Hackers stole approximately $6.3 billion in cryptocurrency from Binance after breaching the exchange’s wallet-signing infrastructure and exploiting a feature on the Ethereum blockchain to redirect digital assets into accounts they controlled.
The attack, which unfolded on Thursday, October 29, 2026, affected wallets across 10 blockchain networks, with most of the money moving within approximately 20 minutes.
Blockchain intelligence firm TRM Labs estimated the stolen assets at $6.36 billion, making the incident the largest cryptocurrency theft on record.
The attackers targeted Binance’s hot wallets, which remain connected to the internet to facilitate cryptocurrency transactions and withdrawals.
They allegedly gained access to the systems responsible for authorising transactions, allowing them to move funds without following the exchange’s normal security procedures.
Binance’s initial investigation pointed to a compromised laptop belonging to a DevOps engineer.
However, the exchange later disclosed that investigators had discovered additional points of breach, suggesting a more extensive intrusion into its internal infrastructure.
In a video statement on Friday, October 30, Binance co-CEO Richard Teng described the incident as a sophisticated operation.
“This was a complex attack,” Teng said, explaining that investigators were still working to establish the full sequence of events.
How hackers accessed Binance’s systems
Binance’s preliminary findings suggested that the attackers compromised a DevOps engineer’s laptop before using the access to reach an internal service container.
A service container is an isolated computing environment that allows software applications and their supporting processes to run.
Access to such an environment can expose internal systems and functions, depending on the permissions available to an attacker.
Binance said the intrusion enabled the attackers to submit unauthorised withdrawal transactions.
The investigation later uncovered additional points of breach across the exchange’s infrastructure.
Teng also said the attackers deployed a self-destruct mechanism to erase operational tools and digital traces, complicating efforts to reconstruct the incident.
Binance has not yet published a complete technical account explaining how the attackers obtained their initial access or moved between internal systems.
The exchange, however, said it had found no evidence that its wallet private keys had leaked.
“At this stage, we have found no evidence that wallet private keys were leaked,” Binance stated in its initial security update.
How the attackers drained the wallets
Investigators identified Ethereum’s EIP-7702 account-delegation feature as a central part of the attack on one of Binance’s hot wallets.
EIP-7702 is an Ethereum protocol feature introduced through the network’s Pectra upgrade.
It allows an externally owned account, such as a regular cryptocurrency wallet, to temporarily delegate certain functions to smart-contract code through a signed authorisation.
The feature has legitimate uses, including making wallet transactions more flexible. However, attackers can abuse it if they obtain the necessary authorisations.
According to TRM Labs, the hackers prepared 50 signed authorisations before executing the Ethereum operation.
They submitted these authorisations in a transaction designed to give a smart contract control over the Binance hot wallet.
The contract functioned as a sweeper, automatically redirecting funds from the compromised wallet to an address controlled by the attackers.
TRM Labs reported that the attackers successfully activated the delegation at approximately 20:20 UTC.
A subsequent instruction transferred 167,464 ETH and other tokens, including approximately $1.615 billion in USDT, to an attacker-controlled address.
The attackers continued sweeping funds as additional assets entered the compromised wallet.
The Ethereum operation formed part of a wider attack.
TRM Labs traced unauthorised transfers involving Binance wallets on the XRP Ledger, Bitcoin, Tron, Solana, Arbitrum, Avalanche, Optimism, Base and Polygon.
The transfers across these networks suggested that the attackers had gained access beyond a single Ethereum wallet.
TRM assessed that the attackers most likely compromised Binance’s hot-wallet signing infrastructure, enabling them to obtain valid transaction signatures across several blockchains.
North Korea-linked hackers suspected
Blockchain intelligence firms TRM Labs and Chainalysis attributed the attack with high confidence to TraderTraitor, a cybercrime group linked to North Korea.
TRM said the attackers’ methods and transaction patterns resembled previous operations associated with the group, including the February 2025 Bybit hack, which resulted in approximately $1.5 billion in losses.
Investigators also identified similarities in how the attackers prepared their cryptocurrency wallets and moved the stolen assets.
However, Binance has not officially confirmed the identity of the perpetrators.
Richard Teng said the exchange was working with law enforcement agencies and intelligence partners to establish who carried out
The scale of the breach has renewed concerns about the security of cryptocurrency exchanges, particularly the systems that authorise transactions from internet-connected wallets.
