance guaranteed that one would match when the transaction executed. The sweep landed at 20:24:23 UTC. It moved 167,464 ETH and 63 tokens, including 1.615 billion USDT that we confirmed went to 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c.
The delegation stayed live, so later deposits were swept too, the last at 23:56 UTC. Binance 14’s owner rights over another wallet also exposed 823 million USDC. A second wave reached Avalanche and Polygon around 23:05 UTC.
What failed in 2026, as far as anyone can say
Binance’s account. Its initial update said the incident may involve a compromised DevOps engineer’s laptop, which gave access to a service container that could submit unauthorized withdrawals. It then said it had “uncovered additional points of breach”, and co-CEO Richard Teng said the attacker “did not simply use one engineer’s permissions”. Teng has also said, per Elliptic, that the EIP-7702 delegation “did not pass through our normal approval controls”, and that a self-destruct mechanism destroyed tooling as the attack ran.
The on-chain inference. The other chains show why a single stolen key is a poor fit. Wallets using different chains, key types and signing schemes all produced valid signatures within about half an hour. TRM’s assessment is that the attacker could make Binance’s hot wallet signing system sign transactions of its choosing. Elliptic reads it the same way and compares it to Bybit, where the people and systems around the wallets were compromised rather than the cryptography.
What is not known. Nobody outside Binance has explained how a request reached the signers, how the 50 authorizations were produced, or why limits failed on several chains at once. Binance has promised a technical post-mortem. EIP-7702 was also not shown to be a protocol flaw: it was a legitimate feature, used maliciously.
Attribution needs the same care. TRM says TraderTraitor with high confidence, and Chainalysis says the same, citing funds commingling with last month’s Bitget theft. Elliptic says North Korean involvement is likely. These are strong private assessments, but no government has confirmed them.
Freezing bought time, not recovery
The attacker made a costly mistake: holding billions in freezable stablecoins. Tether froze the main receiving wallet at 21:01 UTC, 37 minutes after the sweep, and Circle froze 823 million USDC three minutes later. Ripple, World Liberty Financial and others followed. At 00:08 UTC, the Arbitrum Security Council moved 8,426 ETH and 74.6 million ARB out of the attacker’s reach.
The numbers move by snapshot. TRM counted about $2.7 billion at 00:30 UTC, Elliptic verified $2.84 billion (44% of its total, 94% of it stablecoins) and Binance says about $3 billion. The attacker raced the freezes by selling USDT at a steep discount and borrowing ETH on Aave. Elliptic now puts the unfreezable holdings at about $3.23 billion.
A freeze is not a refund. As TRM’s Ari Redbord told CNBC, “A freeze stops the money from moving, and recovery follows through legal process.” Binance says it will cover all losses from SAFU and company funds, and it has reserved more than $6.34 billion. It is working with the FBI and Secret Service, according to a person familiar with the matter who spoke to Reuters. Withdrawals are suspended as of October 30. Deposits are unaffected.
Three incidents, three trust boundaries
| 2019 | 2022 | 2026 (preliminary) | |
|---|---|---|---|
| Boundary crossed | User identity to withdrawal | Cross-chain proof to bridge | Internal service to signer |
| Key theft shown? | No public evidence | No | No evidence so far, per Binance |
| Control that failed | Pre-withdrawal risk checks | Proof verification | Signing and withdrawal approval, details pending |
| What limited damage | Hot wallet held about 2% of BTC | Validator halt | Issuer freezes, withdrawal pause |
| Root cause confidence | High, initial access incomplete | High | Low to medium |
A valid login can be malicious. A valid-looking proof can be forged. A secret key can sign theft. Each layer trusted the one before it.
Control lessons for custody, exchange and bridge teams
- Separate transaction generation from authorization. The signer should rebuild and evaluate economic intent itself: destination, asset, amount, contract behavior. An authenticated caller is not a reason to sign.
- Enforce limits outside the application plane. Set per-wallet, per-asset and per-chain ceilings that a compromised production system cannot raise.
- Treat delegation as a privileged change. TRM’s advice is direct: reject unexpected EIP-7702 authorizations, treat a request spanning many nonces as an indicator of compromise, and alert when code appears on a treasury wallet. Keep a tested, pre-approved way to sign a revocation.
- Split signing paths by chain and wallet tier. One actor obtaining signatures on ten chains within hours is the blast radius to design against. Run quorum nodes in separate trust zones and administrative domains.
- Size hot wallets to operational need. The 2% figure limited 2019. It is not a universal number, but online liquidity should follow withdrawals, not treasury size.
- Treat DevOps endpoints as custody attack surface. A laptop should have no path to transaction authorization. Use privileged-access workstations, phishing-resistant authentication, short-lived credentials and signed deployments.
- Correlate across accounts and chains. Each transfer can look valid alone. Simultaneous drains on several chains should stop withdrawals automatically.
- Ship telemetry outside the production trust domain. Teng’s self-destruct detail is the argument. Signing requests, policy decisions, container logs and IAM events belong where an attacker cannot erase them.
- Test proof verifiers like safety-critical code. Fuzz malformed proofs, generate adversarial ones and review independently. The 2022 bug sat below normal contract logic.
- Rehearse the first hour. Pre-agree who can pause withdrawals, who calls Tether and Circle, and who publishes addresses. In 2026 the attacker lost billions to a 37-minute response.
- Keep a loss fund, and don’t confuse it with security. SAFU protects users from the consequences. It does nothing about the cause.
- Disclose fast and label your confidence. Binance’s quick 2019 disclosure helped tracing. Say which claims are confirmed, which are hypotheses and which belong to third parties.
Where to check the on-chain record
| Incident | Artifact | Why it matters |
|---|---|---|
| 2019 | e8b406091959700dbffcff30a60b190133721e5c39e89bb5fe23c5a554ab05ea |
Theft transaction, 44 outputs |
| 2022 | 0x489a8756c18c0b8b24ec2a2b9ff3d4d447f79bec |
Main exploiter wallet |
| 2022 | 0xebf83628ba893d35b496121fb8201666b8e09f3cbadf0e269162baa72efe3b8b |
Exploit transaction cited by Coinbase |
| 2026 | 0xad99264d5532ae0dd04b2004eebda05f25657e70dacb764f7ac8d4ccd051298b |
EIP-7702 setup, 50 authorizations |
| 2026 | 0x53bd38b816c23e74134786c29a8c18d792777998a3b9326047b583100e88e2f3 |
Main Ethereum sweep |
| 2026 | 0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c |
Main receiving wallet |
| 2026 | bc1q0mtc2f5agpkvlq6hhahmfr3hlr55kyfjhl2mnm |
Initial Bitcoin receiver, about 18,270 BTC |
How to find this attack path in your own environment
Most readers do not run a hot wallet, but many run a workstation-to-production path that moves money, data or deployments. Jutsu doesn’t sign transactions or monitor blockchains. It helps with the detection and response around that path.
- The Jutsu platform groups related alerts into incidents, including multi-hop chains like lateral movement. A DevOps laptop signal and an unusual cloud API call can land in one investigation instead of two queues. Playbooks can isolate hosts or disable users, with revert, and uncertain cases go to an analyst.
- Red Team runs MITRE ATT&CK-mapped scenarios, including lateral movement and APT chains, against authorized targets. It measures what your SIEM caught and how long that took.
- Exposure shows what attackers can see from outside, which helps with the staging phase.
- Integrations such as AWS CloudTrail, GitHub, Docker containers and macOS and Linux hosts bring the endpoint and cloud events into one place.
For more on how automation should and shouldn’t act alone, read what an agentic SOC is and how AI agents compare with SOAR playbooks.
The bottom line
Binance’s history shows attackers moving up the stack, from customer credentials to verification code to the systems that instruct signers. Cold storage and hardware keys still matter, but neither one judges whether a transaction should exist. A key that stays secret while it signs your theft has protected nothing.
FAQ
How much was stolen in the 2026 Binance hack?
Binance estimates about $6.3 billion. TRM Labs counts about $6.36 billion across ten blockchains, and Elliptic counts $6.43 billion across 11. The gaps come from pricing and from which transfers and chains each one includes. All figures are as of October 30, 2026.
Were Binance private keys stolen?
Binance says it has found no evidence of a wallet private key leak. On-chain analysis suggests the attacker got Binance’s own systems to sign transactions. The post-mortem isn’t out yet, so treat this as preliminary.
Who was behind the Binance hack?
TRM Labs and Chainalysis attribute it to TraderTraitor, a North Korean group, and Elliptic says North Korean involvement is likely. No government has confirmed this, and Binance has not named anyone.
What is EIP-7702 and did it cause the hack?
EIP-7702 lets an ordinary Ethereum wallet delegate its behavior to a smart contract by signing an authorization. The attacker used this to turn a Binance hot wallet into a sweeper. It was a legitimate feature used maliciously, and the open question is how those authorizations got signed.
Has Binance been hacked before?
Yes. In May 2019, attackers stole 7,000 BTC from a hot wallet. Phishing and API attacks in 2018 failed to extract funds. The 2022 exploit of 2 million BNB hit the BNB Chain bridge, not Binance.com wallets.
Will Binance users lose money?
Binance says user funds are safe and that it will cover all losses from SAFU and company funds, with more than $6.34 billion reserved. It plans an updated Proof of Reserves after remediation, which will be the first real test of that claim.