Binance Hack Explained: How Attackers Drained $6 Billion in 31 Minutes

The Binance hack of October 29, 2026 didn’t require a single stolen private key. An attacker drained roughly $6 billion from the exchange’s hot wallets in about 31 minutes by getting Binance’s own systems to sign the transfers, according to a reconstruction published by BeInCrypto on October 30.

• Size: blockchain analytics firm BitOK traced $6.15 billion across nine blockchains. Binance puts the impact at about $6.3 billion, TRM Labs at $6.36 billion across ten chains and Chainalysis at $6.4 billion.
• Entry point: Binance said a DevOps engineer’s laptop was compromised, giving the attacker access to a service container that sent unauthorized withdrawals.
• Frozen funds: around $3 billion has been frozen on-chain, including $2.3 billion in USDT and USDC, according to Binance.
• Attribution: TRM Labs blames North Korea’s TraderTraitor group, and Chainalysis says the same group likely carried out the attack.
• Response: Binance suspended deposits and withdrawals and pledged to cover all losses.

How the Binance hack unfolded, step by step

BeInCrypto’s timeline, built largely on BitOK’s tracing, covers roughly a day and a half. All times are UTC.

1. October 28: The attacker funds an operator wallet and two helper wallets through the Tornado Cash mixer. BeInCrypto counts six withdrawals; TRM Labs describes three small ones starting that morning.
2. October 29, 02:28: A test version of a wallet-draining smart contract goes live on Ethereum.
3. 13:51-14:24: First rehearsal. Small amounts of USDT and USDC in two attacker-owned wallets are drained successfully.
4. 15:59: The final contract is deployed. Unlike the test version, it can make a delegating wallet execute arbitrary calls, not just send tokens.
5. 16:20-16:47: Second rehearsal with the final contract.
6. 20:04:52-20:35:53: The drain. Hot wallets on Ethereum, Bitcoin, Tron, XRP Ledger, Solana, Base, Optimism, Arbitrum and Avalanche are emptied.
7. Around 20:20: The attacker targets a busy Ethereum hot wallet labelled Binance 14, with a plan built on an EIP-7702 authorization.
8. October 29-30: Binance halts deposits and withdrawals; Tether and Circle freeze linked stablecoins; Chainalysis tells CNN it has high confidence North Korea is responsible.

Background: turning an exchange against itself

Exchanges keep hot wallets online so payouts go out fast, and automated systems sign thousands of transactions a day. Rather than stealing keys, the attacker got those signing systems to approve the theft. Ethereum’s EIP-7702 feature lets a wallet sign an authorization allowing a smart contract to act on its behalf. If a Binance wallet signed one naming the attacker’s contract, that contract could control the wallet.

“The main contract included a function that could execute arbitrary calls on behalf of a wallet that had delegated control to it. The attacker later used that function to drain 823 million USDC from a Binance smart wallet,” BitOK said, as quoted by BeInCrypto.

The haul included 18,270.2 BTC, 197,540 ETH, 2.49 billion USDT, 823 million USDC, 233.46 million XRP and 970,522 SOL. FXStreet’s on-chain breakdown put $3.78 billion of outflows on Ethereum and $1.441 billion on Bitcoin. BitOK flagged the fraudulent transfers by their habits: fees 2 to 2.7 times above normal, transaction formats Binance’s payout software doesn’t use and, on Ethereum, fake transfers slotted between genuine customer payouts. Our earlier coverage details the compromised engineer laptop behind the breach.

For scale, TRM Labs calls it about four times the $1.5 billion Bybit hack of February 2025. Binance held roughly $144 billion in assets before the attack, per DefiLlama data cited by CoinDesk. It also lands in what Axios called “Black October,” weeks after Bitget lost $388 million in a separate hack in September.

Reactions from Binance, analysts and markets

Co-founder Yi He wrote on X that “User funds are safe” and “Binance will cover all hacking losses,” Axios reported. Spokesperson Ross O’Leary said withdrawals were “temporarily suspended” on multiple networks as a precaution, according to TechCrunch. Co-CEO Richard Teng said on X that the attack was a complex process, not a “one-click” action. Changpeng Zhao, who stepped down as CEO in 2023, said he expects user funds to be safe.

Binance said it found “no evidence of any private key leaks from wallets.” CNBC reported that Fundstrat’s Sean Farrell said the breach does not currently appear to create meaningful solvency risk. Markets were less calm: Bitcoin fell below $80,000 and liquidations topped $1 billion in 24 hours, FXStreet reported. See our piece on the market fallout and liquidations.

Data from CoinGecko. The Crypto Fear & Greed Index read 30 (Fear) on October 30.

Outlook after the Binance hack

Yi He expects withdrawals to resume by Sunday, Bloomberg reported. Binance has also promised a detailed technical analysis once its investigation ends. Open questions include exactly how the attacker reached the service container and whether any other controls failed.

The bigger recovery question is the roughly half of the funds that has not been frozen. Stablecoin issuers can freeze addresses, but nobody can freeze native coins like BTC, ETH or TRX, so those assets could still be moved or laundered. For users, the episode is a reminder that assets held on any exchange carry custody risk. A pledge to cover losses is a commitment by the company, and how it is honoured depends on that company.

FAQ

Who was behind the Binance hack?

TRM Labs blames North Korea’s TraderTraitor group, and Chainalysis CEO Jonathan Levin said the group likely carried it out. Chainalysis told CNN it has high confidence North Korea was behind the attack.

How much was stolen?

Estimates range from $6.15 billion (BitOK) to $6.4 billion (Chainalysis), with Binance citing about $6.3 billion. Around $3 billion has been frozen, per Binance.

Were Binance private keys stolen?

Binance says it found no evidence of private key leaks. It says the attacker instead used a compromised laptop and service container to send unauthorized withdrawals that Binance’s systems signed.

Sources

• How Did the Binance Hack Happen? Detailed Investigation of the $6 Billion Heist (BeInCrypto)
• North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (www.trmlabs.com)
• Crypto platform Binance confirms $6.3 bn hack (finance.yahoo.com)
• Binance loses over $6 billion in the largest crypto hack to date (www.coindesk.com)
• Binance pauses withdrawals as hackers suspected of stealing billions in crypto (techcrunch.com)
• Binance halts trading after biggest-ever crypto hack (www.axios.com)
• Binance: North Korea suspected in record $6 billion theft from world's largest crypto exchange (www.cnn.com)
• Binance's $6.3 billion hack: What we know and what comes next (www.cnbc.com)
• Binance likely hacked for an estimated $6B, on-chain data shows (www.fxstreet.com)
• Binance Suspends Deposits, Withdrawals After $6.3 Billion Hack Shakes Industry – Bloomberg (www.bloomberg.com)

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.