What happened
On the evening of October 29, crypto assets worth billions of dollars began leaving the wallets of Binance, the world's largest crypto exchange. Within a few minutes, the exchange's wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and four other blockchains sent their funds to addresses controlled by a single attacker. A second wave of transfers came at about 23:05 UTC: this time, funds were sent from Binance wallets on Avalanche and Polygon.
Binance said it was investigating a possible security issue and then announced a temporary pause on withdrawals on several networks as a precaution. The exchange said that user funds are safe. The situation is still developing, and the figures in this article reflect blockchain data as of 00:30 UTC on October 30.
The largest crypto hack in history: what we know about the $6.3 billion Binance breachOct 30, 2026Read more
Who is behind the attack
The analysis links this attack to TraderTraitor, one of North Korea's best-known hacking groups. This assessment is based on a combination of data obtained both directly from blockchains and from external sources. In February 2025, the FBI named the same group as responsible for the $1.5 billion Bybit hack.
Several features of the current attack match methods previously used in major thefts linked to North Korea. Among them are the Bybit hack and the attack on KelpDAO in April 2026. In both cases, there were small transfers from Tornado Cash to fund the operator's wallet, preparatory actions that began long before the theft, and signatures obtained in advance that were then used almost simultaneously.
At the same time, the laundering method identified so far differs from the scheme used after the Bybit hack. This time, the attacker relied heavily on large swaps through professional market participants and lending protocols, rather than mainly on cross-chain bridges. More details may emerge as the investigation progresses.
How much was stolen
All transfers from Binance-linked wallets to attacker-controlled addresses across ten blockchain networks have been traced. If each transfer is valued at the asset's market price at the time of the theft, the total comes to about $6.36 billion. At current prices, the same assets are worth about $6.23 billion.
Ethereum accounts for about $3.79 billion. This includes 200,630 ETH and 185 other tokens, among them 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD. 18,270 BTC worth about $1.47 billion was drained from the Bitcoin network. On Tron, 612.7 million USDT and 46.4 million TRX were stolen – about $628M. 233.46 million XRP worth about $296M was taken from the XRP Ledger. On Solana, the stolen amount came to 970,500 SOL, or about $96M.
Arbitrum, Optimism and Base together account for about $39M, including 74.6 million ARB drained from Arbitrum. Assets worth about $28M were stolen from Avalanche, and about $10M from Polygon.
How the attack unfolded
Preparation began at least 36 hours before the theft. On the morning of October 28, the operator wallet used to carry out the attack received three small transfers from Tornado Cash – a service that makes it possible to hide the original source of crypto.
Early on the morning of October 29, the attacker deployed the first version of the attack code and tested it on two wallets. Later that day, he tested the final version on a third wallet and then returned the test funds to his own address. Four hours after this test, the same code was installed on a Binance hot wallet.
The first theft that evening took place on the XRP Ledger. Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address. After that, each of the wallets was left with only the minimum balance required for it to exist on the network. The stolen XRP has remained at that address ever since.
Shortly after 20:10 UTC, transfers from Binance wallets on Solana and Optimism followed. At 20:20 UTC, the Binance Bitcoin hot wallet sent 18,270 BTC to the attacker's address. He began splitting the funds into batches of about 1,000 and 100 BTC within a single block. This method is called a peel chain – a chain of sequential transfers in which a large amount is gradually broken into smaller parts. This approach makes it harder to trace the movement of funds. Less than two minutes later, the Binance hot wallet on Tron sent the attacker 612.7 million USDT and 46.4 million TRX.
How the attacker gained control of a Binance hot wallet
In this case, it was one of Binance's best-known hot wallets on Ethereum.
The EIP-7702 mechanism appeared in the Ethereum upgrade called Pectra, which took place in May 2025. It allows a regular crypto wallet to hand control of its actions to a smart contract – a special program on the blockchain – using a signed authorization. After that, all calls to the wallet are executed according to that contract's code. The delegation remains in place until the wallet itself signs a new authorization that changes or revokes the previous setting.
At 20:20 UTC, the operator sent a single transaction containing 50 delegation authorizations. Each of them was signed by the Binance hot wallet and pointed to a sweeper contract that accepted commands only from the operator.
Every wallet has a transaction counter called a nonce. It increases with each new operation. A signed authorization is valid only for the counter value the wallet has at the moment of execution. The Binance hot wallet constantly processes withdrawal requests, so its counter changes all the time.
By preparing signatures in advance for 50 consecutive counter values, the attacker made sure he could use at least one of the authorizations, even if the counter had already changed by the time the transaction was executed. One of the authorizations matched the current value – and that was enough. All the signatures were prepared in advance and sent as a single batch.
Three minutes and 24 seconds after the delegation, the operator instructed the Binance hot wallet to transfer its entire balance to an attacker-controlled address. A single transaction moved 167,464 ETH and 63 other tokens, including 1.615 billion USDT.
The delegation remained in effect. As new funds arrived at the Binance hot wallet, the operator withdrew them again at 20:41, 20:59, 21:04, 21:44, 22:39 and 23:56 UTC.
In addition, this wallet was used to execute operations of a separate Binance smart account. This allowed the attacker to take 823 million USDC from it. Shortly afterward, Circle froze those funds.
The data points to a compromise of Binance's transaction signing system
The first signs of activity on Ethereum suggested that the attacker might have tricked someone into providing signatures for the delegation authorizations. However, this version explains only the events on Ethereum and does not show how funds were drained from the other networks.
During the same period, five Binance wallets on the XRP Ledger, the exchange's wallets on Arbitrum, Avalanche, Optimism and Base, the Bitcoin hot wallet, the Tron hot wallet and the Solana wallet sent funds to the attacker through ordinary signed transfers.
Another Binance hot wallet on Ethereum sent 28,006 ETH, 55.7 million USDT and 25.9 million RLUSD in the same way – without using delegation. About two and a half hours later, at 23:05 UTC, Binance wallets on Avalanche and Polygon joined the transfers.
These wallets operate on different blockchains and use different key types and transaction signing mechanisms. Nevertheless, all of them produced valid signatures for transfers to the attacker within about half an hour.
The batch of 50 pre-signed authorizations may indicate that access to the system was time-limited or that the signatures had to be requested through a particular software mechanism. Binance has not yet published an official explanation of the root cause of the incident.
Stablecoin freezes and swaps of the stolen funds
Stablecoin issuers responded quickly, and the freezes continued throughout the night. At 23:35 UTC, Binance reported that the confirmed amount of frozen funds had reached $2.54 billion. Including later on-chain freezes, about $2.7 billion had been frozen by 00:30 UTC.
- 1. Tether – about 1.77 billion USDT.At 21:01 UTC, 37 minutes after the main withdrawal, Tether froze 971.1 million USDT at the main address that received the stolen assets. Funds from subsequent withdrawals later arrived at the same address. It now holds 1.175 billion USDT. In addition, Tether froze 205 million USDT at two other attacker addresses on Ethereum, 378.7 million USDT at two of his addresses on Tron and 8.4 million USDt on Avalanche. Another 6.2 million USDT0 on Polygon was also locked.
- 2. Circle – about 825 million USDC.At 21:04 UTC, Circle froze 823 million USDC at the main address that received the stolen funds. The operation was carried out in cooperation with law enforcement. The company later blocked another 1.56 million USDC that the attacker obtained by swapping AVAX and moving funds from Avalanche to Ethereum through a cross-chain bridge.
- 3. Ripple – 40.5 million RLUSD.At 22:01 UTC, Ripple blocked the wallet holding the stolen RLUSD. At that point, 40.5 million of the 88.5 million RLUSD remained on it. The company also froze RLUSD on the compromised Binance hot wallet so that new incoming funds could not be withdrawn. Binance co-CEO Yi He said that Ripple's help made it possible to stop the transfer of about $200M. At the same time, the freeze of 40.5 million RLUSD is confirmed on the blockchain.
- 4. World Liberty Financial – 27.8 million USD1.At 22:10 UTC, World Liberty Financial froze 27.8 million USD1 held at the main receiving address. Another USD1 freeze on the compromised Binance hot wallet was carried out at 22:26 UTC.
- 5. Arbitrum Security Council – 8,426 ETH and 74.6 million ARB.The Arbitrum Security Council is a group with the authority to take emergency measures on the Arbitrum network. At 00:08 UTC, it used these powers to force two transfers from the attacker's wallet on Arbitrum. In this way, 8,426 ETH and 74.6 million ARB with a total value of about $30M were taken out of his control.
In the first hours after the attack, the attacker tried to swap stablecoins that issuers could freeze for assets that cannot be blocked this way. This came at a significant financial cost.
- About 325 million USDT was sold to professional market participants and market makers through UniswapX and other contracts that work on the basis of pre-agreed swap terms. In return, the attacker received about 122,300 ETH. The resulting price was about $2,650 per ETH, while ETH was trading in the $2,300–2,350 range at the time. In other words, the swap went through at a discount of more than 10%. The remaining 175 million USDT from this batch was frozen.
- Another attacker wallet deposited 60 million USDT into the Aave lending protocol and borrowed about 19,760 ETH against it. Aave then froze the affected markets.
- On Tron, 300 million USDT was moved to a wallet that began placing these funds in the JustLend lending protocol. Another 200 million USDT passed through a chain of intermediary wallets, where it was swapped on Uniswap. 30 million USDT from this chain was frozen.
- The stolen 88.5 million RLUSD passed through two intermediary addresses and arrived at a wallet from which 48 million tokens were sold through decentralized exchanges between 21:42 and 22:01 UTC. The remaining 40.5 million RLUSD was frozen by Ripple.
After the ETH was concentrated in several wallets and the 18,270 BTC continued moving along the chain of sequential transfers, about $2.4 billion in assets that issuers cannot freeze remained under the attacker's control.
Based on previous major thefts, the next stage may involve transfers through cross-chain bridges, swap services and OTC brokers. Tracing continues both for the funds moving along the chain of sequential transfers and for the wallets where the stolen assets are concentrated.
What exchanges and compliance specialists should do now
Crypto exchanges and compliance specialists should screen incoming deposits and counterparties for links to the attacker addresses that have already been identified and labeled during the investigation. In the coming days, funds from the chain of transfers of the stolen bitcoins and from the wallets where the ETH is concentrated may reach exchanges, swap services and OTC trading desks.
Treasury teams should monitor EIP-7702 delegations in Ethereum-compatible wallets. Such a delegation shows up as program code at an address where, under normal conditions, there should be none. Any such change in a treasury wallet should immediately trigger a security alert. In addition, teams should have a pre-agreed and tested way to sign an authorization that revokes the delegation.
Transaction signing policies should reject EIP-7702 authorizations unless they were planned in advance. A request for a large number of authorizations for a consecutive range of transaction counter values should be treated as a possible sign of compromise.
Transaction signing infrastructure and approval procedures need to be separated by blockchain and by wallet tier. In this incident, a single attacker managed to obtain valid signatures for wallets on ten networks within a few hours.
