Key takeaways
- Binance's own account is a compromised DevOps laptop that gave an attacker access to a service container, plus additional points of breach it hasn't detailed.
- TRM Labs says one transaction carried 50 authorizations pointing a Binance hot wallet at a sweeper contract, and about 3 minutes 24 seconds later the wallet was told to send out its whole balance.
- Elliptic says the attacker rehearsed beforehand and ran pre-signed transactions in a single burst, funded through small Tornado Cash withdrawals.
- The EIP-7702 and malicious-code details are TRM's suspicions, not Binance-confirmed findings, and attribution to North Korea comes from private analytics firms.
Binance lost about $6.3 billion in crypto on Thursday, Oct. 29, 2026, in what researchers are calling the largest crypto theft ever. Binance has said it will cover customer losses, but it hasn’t published a full technical account. TRM Labs, Elliptic and Binance have each supplied a fragment, and they only make sense when put side by side.
This piece does that, and labels each claim as confirmed, reported or suspected. For the broader timeline, see our earlier piece on how the Binance hack worked, from laptop to 20-minute burst.
What does Binance say happened?
Binance’s first explanation was that a DevOps engineer’s laptop may have been compromised. That gave an attacker a way into a service container, from which unauthorized withdrawals were submitted. Binance also said it found no evidence that wallet private keys leaked.
That explanation didn’t last long as the full story. Binance later said investigators had found additional points of breach and called the attack complex. Co-CEO Richard Teng pushed back on the idea that one engineer’s access was the whole story. He told reporters the intruder went beyond a single engineer’s access, that it wasn’t a one-click action, and that it involved “a more complex attack process.”
Binance has promised more technical detail once its findings are verified. It hasn’t named a threat actor.
The sweeper step TRM describes
According to TRM Labs, the key transaction carried 50 authorizations. Each was signed by a Binance hot wallet and pointed that wallet to a sweeper contract that obeys only the attacker’s operator. About 3 minutes 24 seconds later, the operator told the wallet to transfer everything it held to an address the attacker controlled.
That one sweep carried 167,464 ETH plus 63 tokens, among them 1.615 billion USDT, per TRM. Tom’s Hardware said the drained wallets included Hot Wallet 34 and two others labeled Binance 14 and Binance 16.
TRM suspects the attackers used EIP-7702, an Ethereum upgrade that went live in May 2025, to automate these transfers. The word to hold onto is suspects. Binance hasn’t confirmed it. But the structure is easy to picture: the wallet signs its own delegation, the contract takes over, and the operator needs no further signature from Binance’s side.
Was the signing system the real target?
TRM thinks so. It suspects the attacker could make Binance’s hot-wallet signing system sign transactions of the attacker’s choosing, across multiple chains, and that malicious code on Binance’s internal wallet system was involved. TRM counts roughly $6.36 billion stolen across ten blockchains.
This squares with Binance’s statement that no private key leak has been found. If an attacker can get your own signer to produce valid signatures, they don’t need the keys. Nobody has confirmed that’s what happened, though, and Binance’s additional points of breach could mean something else entirely.
Elliptic adds the preparation. It says the attacker funded a wallet with small Tornado Cash withdrawals, rehearsed beforehand, and then ran pre-signed transactions in one burst. TRM says most funds left over roughly 20 minutes, beginning at 20:05 UTC.
One loose end: Elliptic talks about pre-signed transactions, while TRM describes authorizations signed by the hot wallet. The two accounts may describe the same mechanism from different angles or two different stages. Neither firm has said which.
What’s confirmed and what isn’t
- Binance says: a DevOps laptop may have been compromised, an attacker reached a service container, unauthorized withdrawals followed, no private key leak found, more breach points exist.
- Analytics firms report: the 50-authorization transaction and sweeper contract (TRM), the Tornado Cash funding and rehearsal (Elliptic), and North Korea’s TraderTraitor group as the likely actor. TRM puts that at high confidence; Chainalysis and Elliptic also point to North Korea.
- Still suspicion: EIP-7702 abuse, malicious code on the internal wallet system, and the ability to make the signer sign arbitrary transactions.
No government has formally attributed the theft. The attribution rests on private firms, and Binance itself stayed silent on who did it.
What to audit if you run a hot wallet
None of the vendors has published a fix list, so this is my reading of the pattern, not a finding. The attack chain they describe runs from a developer machine to a container to a signer, so that’s where I’d look first.
- Who can reach the signer. Map every path from a laptop, CI job or container to the signing service. If one engineer’s compromised machine can submit withdrawals, the setup is too trusting.
- What the signer will sign. A hot wallet signing 50 authorizations in one transaction is unusual. Allowlist destinations and contract targets, and treat delegation-style authorizations as something to block or review by default.
- Outflow limits per chain. The money left across ten chains in about 20 minutes. Velocity caps and automatic halts would have forced a human into the loop.
- Watch for rehearsals. Small Tornado Cash-funded wallets probing your infrastructure before the real event is a signal worth alerting on.
- Harden the people. Phishable logins on engineer accounts are the cheapest door. A hardware security key such as a YubiKey 5 NFC is the usual fix, though nobody has said that any particular login control was missing at Binance.
Developer tooling is its own attack surface. We covered a Claude Code extension backdoor that used Anthropic’s real ID, and that kind of trust abuse is the same family of problem.
Why it matters if you’re just a Binance user
Binance says user funds are safe and that it will cover all losses from its SAFU emergency fund and company funds. It says it has set aside over $6.34 billion, $5 billion of it in the same token types that were stolen. It also plans to publish an updated Proof of Reserves when remediation is done.
Binance.US says it wasn’t affected, and Coinbase says it was unaffected and is monitoring. Binance has warned about impersonation scams by email, SMS and phone, especially fake compensation or withdrawal restoration offers. Treat any of those as fraud and go only to Binance’s official site.
Withdrawals were suspended at first. TechSpot reported Friday that deposits were operating normally while withdrawals remained suspended, with Binance expecting them back within a day or two.
What we still don’t know
The biggest gap is the one Binance has flagged itself: what the additional points of breach were beyond the laptop. Until the company publishes verified findings, the EIP-7702 account stays a hypothesis, however plausible.
The total isn’t settled either. Figures run from $6.3 billion in headline reports to $6.36 billion from TRM and about $6.4 billion from Chainalysis. Tom’s Hardware’s early $5.6 billion tally was preliminary. Frozen amounts differ too: Binance claims $3 billion, while TRM counts roughly $2.7 billion including Arbitrum’s freeze. A freeze isn’t a recovery. TRM says the attacker sold USDT to market makers and borrowed ETH against it on Aave, and now holds over 420,000 ETH and 18,270 BTC that no issuer can freeze.
Axios raised the possibility that AI sped up the operation. No outlet has shown AI was actually used. And whether other exchanges now face copycat attacks using the same technique is not yet reported.
Tools & products mentioned
- YubiKey 5 NFC on Amazon — Check current price
Disclosure: some links in this article are affiliate links or our editor's own courses and book. If you buy through them, TechyCluster or its editor may earn money at no extra cost to you. This does not influence what we cover or how we cover it. As an Amazon Associate, TechyCluster earns from qualifying purchases.
Frequently asked questions
How did hackers steal $6.3 billion from Binance?
Binance says a compromised DevOps laptop let an attacker reach a service container and submit unauthorized withdrawals, with additional breach points still being detailed. TRM Labs suspects malicious code on the wallet system and abuse of EIP-7702, but Binance hasn't confirmed that.
What is the EIP-7702 sweeper TRM describes?
TRM says one transaction carried 50 authorizations signed by a Binance hot wallet, each pointing it to a contract that obeys only the operator. About 3 minutes 24 seconds later the operator ordered the wallet to send its whole balance out.
Did attackers steal Binance's private keys?
Binance said it found no evidence that wallet private keys leaked. TRM suspects the attacker instead got the signing system to sign transactions of its choosing. That is a suspicion, not a confirmed finding.
Who is blamed for the Binance hack?
TRM Labs attributes it to North Korea's TraderTraitor group with high confidence, and Chainalysis and Elliptic also point to North Korea. Binance hasn't named a threat actor, and no government attribution has been reported.
Get the next one in your inbox. One email a day with the tech stories that matter, explained in plain English. Subscribe free.
Sources
This article was compiled from reporting by the following outlets. Links go to the original reports.
- Axios: How North Korea perfected the crypto heist
- The Guardian US Tech: North Korea is likely culprit behind $6.3bn crypto hack, ‘largest heist in history’
- TechSpot: Binance loses $6.3 billion in largest crypto heist ever
- PCMag: North Koreans Likely Behind Binance Hack, Now the Largest Crypto Heist
- Tom's Hardware: Suspected North Korean hackers steal $5.6 billion in crypto in record-breaking cryptocurrency heist, Binance withdrawals frozen
- BleepingComputer: Binance links $6.3 billion crypto theft to compromised DevOps laptop
