Hey there!

On Thursday, 29 October, attackers took about $6.3 billion in crypto from Binance, one of the world's biggest crypto exchanges. The Binance hack is the largest crypto theft on record, roughly four times the $1.5 billion taken from Bybit in 2025, and most of the money left in about 20 minutes.

In this post I'll go through how the hack appears to have worked, why some of the money could be frozen while the rest couldn't, and where things stand for Binance users. Binance hasn't published its full technical report yet, so parts of this come from blockchain analysis firms and could change.

One quick note: this is an explainer, not financial advice.

What happened during those 20 minutes

According to TRM Labs' analysis of the Binance hack, the main theft began at 20:05 UTC and hit Binance wallets across several blockchains at once. A smaller second wave reached its Avalanche and Polygon wallets about three hours later. TRM puts the total at about $6.36 billion across ten blockchains, using prices at the time of the theft, while Binance estimates about $6.3 billion. Early reports had lower figures, including $5.6 billion.

Ethereum took the biggest hit at about $3.79 billion, followed by 18,270 bitcoin worth about $1.47 billion. Tron, XRP and Solana wallets were hit as well.

The 20 minutes were the end of a longer operation. TRM found activity starting at least 36 hours earlier, including test runs of the attack code and small withdrawals from Tornado Cash, a service that mixes crypto to hide where it came from, to fund the attacker's wallet.

How the attackers got in

The money came from Binance's hot wallets, the internet-connected wallets an exchange uses for everyday withdrawals. Moving funds from one needs a valid signature, which is produced with a secret called a private key.

Binance's early account is that a DevOps engineer's laptop was compromised, giving the attacker a route to an internal service that could submit withdrawals. Binance says it has found no evidence that any wallet private key leaked. It has also since said the attack went further than that laptop, according to Yahoo Finance.

TRM's assessment is that the evidence points to a compromise of Binance's hot wallet signing system, since valid signatures were produced on ten different blockchains. The two accounts could fit together, because someone who can get a signing system to approve transactions doesn't need a copy of the key. That's my reading rather than a confirmed finding, and Binance hasn't published a root cause.

EIP-7702: the feature used to empty the Ethereum wallet

On Ethereum, the attacker used EIP-7702, a feature that lets a normal wallet run smart contract code (a program stored on the blockchain). TRM says it was used to make a Binance hot wallet run the attacker's "sweeper" contract, which empties the wallet and keeps taking anything that arrives later.

The transaction carried 50 pre-signed authorizations. Every wallet has a counter of how many transactions it has sent, and an authorization only works if it matches that counter, so one of the 50 had to line up at the moment it ran. One did. Arkham's on-chain trace says the wallet was swept 3 minutes and 24 seconds later, losing 64 tokens worth $2.53 billion.

EIP-7702 still needed those authorizations to be signed, which is why the investigation centres on Binance's signing system. On the other blockchains, TRM saw ordinary signed transfers with no such trick.

Why $3 billion was frozen and the rest wasn't

Tether blacklisted the attacker's USDT at 21:01 UTC, and Circle froze its USDC about three minutes later, according to Arkham. Stablecoins like these are issued by companies that can block specific addresses. By 00:30 UTC, TRM counted about $2.7 billion frozen, nearly all of it USDT and USDC, and Binance has since put the figure at around $3 billion.

Bitcoin and ether have no issuer who can do the same. TRM estimated that about $2.4 billion was beyond the reach of issuers, including all 18,270 stolen bitcoin.

That difference shaped what the attacker did next. TRM says about $325 million of USDT was sold for ether at a discount of more than 10%, a steep price to pay for an asset that can't be frozen. The FBI has also said the stolen funds are mainly being converted into Ethereum, with more laundering likely.

The North Korea link

TRM attributes the attack with high confidence to TraderTraitor, a North Korean hacking unit, citing similarities with the Bybit hack and the KelpDAO hack in April 2026: Tornado Cash funding, staging in advance and signatures obtained ahead of time. On Saturday, 31 October, the FBI also attributed the theft to TraderTraitor, the group it named for the Bybit hack.

What it means for Binance users

Binance says users won't bear the loss, and it has been buying crypto to replace what was taken. Yahoo Finance reports that its roughly $1 billion emergency fund wasn't enough, so it also drew on its corporate treasury and its Futures Insurance Fund. Binance said it had replaced 90% of the stolen assets by Saturday and about 95% by Sunday. The remainder is smaller tokens outside the top ten, which it says take longer to buy at that scale. These are Binance's own figures.

Withdrawals started coming back in phases on Sunday, 1 November, beginning with bitcoin and assets on 15 other blockchains. Later phases depend on each blockchain passing security checks, so some assets may take longer, and Binance has warned of delays. Yahoo Finance reported about $3.64 billion in net outflows in under 10 hours after withdrawals reopened.

Binance has also told users to rely only on its official channels for updates. That's worth taking seriously, because anyone can post a fake "claim your refund" link during a story this big.

The takeaway

A laptop may have been the way in, but the damage came from what that access could reach: a signing system able to approve billions of dollars of transfers on ten blockchains within minutes. The frozen stablecoins show how much a central issuer can do in an emergency, and the bitcoin still in the attacker's hands shows the limit of that.

The main open question is how the attackers got from that laptop to valid signatures. Binance has promised a detailed technical report and a full proof of reserves, so those are the documents to watch.